Secure instant messaging

• US 20070003065A1
• Filed: 06/30/2005
• Published: 01/04/2007
• Est. Priority Date: 06/30/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Schwartz, Eyal, Holmes, John, Ford, Peter
• Granted Patent: US 7,949,873 B2
• Time in Patent Office: Days
• US Class Current: 380/286
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Secure instant messaging is described. In an embodiment, a messaging device encrypts a challenge identifier to generate an encrypted challenge message, and communicates the encrypted challenge message via a peer-to-peer communication link to a recipient messaging device. The recipient messaging device decrypts the encrypted challenge message and encrypts the challenge identifier as a return challenge identifier to generate an encrypted challenge return. The messaging device receives the encrypted challenge return from the recipient messaging device, decrypts the encrypted challenge return, and verifies that the return challenge identifier matches the challenge identifier to establish that communications are secure when communicated via the peer-to-peer communication link and, optionally, to establish control policies pertaining to a communication received at the recipient messaging device.

Claims

1. A method, comprising:

establishing a peer-to-peer communication link for real-time communication of secure communications with a recipient messaging device;

establishing that encrypted communications are secure when communicating via the peer-to-peer communication link with the recipient messaging device;

encrypting a communication to generate an encrypted communication that includes a control policy to limit use of the communication when received by the recipient messaging device; and

communicating the encrypted communication via the peer-to-peer communication link to the recipient messaging device.

2. A method as recited in claim 1, wherein the control policy designates the extent to which the recipient messaging device can at least one of distribute or use the communication after being decrypted.

3. A method as recited in claim 1, wherein the control policy designates the extent to which the recipient messaging device can maintain the communication for future reference after being decrypted.

4. A method as recited in claim 1, wherein the control policy designates the extent to which a user of the recipient messaging device can at least one of maintain, use, or distribute the communication after being decrypted at the recipient messaging device.

5. A method as recited in claim 1, wherein the control policy precludes distribution of the communication and additional data associated with the communication.

6. A method as recited in claim 1, wherein the control policy designates that a communication application at the recipient messaging device be validated by a digital rights management service to receive and decrypt the encrypted communication.

7. A method as recited in claim 1, wherein the communication includes at least one of an instant message, a file transfer, an image transfer, a text-based communication, an audio communication, a video communication, or an audio/video communication that is encrypted and communicated via the peer-to-peer communication link to the recipient messaging device as a secure communication.

8. An instant messaging system, comprising:

a peer-to-peer communication link configured for real-time communication of secure instant messages;

a first messaging device configured to establish that encrypted instant messages are secure when communicated from the first messaging device to a second messaging device via the peer-to-peer communication link; and

the second messaging device configured to decrypt an instant message received from the first messaging device, and further configured to conform to a control policy implemented to limit use of the instant message when received and decrypted.

9. An instant messaging system as recited in claim 8, wherein the first messaging device is further configured to encrypt the instant message with an encryption key embedded in an issuance license that is associated with the second messaging device, the issuance license including the control policy to limit use of the instant message when received by the second messaging device.

10. An instant messaging system as recited in claim 9, wherein the control policy designates the extent to which the second messaging device can distribute the instant message after being decrypted.

11. An instant messaging system as recited in claim 9, wherein the control policy designates the extent to which the second messaging device can maintain the instant message for future reference after being decrypted.

12. An instant messaging system as recited in claim 9, wherein the control policy designates the extent to which a user of the second messaging device can at least one of maintain, use, or distribute the instant message after being decrypted.

13. An instant messaging system as recited in claim 9, wherein the control policy precludes distribution of the instant message and additional data associated with the instant message.

14. An instant messaging system as recited in claim 9, wherein the control policy designates that an instant messaging application at the second messaging device be validated by a digital rights management service to receive and decrypt the instant message.

15. One or more computer readable media comprising computer executable instructions that, when executed, direct an instant messaging device to:

establish a peer-to-peer communication link for secure instant messaging;

validate that an encrypted instant message is secure when communicating via the peer-to-peer communication link;

encrypt an instant message to generate the encrypted instant message which includes a control policy to limit use of the instant message; and

communicate the encrypted instant message via the peer-to-peer communication link to a second instant messaging device.

16. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed, direct the instant messaging device to designate via the control policy the extent to which the second instant messaging device can distribute the instant message after being decrypted.

17. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed, direct the instant messaging device to designate via the control policy the extent to which the second instant messaging device can maintain the instant message for future reference after being decrypted.

18. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed, direct the instant messaging device to designate via the control policy the extent to which a user at the second instant messaging device can at least one of maintain, use, or distribute the instant message after being decrypted at the second instant messaging device.

19. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed, direct the instant messaging device to designate via the control policy to preclude distribution of the instant message and additional data associated with the instant message.

20. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed, direct the instant messaging device to designate via the control policy that an instant messaging application at the second instant messaging device be validated by a digital rights management service to receive and decrypt the encrypted instant message.