Secure Communication System For Mobile Devices

• US 20110131406A1
• Filed: 10/30/2010
• Published: 06/02/2011
• Est. Priority Date: 10/31/2009
• Status: Active Grant

• Current Assignee: Saife Inc.
• Original Assignee: Saife Inc.
• Inventors: Jones, James C., Cummings, Darren
• Granted Patent: US 8,392,699 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 65/1053 IP private branch exchange [PBX] functionality entities or arrangements circuit switched PBXs H04M3/00
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3252 using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

A comprehensive solution for providing secure mobile communication is provided. The system includes techniques for authentication and control of communication end-points; chain of trust to ensure devices are certified as authentic; contact list management; peer-to-peer encrypted voice, email, and texting communication; and a technique for bypassing an IP PBX to ensure high levels of security. The system is able to support use of commodity mobile communication devices (e.g., smart phones, laptops) over public carrier networks.

Claims

1. A system for providing secure communication via a public carrier network, comprising:

stored in each mobile device that is in communication with another such mobile device via the network, an application configured to effect, by the mobile device, encryption of data packets sent to, and decryption of data packets received from, the other mobile device, the data packets containing information enabling the communication;

wherein each of the mobile devices involved in the communication is configured to initially determine whether such secure communication with the other device is allowed.

2. The system of claim 1, wherein each of the mobile devices is configured with a shadow contact list such that the secure communication is only allowed between mobile devices each having the other in its shadow contact list.

3. The system of claim 1, wherein each of a pair of mobile devices performs mutual authentication to determine whether the secure communication is allowed.

4. The system of claim 1, further comprising:

a Certificate Authority having ultimate trust authority; and

a plurality of C3i computers for provisioning other devices;

wherein each of the C3i computers was provisioned by an already-provisioned C3i computer or the Certificate Authority.

5. The system of claim 4, wherein at least one of the C3i computers was provisioned by an already-provisioned C3i computer.

6. The system of claim 1, wherein the communication is one of voice communication, e-mail communication, and SMS communication.

7. The system of claim 6, wherein when the communication is SMS communication, several separate SMS messages are generated when there is insufficient space to transmit encrypted information with one SMS message alone.

8. The system of claim 7, wherein the separate SMS are sequenced using a sequence number stored in a header portion of each SMS message transmitted.

9. The system of claim 1, further including a message broker, the message broker for providing asynchronous messaging.

10. The system of claim 4, wherein a C3i computer is able to update a list by forwarding information related to the update of the list to a message broker, and each of the mobile devices affected by the update is able to receive the information from the message broker.

11. The system of claim 10, wherein the receipt of the information by an affected mobile devices is done by one of the affected mobile device polling the message broker for messages and pushing the information to the affected mobile device.

12. The system of claim 1, wherein the application is further configured to effect, by the mobile device, wiping data from the memory of the mobile device responsive to a panic indication.

13. The system of claim 12, wherein a predetermined portion of the memory of the mobile device is set to a predetermined value to reduce the number of operations needed to perform the wiping.

14. The system of claim 1, wherein the encryption of the data packets is done using the Station-to-Station (STS) protocol.

15. The system of claim 1, further including:

a Voice server; and

a proxy;

wherein, in operation,

a first mobile device sends an initiation request to the Voice server;

the Voice server, responsive to the initiation request, provides an address of the proxy;

the first mobile device sends an SMS message to a second mobile device, the SMS message including the address of the proxy; and

the first mobile device and the second mobile device form a communication path by each connecting to the proxy at the address of the proxy.

18. The method of claim 14, wherein each of a pair of mobile devices performs mutual authentication to determine whether the secure communication is allowed.

19. The system of claim 1, further comprising:

a Certificate Authority having ultimate trust authority; and

a plurality of C3i computers for provisioning other devices;

wherein each of the C3i computers was provisioned by an already-provisioned C3i computer or the Certificate Authority.

16. A method for providing secure communication via a public carrier network, comprising:

storing, in each mobile device that is in communication with another such mobile device via the network, an application configured to effect, by the mobile device, encryption of data packets sent to, and decryption of data packets received from, the other mobile device, the data packets containing information enabling the communication;

wherein each of the mobile devices involved in the communication is configured to initially determine whether such secure communication with the other device is allowed.

17. The method of claim 16, wherein each of the mobile devices is configured with a shadow contact list such that the secure communication is only allowed between mobile devices each having the other in its shadow contact list.

20. A computer-readable medium which stores a set of instructions which when executed performs a method for providing secure communication via a public carrier network, comprising:

storing, in each mobile device that is in communication with another such mobile device via the network, an application configured to effect, by the mobile device, encryption of data packets sent to, and decryption of data packets received from, the other mobile device, the data packets containing information enabling the communication;

wherein each of the mobile devices involved in the communication is configured to initially determine whether such secure communication with the other device is allowed.