Secure instant messaging system

• US 7,131,003 B2
• Filed: 02/20/2003
• Issued: 10/31/2006
• Est. Priority Date: 02/20/2003
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Inventors: Uberti, Justin, Hayes, Terry N., Lord, Robert B.
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Sherkat, Arezoo
• Application Number:
  US10/371,601
• Publication Number:
  US 20040168055A1
• Time in Patent Office: 1,349 Days
• Field of Search: 713200-201, 713/153, 713/156, 713/173, 713/155, 713/168, 709/246, 379/88.12
• US Class Current: 713/168
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure instant messaging system integrates secure text instant messaging and secure file transfers into existing instant messaging systems. At least one certificate authority (CA) is provided that issues a security certificate to a user that binds the user'"'"'s instant messaging screen name to a public key which is used by other users to encrypt messages and files sent to the user and by the user to decrypt the received messages and files. A subscriber database is used by the CA to keep track of valid users and their associated information, such as: user screen names, user subscription expiration dates, and enrollment agent information. A user sends his certificate to the invention'"'"'s instant messaging server which publishes the user'"'"'s certificate to other users by creating a hash value of the user'"'"'s certificate and sending it to the other users which allows the recipients to decide if they need to update their caches with a new copy of the user'"'"'s certificate. Instant messages and files are encrypted by a sending user using an encryption algorithm and the recipient'"'"'s certificate. The sending user can sign instant messages using his private signing key. The security status of each received instant message is displayed to the user.

Claims

1. A process for the secure transmission and reception of data files and text messages via an instant messaging system across a computer network, comprising the steps of:

providing an instant messaging server;

providing at least one certificate authority;

wherein said at least one certificate authority issues a certificate to a user that links a user'"'"'s screen name with a public key value;

providing a first instant messaging client;

wherein said first instant messaging client is associated with a first user;

wherein the first user has an associated screen name; and

wherein the first user obtains a certificate from said at least one certificate authority;

wherein said first instant messaging client sends the first user'"'"'s certificate to said instant messaging server for publishing, and wherein said instant messaging server makes the first user'"'"'s certificate available to any of;

the first user'"'"'s list of preferred users and users that have the first user on their list of preferred users; and

wherein said first instant messaging client sends the first user'"'"'s status information for his certificate along with his certificate to said instant messaging server, and wherein said instant messaging server makes the first user'"'"'s status information available to any of;

the first user'"'"'s list of preferred users and users that have the first user on their list of preferred users.

2. The process of claim 1, further comprising the step of:

providing a subscriber database; and

wherein said subscriber database includes, but is not limited to;

user screen names, user subscription expiration dates, and enrollment agent information for users.

3. The process of claim 1, further comprising the step of:

providing a second instant messaging client;

wherein said second instant messaging client is associated with a second user; and

wherein the second user has an associated screen name.

4. The process of claim 3, further comprising the steps of:

providing publishing means on said instant messaging server for calculating a hash value for the first user'"'"'s certificate and sending said hash value to any of;

the users in the first user'"'"'s list of preferred users and users that have the first user on their list of preferred users;

wherein the second user is on the first user'"'"'s list of preferred users and/or has the first user on his list of preferred users;

wherein said second instant messaging client receives said hash value;

providing hash comparison means on said second instant messaging client for comparing said hash value with a hash value for the first user'"'"'s certificate stored in a cache; and

wherein if said hash comparison means finds that said hash value does not match said cached hash value or said cached hash value does not exist, then said second instant messaging client requests the first user'"'"'s certificate from said instant messaging server.

5. The process of claim 4, wherein said instant messenger server sends the first user'"'"'s certificate and said hash value in response to said second instant messaging client'"'"'s request, and wherein said second instant messaging client stores the first user'"'"'s certificate and said hash value in said cache.

6. The process of claim 4, wherein said second instant messaging client uses the first user'"'"'s certificate to encrypt an instant text message to the first user;

wherein said second instant messaging client sends said encrypted instant text message to said instant messaging server, and wherein said instant messaging server forwards said encrypted instant text message to said first instant messaging client if the first user is logged on.

7. The process of claim 6, wherein said first instant messaging client receives said encrypted instant text message from said instant messaging server and decrypts said encrypted instant text message using the first user'"'"'s certificate.

8. The process of claim 7, wherein said first instant messaging client reuses an encryption key value obtained from decrypting said encrypted instant text message in subsequent messages during an instant message conversation with said second instant messaging client.

9. The process of claim 1, wherein said first instant messaging client displays instant messages received and their security status.

10. The process of claim 7, wherein said second instant messaging client attaches an encryption algorithm that was used to encrypt said encrypted instant text message to said encrypted instant text message, and wherein said first instant messaging client uses said encryption algorithm to decrypt said encrypted instant text message.

11. The process of claim 7, wherein said second instant messaging client wraps said encrypted instant text message using a wrapping algorithm and wrapping key, wherein said second instant messaging client attaches said wrapping algorithm and said wrapping key to said encrypted instant text message, and wherein said first instant messaging client extracts said wrapping key from said encrypted instant text message and uses said wrapping algorithm and said wrapping key to unwrap said encrypted instant text message.

12. The process of claim 4, wherein said second instant messaging client uses the first user'"'"'s certificate to encrypt a data file to the first user;

wherein said second instant messaging client sends said encrypted file to said instant messaging server, and wherein said instant messaging server forwards said encrypted file to said first instant messaging client if the first user is logged on.

13. The process of claim 12, wherein said first instant messaging client receives said encrypted file from said instant messaging server and decrypts said encrypted file using the first user'"'"'s certificate.

14. The process of claim 12, wherein if a file transfer to said first instant messaging client has been terminated before an encrypted file has been fully transferred, then said first instant messaging client requests any remaining portions of an encrypted file from said second instant messaging client, wherein said second instant messaging client sends remaining portions of said encrypted file to said instant messaging server, and wherein said instant messaging server forwards said encrypted file portions to said first instant messaging client.

15. The process of claim 12, wherein said second instant messaging client attaches an encryption algorithm that was used to encrypt said encrypted file to said encrypted file, and wherein said first instant messaging client uses said encryption algorithm to decrypt said encrypted file.

16. The process of claim 12, wherein said second instant messaging client wraps said encrypted file using a wrapping algorithm and wrapping key, wherein said second instant messaging client attaches said wrapping algorithm and said wrapping key to said encrypted file, and wherein said first instant messaging client extracts said wrapping key from said encrypted file and uses said wrapping algorithm and said wrapping key to unwrap said encrypted file.

17. The process of claim 4, wherein said first instant messaging client uses the first user'"'"'s certificate to sign an instant text message to the second user;

wherein said first instant messaging client sends said signed instant text message to said instant messaging server, and wherein said instant messaging server forwards said signed instant text message to said second instant messaging client if the first user is logged on.

18. The process of claim 17, wherein said second instant messaging client receives said signed instant text message from said instant messaging server and verifies said signed instant text message using the first user'"'"'s certificate.

19. The process of claim 18, wherein said first instant messaging client reuses a signature value in subsequent messages during an instant message conversation with said second instant messaging client.

20. The process of claim 3, further comprising the step of:

escrowing a set of encryption keys;

wherein instant messaging clients belonging to a company encrypt instant messages to the escrowed keys to enable recovery; and

wherein said escrowed encryption keys allows said company'"'"'s officials to recover the contents of messages when required.

21. The process of claim 20, further comprising the step of:

providing an audit log proxy; and

wherein said audit log proxy records messages sent in and out of said company.

22. The process of claim 20, wherein said audit log proxy enforces an audit/escrow policy by blocking messages that are not encrypted using an escrowed key.

23. An apparatus for the secure transmission and reception of data files and text messages via an instant messaging system across a computer network, comprising:

an instant messaging server;

at least one certificate authority, wherein said at least one certificate authority issues a certificate to a user that links a user'"'"'s screen name with a public key value;

a first instant messaging client, wherein said first instant messaging client is associated with a first user;

wherein the first user has an associated screen name; and

wherein the first user obtains a certificate from said at least one certificate authority;

wherein said first instant messaging client sends the first user'"'"'s certificate to said instant messaging server for publishing, and wherein said instant messaging server makes the first user'"'"'s certificate available to any of;

the first user'"'"'s list of preferred users and users that have the first user on their list of preferred users; and

wherein said first instant messaging client sends the first user'"'"'s status information for his certificate along with his certificate to said instant messaging server, and wherein said instant messaging server makes the first user'"'"'s status information available to any of;

the first user'"'"'s list of preferred users and users that have the first user on their list of preferred users.

24. The apparatus of claim 23, further comprising:

a subscriber database; and

wherein said subscriber database includes, but is not limited to;

user screen names, user subscription expiration dates, and enrollment agent information for users.

25. The apparatus of claim 23, further comprising:

a second instant messaging client;

wherein said second instant messaging client is associated with a second user; and

wherein the second user has an associated screen name.

26. The apparatus of claim 25, further comprising:

publishing means on said instant messaging server for calculating a hash value for the first user'"'"'s certificate and sending said hash value to any of;

the users in the first user'"'"'s list of preferred users and users that have the first user on their list of preferred users;

wherein the second user is on the first user'"'"'s list of preferred users and/or has the first user on his list of preferred users;

wherein said second instant messaging client receives said hash value;

hash comparison means on said second instant messaging client for comparing said hash value with a hash value for the first user'"'"'s certificate stored in a cache; and

wherein if said hash comparison means finds that said hash value does not match said cached hash value or said cached hash value does not exist, then said second instant messaging client requests the first user'"'"'s certificate from said instant messaging server.

27. The apparatus of claim 26, wherein said instant messenger server sends the first user'"'"'s certificate and said hash value in response to said second instant messaging client'"'"'s request, and wherein said second instant messaging client stores the first user'"'"'s certificate and said hash value in said cache.

28. The apparatus of claim 26, wherein said second instant messaging client uses the first user'"'"'s certificate to encrypt an instant text message to the first user;

wherein said second instant messaging client sends said encrypted instant text message to said instant messaging server, and wherein said instant messaging server forwards said encrypted instant text message to said first instant messaging client if the first user is logged on.

29. The apparatus of claim 28, wherein said first instant messaging client receives said encrypted instant text message from said instant messaging server and decrypts said encrypted instant text message using the first user'"'"'s certificate.

30. The apparatus of claim 29, wherein said first instant messaging client reuses an encryption key valve obtained from decrypting said encrypted instant text messages in subsequent messages during an instant message conversation with said second instant messaging client.

31. The apparatus of claim 23, wherein said first instant messaging client displays instant messages received and their security status.

32. The apparatus of claim 29, wherein said second instant messaging client attaches an encryption algorithm that was used to encrypt said encrypted instant text messages to said encrypted instant messages, and wherein said first instant messaging client used said encryption algorithm to decrypt said encrypted instant text message.

33. The apparatus of claim 29, wherein said second instant messaging client wraps said encrypted instant text message using a wrapping algorithm and wrapping key, wherein said second instant messaging client attaches said wrapping algorithm and said wrapping key to said encrypted instant text message, and wherein said first instant messaging clients extracts said wrapping key from said encrypted instant text message and uses said wrapping algorithm and said wrapping key to unwrap said encrypted instant text message.

34. The apparatus of claim 26, wherein said second instant messaging client uses the first user'"'"'s certificate to encrypt a data file to the first user;

wherein said second instant messaging client sends said encrypted file to said instant messaging server, and wherein said instant messaging server forwards said encrypted file to said first instant messaging client if the first user is logged on.

35. The apparatus of claim 34, wherein said first instant messaging client receives said encrypted file from said instant messaging server and decrypts said encrypted file using the first user'"'"'s certificate.

36. The apparatus of claim 34, wherein if a file transfer to said first instant messaging client has been terminated before an encrypted file has been fully transferred, then said first instant messaging client requests any remaining portions of an encrypted file from said second instant messaging client, wherein said second instant messaging client sends remaining portions of said encrypted file to said instant messaging server, and wherein said instant messaging server forwards said encrypted file portions to said first instant messaging client.

37. The apparatus of claim 34, wherein said second instant messaging client attaches an encryption algorithm that was used to encrypt said encrypted file to said encrypted file, and wherein said first instant messaging client uses said encryption algorithm to decrypt said encrypted file.

38. The apparatus of claim 34, wherein said second instant messaging client wraps said encrypted file using a wrapping algorithm and wrapping key, wherein said second instant messaging client attaches said wrapping algorithm and said wrapping key to said encrypted file, and wherein said first instant messaging client extracts said wrapping key from said encrypted file and uses said wrapping algorithm and said wrapping key to unwrap said encrypted file.

39. The apparatus of claim 26, wherein said first instant messaging client uses the first user'"'"'s certificate to sign an instant text message to the second user;

wherein said first instant messaging client sends said signed instant text message to said instant messaging server, and wherein said instant messaging server forwards said signed instant text message to said second instant messaging client if the first user is logged on.

40. The apparatus of claim 39, wherein said second instant messaging client receives said signed instant text message from said instant messaging server and verifies said signed instant text message using the first user'"'"'s certificate.