Unified messaging system configured for transport of encrypted messages

• US 7,308,477 B1
• Filed: 01/10/2001
• Issued: 12/11/2007
• Est. Priority Date: 01/10/2001
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gress, David Stephen, Sealey, Robert Raymond
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Osman, Ramy M
• Application Number:
  US09/756,697
• Time in Patent Office: 2,526 Days
• Field of Search: 709/206, 709/202, 709/246, 709/219, 709/249, 709/203, 709223-229, 709/217, 713/152, 713/151, 379/67.1, 379/88.09, 379/88.13, 379/902, 380/277, 380/279
• US Class Current: 709/206
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/56 Unified messaging, e.g. interactions between e-mail, instant messaging or converged IP messaging [CPM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838

Abstract

A unified messaging system is configured for encrypting messages. The calling party is prompted to encrypt the unified message, for example as part of an extended options menu. The unified messaging system encrypts the unified message based on an encryption key input by the user into an encrypted message, and generates an open-network destination header for identifying a destination location for the encrypted message according to an open-network protocol. The unified messaging system then outputs the open-network destination header and the encrypted message as an open-network encrypted message to an open-network message store. During retrieval of the message, the unified messaging system identifies the encrypted message and prompts the destination subscriber for a decryption key; the unified messaging system performs a decryption operation to recover a decrypted file, and outputs the decrypted file for playback to the user.

Claims

1. A method in a unified communications system, the method comprising:

receiving from a requesting device a request for providing a user interface session by the unified communications system to enable a user of the requesting device to send a message to an identified destination subscriber;

receiving, by the unified communications system, the message in unencrypted form from the requesting device as part of the user interface session;

generating and outputting to the requesting device as part of the user interface session a first prompt enabling the user to select encryption of the message;

generating and outputting to the requesting device as part of the user interface session a second prompt, based on the user selecting encryption of the message, for the user to input an encryption key;

invoking a resource configured for executing encryption of the message, having been received in unencrypted form, into an encrypted message based on the encryption key received from the requesting device as part of the user interface session, the resource and the executing encryption being distinct from the requesting device; and

outputting the encrypted message to a determined destination based on determined subscriber profile attributes for the identified destination subscriber.

2. The method of claim 1, wherein the receiving of the message includes receiving a message data file having the message and a Multipurpose Internet Mail Extension (MIME) that specifies a format of the message, the invoking including encrypting the message data file into an encrypted file having a MIME extension specifying that the encrypted file has an encrypted format.

3. The method of claim 2, further including generating a message transport header specifying an IP based destination address corresponding to the identified destination subscriber.

4. The method of claim 2, wherein the message data file has a MIME extension specifying a “

.wav”

format, the message having an audio header and audio payload, the invoking including encrypting the audio header and the audio payload within the encrypted file.

5. The method of claim 1, further comprising determining the subscriber profile attributes for the identified destination subscriber based on accessing a subscriber directory according to Lightweight Directory Access Protocol (LDAP), the subscriber profile attributes specifying the determined destination.

6. The method of claim 1, wherein the outputting includes outputting the encrypted message to the determined destination according to at least one of SMTP protocol and IMAP protocol.

7. The method of claim 1, further comprising:

receiving from a second requesting device a request for providing a second user interface session by the unified communications system to enable the identified destination subscriber using the second requesting device to retrieve stored messages;

retrieving for the second user interface session information related to the stored messages for the identified destination subscriber;

detecting one of the stored messages as encrypted;

generating for the second requesting device as part of the second user interface session a third prompt, based on detecting the one stored message, for the identified destination subscriber to input a decryption key; and

supplying the decryption key having been received from the second requesting device as part of the second user interface session and the one stored message to an invoked decryption utility for decryption of the one stored message into a decrypted data file, the invoked decryption utility and the decryption distinct from the requesting device and the second requesting device.

8. The method of claim 7, further comprising outputting a decryption result, having been received from the invoked decryption utility relative to the supplying of the decryption key and one stored message, during the second user interface session to the identified destination subscriber, independent of the encryption key matching the decryption key.

9. The method of claim 1, wherein the receiving of the request includes receiving the request according to hypertext transport protocol, each of the generating the first prompt and generating the second prompt including sending a corresponding HTML page specifying the corresponding prompt, the receiving of the message includes receiving the message as an HTTP post to a prescribed uniform resource location.

10. A method in a unified communications system, the method comprising:

receiving from a requesting device a request for providing a user interface session by the unified communications system to enable a messaging subscriber using the requesting device to retrieve stored messages;

accessing, for the user interface session, subscriber profile information from a subscriber profile directory according to a prescribed open network protocol, the subscriber profile directory distinct from the requesting device;

determining one of the stored messages is encrypted based on access of a message store according to a prescribed open network protocol and based on the accessed subscriber profile information;

generating and outputting to the requesting device as part of the user interface session a prompt, based on identifying the one stored message as encrypted, for the messaging subscriber to input a decryption key; and

invoking a resource configured for attempting decrypting of the one stored message based on the decryption key having been supplied by the messaging subscriber via the requesting device as part of the user interface session, the resource and the attempting decrypting being distinct from the requesting device.

11. The method of claim 10, further comprising:

obtaining a decryption result based on the invoking of the resource; and

outputting the decryption result for attempted presentation to the messaging subscriber.

12. The method of claim 11, wherein the outputting step includes outputting the decryption result independent of whether the decryption key enabled successful decryption of the one stored message.

13. The method of claim 10, further comprising obtaining, based on the invoking of the resource, a decryption result including a message data file having a message and a Multipurpose Internet Mail Extension (MIME) that specifies a format of the message.

14. The method of claim 10, wherein the receiving of the request includes receiving the request according to hypertext transport protocol, wherein the generating of the prompt includes outputting a first HTML page specifying the prompt.

15. The method of claim 10, wherein the accessing includes obtaining the subscriber profile information according to LDAP protocol.

16. The method of claim 15, wherein the determining includes:

accessing the message store according to IMAP protocol for messaging information related to the stored messages for the messaging subscriber, based on the accessed subscriber profile information; and

identifying the one stored message as encrypted based on a prescribed file extension specifying that the one stored message has an encrypted format.

17. The method of claim 16, wherein the identifying includes identifying the prescribed file extension as a MIME type extension that specifies an encrypted format.

18. The method of claim 10, wherein the determining includes:

accessing the message store according to IMAP protocol for messaging information related to the stored messages for the messaging subscriber, based on the accessed subscriber profile information; and

identifying the one stored message as encrypted based on a prescribed file extension specifying that the one stored message has an encrypted format.

19. The method of claim 18, wherein the identifying includes identifying the prescribed file extension as a MIME type extension that specifies an encrypted format.

20. A unified communications server including:

an interface configured for receiving a request from a requesting device for generation of a user interface session by the unified communications server to enable a user of the requesting device to send a message to an identified destination subscriber;

an IP-based interface enabling retrieval of subscriber profile attributes for the identified destination subscriber from an IP-based subscriber profile directory that is distinct from the requesting device, and storage of messaging information for the identified destination subscriber in an IP-based subscriber message store that is distinct from the requesting device; and

an application runtime environment configured for generating the user interface session and accessing the subscriber profile attributes, the application runtime environment configured for generating first and second prompts and outputting the first and second prompts to the requesting device as part of the user interface session enabling the user to select encryption of the message and input an encryption key, respectively, the application runtime environment configured for invoking a resource configured for encrypting the message, received in unencrypted form from the requesting device as part of the user interface session, into an encrypted file based on the encryption key supplied by the user via the requesting device as part of the user interface session, and outputting an encrypted message including the encrypted file for storage in the IP-based subscriber message store for the identified destination subscriber the resource and the encrypting distinct from the requesting device.

21. The server of claim 20, wherein the application runtime environment is configured for generating for the encrypted message a MIME extension specifying that the encrypted file has an encrypted format, and a message transport header specifying an IP based destination address corresponding to the identified destination subscriber.

22. The server of claim 20, wherein the IP-based interface includes an application programming interface configured for invoking prescribed routines, including a first routine for accessing the IP-based subscriber profile directory according to LDAP protocol, and a second routine for accessing the IP-based subscriber message store according to at least one of SMTP protocol and IMAP protocol.

23. The server of claim 22, wherein the application programming interface is configured for implementing the invoking of the resource by the application runtime environment for generation of the encrypted message.

24. The server of claim 20, wherein the application runtime environment is further configured for generating a second user interface session for a second requesting device enabling the identified destination subscriber using the second requesting device to retrieve stored messages, the application runtime environment, in response to detecting one of the stored messages as encrypted, generating a third prompt for the second requesting device as part of the second user interface session to enable the identified destination subscriber to input a decryption key, the application runtime environment configured for invoking a second resource configured for attempting decryption of the one stored message based on the decryption key input by the user via the second requesting device as part of the user interface session, the second resource distinct from the requesting device and the second requesting device.

25. The server of claim 24, wherein the application runtime environment, upon obtaining a decryption result based on the attempted decryption, outputs the decryption result for attempted presentation to the identified destination subscriber independent of whether the decryption key enabled successful decryption of the one stored message.

26. The server of claim 20, wherein the interface is configured for receiving the request, and outputting responses, according to hypertext transport protocol.

27. A unified communications server comprising:

an interface configured for receiving from a requesting device a request for generation of a user interface session by the unified communications server to enable a messaging subscriber using the requesting device to retrieve stored messages;

an IP-based interface enabling retrieval of subscriber profile attributes for the messaging subscriber from an IP-based subscriber profile directory that is distinct from the requesting device, and access of messaging information for the messaging subscriber from an IP-based subscriber message store that is distinct from the requesting device; and

an application runtime environment configured for generating the user interface session and accessing the subscriber profile attributes, the application runtime environment configured for generating, based on identifying from the messaging information that one of the stored messages is encrypted, a prompt output to the requesting device as part of the user interface session enabling the messaging subscriber to input a decryption key, the application runtime environment configured for invoking a resource configured for attempting decryption of the one stored message into a decryption result based on the decryption key supplied by the user via the requesting device as part of the user interface session, the resource and the attempting decryption being distinct from the requesting device.

28. The server of claim 27, wherein the application runtime environment is configured for outputting the decryption result to the messaging subscriber independent of whether the decryption key enabled successful decryption of the one stored message.

29. The server of claim 27, wherein the application runtime environment identifies that the one stored message is encrypted based on an attached MIME extension specifying an encrypted format.

30. The server of claim 27, wherein the IP-based interface includes an application programming interface configured for invoking prescribed routines, including a first routine for accessing the IP-based subscriber profile directory according to LDAP protocol, and a second routine for accessing the IP-based subscriber message store according to IMAP protocol.

31. The server of claim 30, wherein the application programming interface is configured for implementing the invoking of the resource by the application runtime environment for generation of the decryption result.

32. The server of claim 27, wherein the interface is configured for receiving the request, and outputting responses, according to hypertext transport protocol.

33. A computer readable medium having stored thereon sequences of instructions for a device receiving a message for an identified messaging subscriber, the sequences of instructions including instructions for performing the steps of:

receiving from a requesting device a request for providing a user interface session by the device executing the instructions to enable a user of the requesting device to send a message to an identified destination subscriber;

receiving the message in unencrypted form from the requesting device as part of the user interface session;

generating and outputting to the requesting device as part of the user interface session a first prompt enabling the user to select encryption of the message;

generating and outputting to the requesting device as part of the user interface session a second prompt, based on the user selecting encryption of the message, for the user to input an encryption key;

invoking a resource configured for executing encryption of the message, having been received in unencrypted form, into an encrypted message based on the encryption key received from the requesting device as part of the user interface, the resource and the executing encryption being distinct from the requesting device; and

outputting the encrypted message to a determined destination based on determined subscriber profile attributes for the identified destination subscriber.

34. The medium of claim 33, wherein the step of receiving the message includes receiving a message data file having the message and a Multipurpose Internet Mail Extension (MIME) that specifies a format of the message, the invoking step including encrypting the message data file into an encrypted file having a MIME extension specifying that the encrypted file has an encrypted format.

35. The medium of claim 34, wherein the invoking step further including generating a message transport header specifying an IP based destination address corresponding to the identified destination subscriber.

36. The medium of claim 34, wherein the message data file has a MIME extension specifying a “

.wav”

format, the message having an audio header and audio payload, the invoking step including encrypting the audio header and the audio payload within the encrypted file.

37. The medium of claim 33, further comprising instructions for performing the step of determining the subscriber profile attributes for the identified destination subscriber based on accessing a subscriber directory according to Lightweight Directory Access Protocol (LDAP), the subscriber profile attributes specifying the determined destination.

38. The medium of claim 33, wherein the outputting step includes outputting the encrypted message to the determined destination according to at least one of SMTP protocol and IMAP protocol.

39. The medium of claim 33, further comprising instructions for performing the steps of:

receiving from a second requesting device a request for providing a second user interface session by the device to enable the identified destination subscriber using the second requesting device to retrieve stored messages;

retrieving for the second user interface session information related to the stored messages for the identified destination subscriber;

detecting one of the stored messages as encrypted;

generating for the second requesting device as part of the second user interface session a third prompt, based on detecting the one stored message, for the identified destination subscriber to input a decryption key; and

supplying the decryption key having been received from the second requesting device as part of the second user interface session and the one stored message to an invoked decryption utility for decryption of the one stored message into a decrypted data file, the invoked decryption utility and the decryption distinct from the requesting device and the second requesting device.

40. The medium of claim 39, further comprising instructions for performing the step of outputting a decryption result, having been received from the invoked decryption utility relative to the supplying of the decryption key and one stored message, during the second user interface session to the identified destination subscriber, independent of the encryption key matching the decryption key.

41. The medium of claim 33, wherein the receiving step includes receiving the request according to hypertext transport protocol, each of the steps of generating the first prompt and generating the second prompt including sending a corresponding HTML page specifying the corresponding prompt, the step of receiving the message includes receiving the message as an HTTP post to a prescribed uniform resource location.

42. A computer readable medium having stored thereon sequences of instructions for a device retrieving a message for a messaging subscriber, the sequences of instructions including instructions for performing the steps of:

receiving from a requesting device a request for providing a user interface session by the device executing the instructions to enable a messaging subscriber using the requesting device to retrieve stored messages;

accessing, for the user interface session, subscriber profile information from a subscriber profile directory according to a prescribed open network protocol, the subscriber profile directory distinct from the requesting device;

determining one of the stored messages is encrypted based on access of a message store according to a prescribed open network protocol and based on the accessed subscriber profile information;

generating and outputting to the requesting device as part of the user interface session a prompt, based on identifying the one stored message as encrypted, for the messaging subscriber to input a decryption key; and

invoking a resource configured for attempting decrypting of the one stored message based on the decryption key having been supplied by the messaging subscriber via the requesting device as part of the user interface session, the resource and the attempting decrypting being distinct from the requesting device.

43. The medium of claim 42, further comprising instructions for performing the steps of:

obtaining a decryption result based on the invoking step; and

outputting the decryption result for attempted presentation to the messaging subscriber.

44. The medium of claim 43, wherein the outputting step includes outputting the decryption result independent of whether the decryption key enabled successful decryption of the one stored message.

45. The medium of claim 42, further comprising instructions for performing the step of obtaining, based on the invoking step, a decryption result including a message data file having a message and a Multipurpose Internet Mail Extension (MIME) that specifies a format of the message.

46. The medium of claim 42, wherein the receiving step includes receiving the request according to hypertext transport protocol, wherein the step of generating the prompt includes outputting a first HTML page specifying the prompt.

47. The medium of claim 42, wherein the accessing step includes obtaining the subscriber profile information according to LDAP protocol.

48. The medium of claim 47, wherein the determining step includes:

accessing the message store according to IMAP protocol for messaging information related to the stored messages for the messaging subscriber, based on the accessed subscriber profile information; and

identifying the one stored message as encrypted based on a prescribed file extension specifying that the one stored message has an encrypted format.

49. The medium of claim 48, wherein the identifying step includes identifying the prescribed file extension as a MIME type extension that specifies an encrypted format.

50. The medium of claim 42, wherein the determining step includes:

accessing the message store according to IMAP protocol for messaging information related to the stored messages for the messaging subscriber, based on the accessed subscriber profile information; and

identifying the one stored message as encrypted based on a prescribed file extension specifying that the one stored message has an encrypted format.

51. The medium of claim 50, wherein the identifying step includes identifying the prescribed file extension as a MIME type extension that specifies an encrypted format.

52. A unified communications system comprising:

means for receiving from a requesting device a request for providing a user interface session by the system to enable a user of the requesting device to send a message to an identified destination subscriber, the means for receiving configured for receiving the message in unencrypted form from the requesting device as part of the user interface session;

means for generating and outputting to the requesting device as part of the user interface session a first prompt enabling the user to select encryption of the message;

means for generating and outputting to the requesting device as part of the user interface session a second prompt, based on the user selecting encryption of the message, for the user to input an encryption key;

means for invoking a resource configured for executing encryption of the message, having been received in unencrypted form, into an encrypted message based on the encryption key received from the requesting device as part of the user interface session, the resource and the executing encryption distinct from the requesting device; and

means for outputting the encrypted message to a determined destination based on determined subscriber profile attributes for the identified destination subscriber.

53. The system of claim 52, wherein the means for receiving is configured for receiving the message within a message data file having the message and a Multipurpose Internet Mail Extension (MIME) that specifies a format of the message, the means for invoking configured for causing encryption of the message data file into an encrypted file having a MIME extension specifying that the encrypted file has an encrypted format.

54. The system of claim 53, wherein the means for invoking is configured for generating a message transport header specifying an IP based destination address corresponding to the identified destination subscriber.

55. The system of claim 53, wherein the message data file has a MIME extension specifying a “

.wav”

format, the message having an audio header and audio payload, the means for invoking causing the audio header and the audio payload to be encrypted within the encrypted file.

56. The system of claim 52, further comprising means for determining the subscriber profile attributes for the identified destination subscriber based on accessing a subscriber directory according to Lightweight Directory Access Protocol (LDAP), the subscriber profile attributes specifying the determined destination.

57. The system of claim 52, wherein the outputting means is configured for outputting the encrypted message to the determined destination according to at least one of SMTP protocol and INAP protocol.

58. The system of claim 52, wherein the receiving means also is configured for receiving a request from a second requesting device for providing a second user interface session by the system to enable the identified destination subscriber using the second requesting device to retrieve stored messages, the system further comprising:

means for retrieving for the second user interface session information related to the stored messages for the identified destination subscriber;

means for detecting one of the stored messages as encrypted;

means for generating for the second requesting device as part of the second user interface session a third prompt, based on detecting the one stored message, for the identified destination subscriber to input a decryption key; and

means for supplying the decryption key having been received from the second requesting device as part of the second user interface session and the one stored message to an invoked decryption utility for decryption of the one stored message into a decrypted data file, the invoked decryption utility and the decryption distinct from the requesting device and the second requesting device.

59. The system of claim 58, further comprising means for outputting a decryption result, having been received from the invoked decryption utility relative to the supplying of the decryption key and one stored message, during the second user interface session to the identified destination subscriber, independent of the encryption key matching the decryption key.

60. The system of claim 52, wherein the receiving means is configured for receiving the request according to hypertext transport protocol, wherein the first prompt is output in an HTML page to the requesting device, the second prompt output to in a second HTML page to the requesting device, the message received as an HTTP post to a prescribed uniform resource location.

61. A unified communications system comprising:

means for receiving from a requesting device a request for providing a user interface session by the system to enable a messaging subscriber using the requesting device to retrieve stored messages;

means for accessing, for the user interface session, subscriber profile information from a subscriber profile directory according to a prescribed open network protocol, the subscriber profile directory distinct from the requesting device;

means for determining one of the stored messages is encrypted based on access of a message store according to a prescribed open network protocol and based on the accessed subscriber profile information;

means for generating and outputting to the requesting device as part of the user interface session a prompt, based on identifying the one stored message as encrypted, for the messaging subscriber to input a decryption key; and

means for invoking a resource configured for attempting decrypting of the one stored message based on the decryption key having been supplied by the messaging subscriber via the requesting device as part of the user interface session, the resource and the attempting decrypting being distinct from the requesting device.

62. The system of claim 61, further comprising:

means for obtaining a decryption result based on the invoking of the resource; and

means for outputting the decryption result for attempted presentation to the messaging subscriber.

63. The system of claim 62, wherein the outputting means is configured for outputting the decryption result independent of whether the decryption key enabled successful decryption of the one stored message.

64. The system of claim 61, wherein the means for invoking obtains a decryption result including a message data file having a message and a Multipurpose Internet Mail Extension (MIME) that specifies a format of the message.

65. The system of claim 61, wherein the receiving means is configured for receiving the request according to hypertext transport protocol, wherein the prompt is output in an HTML page to the requesting device.

66. The system of claim 61, wherein the accessing means is configured for obtaining the subscriber profile information according to LDAP protocol.

67. The system of claim 66, wherein the determining means is configured for:

accessing the message store according to IMAP protocol for messaging information related to the stored messages for the messaging subscriber, based on the accessed subscriber profile information; and

identifying the one stored message as encrypted based on a prescribed file extension specifying that the one stored message has an encrypted format.

68. The system of claim 67, wherein the determining means identifies the prescribed file extension as a MIME type extension that specifies an encrypted format.

69. The system of claim 61, wherein the determining means is configured for:

accessing the message store according to IMAP protocol for messaging information related to the stored messages for the messaging subscriber, based on the accessed subscriber profile information; and

identifying the one stored message as encrypted based on a prescribed file extension specifying that the one stored message has an encrypted format.

70. The system of claim 69, wherein the determining means is configured for identifying the prescribed file extension as a MIME type extension that specifies an encrypted format.