System, device and method for dynamically securing instant messages

• US 8,117,273 B1
• Filed: 07/12/2004
• Issued: 02/14/2012
• Est. Priority Date: 07/11/2003
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Mathur, Saroop, Venkatraman, Rajamadam C., Kim, Charlie, Warty, Ashish, Liao, Yih-Ming M.
• Primary Examiner(s): Dalencourt, Yves
• Assistant Examiner(s): Lai, Michael C
• Application Number:
  US10/890,394
• Time in Patent Office: 2,773 Days
• Field of Search: 709/207, 709/206, 713/150, 713/153, 713/168, 713/171, 713/175
• US Class Current: 709/207
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

An Instant Messaging security system that encrypts Instant Messages sent by a Instant Messaging user to an Instant Messaging server by intercepting the messages, negotiating a preferred security algorithm and forwarding the encrypted messages to the server. The security system intercepts and decrypts encrypted messages sent by the server to the user. The security system is able to determine whether a receiving user is equipped with a similar security system without prior knowledge of network addresses, configuration or capability. The security system is transparent to the Instant Message service provider and may provide one or more indicators to users that messages are encrypted during forwarding.

Claims

1. An instant messaging security device configured for intercepting and encrypting unencrypted instant messages routed for transmission from a first user device to an instant message server through a network and being further configured for intercepting and decrypting encrypted instant messages routed for transmission from the instant message server to the first user device through the network, the instant messaging security device comprising:

a network interface configured to communicate with the first user device and the network to intercept unencrypted instant messages routed for transmission from the first user device to the instant message server through the network, to transmit discovery instant messages, and to intercept encrypted instant messages routed for transmission from the instant message server to the first user device through the network;

a memory storing instructions; and

a processing component coupled to the network interface and the memory, the processing component, according to the stored instructions, configured to;

intercept an unencrypted instant message from the first user device addressed to a second user device through an instant message server;

transmit, in response to intercepting the unencrypted instant message, a discovery instant message addressed to the second user device, the discovery instant message including data indicating that the instant messaging security device is capable of encrypting instant message data according to a security protocol;

determine, in response to the discovery instant message, whether a response to the discovery instant message is received from a responding instant messaging security device;

in response to determining a response to the discovery instant message is not received, allow transmission of the unencrypted instant message to the second user device and allow transmission of an unencrypted instant message from the second user device to the first user device;

in response to determining a response to the discovery instant message is received;

transmit a first negotiation instant message to the responding instant messaging security device, the first negotiation instant message including data for negotiating an encryption technique with the responding instant messaging security device to encrypt unencrypted instant messages from the first user device to the second user device and to decrypt encrypted instant messages from the second user device to the first user device;

receive a second negotiation instant message from the responding instant messaging security device, the second negotiation instant message including data specifying the encryption technique;

encrypt the unencrypted instant message from the first user device using the encryption technique;

transmit the encrypted instant message to the second user device;

decrypt encrypted instant messages received from the responding instant messaging security device and addressed to the first user device; and

transmit the unencrypted instant message from the second user device to the first user device.

2. The instant messaging security device according to claim 1, wherein the discovery instant message and the response to the discovery instant message include identifying information used to negotiate preferred security algorithms.

3. The instant messaging security device according to claim 1, wherein the first negotiation instant message and the second negotiation instant message include information used to generate encryption keys.

4. The instant messaging security device according to claim 3, wherein the information used to generate encryption keys includes Diffie-Hellman keys.

5. The instant messaging security device according to claim 1, wherein the transmitted unencrypted instant message includes information indicating that the unencrypted instant message has been previously encrypted.

6. The instant messaging security device according to claim 1, wherein encryption capabilities of the instant messaging security device are indicated by the instant messaging security device independent of a third party.

7. The instant messaging security device according to claim 1, wherein the processing component requires no information regarding the presence or location of other instant messaging security devices prior to receiving a response to a discovery instant message to obtain encryption capabilities of a responding instant messaging security device.

8. A method for intercepting and encrypting unencrypted instant messages directed to a receiving user device and routed for transmission from a transmitting user device to an instant message server through a network, the method comprising:

intercepting an unencrypted instant message from a first user device addressed to a second user device through an instant message server;

transmitting, in response to intercepting the unencrypted instant message, a discovery instant message including data indicating that an instant messaging security device is capable of encrypting instant message data according to a security protocol;

determining, in response to the discovery instant message, whether a response to the discovery instant message is received from a responding instant messaging security device;

in response to determining that a response to the discovery instant message is not received, allowing transmission of the unencrypted instant message to the second user device and allowing transmission of unencrypted instant messages from the second user device to the first user device;

in response to determining that a response to the discovery instant message is received;

transmitting a first negotiation instant message to the responding instant messaging security device, the first negotiation instant message including data for negotiating an encryption technique with the responding instant messaging security device to encrypt unencrypted instant messages from the first user device to the second user device and to decrypt encrypted instant messages from the second user device to the first user device;

receiving a second negotiation instant message from the responding instant messaging security device, the second negotiation instant message including data specifying the encryption technique;

encrypting the unencrypted instant message from the first user device using the encryption technique; and

transmitting the encrypted instant message to the second user device, wherein the encrypted instant message is decrypted by the responding instant messaging security device.

9. The method according to claim 8, further comprising:

decrypting encrypted instant messages received from the responding instant messaging security device and addressed to the first user device; and

transmitting the unencrypted instant messages from the responding instant messaging security device to the first user device.

10. The method according to claim 9, wherein the encrypted instant message is capable of being transmitted to the second user device using an instant message server on a network.

11. The method according to claim 8, wherein the step of intercepting the unencrypted instant messages comprises:

configuring one or more DNS servers to reroute network communications between the first user device and an instant message server such that network communications pass through an instant messaging security device.

12. The method according to claim 8, wherein an instant messaging security device is physically located between an instant message server and the user device such that network communications between the first user device and an instant message server pass through the instant messaging security device.

13. The method according to claim 12, wherein the instant security device is collocated with an instant message server.

14. The method according to claim 12, wherein the instant messaging security device is collocated with the first user device.

15. The method according to claim 8, wherein encryption capabilities associated with the responding instant messaging security device are obtained independent of a third party.