Network optimization for secure connection establishment or secure messaging

• US 8,990,554 B2
• Filed: 08/13/2012
• Issued: 03/24/2015
• Est. Priority Date: 06/30/2011
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: King, William C., Lee, Kwai Yeung
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/584,226
• Publication Number:
  US 20130232335A1
• Time in Patent Office: 953 Days
• Field of Search: 713/150, 713/152, 713/155, 713/161, 713168-171, 726 1- 4, 380/247, 380/255, 380/270
• US Class Current: 713/155
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 76/10 Connection setup

Abstract

A first device is configured to receive an instruction to establish a secure connection with a second device or to send a secure message to the second device. The instruction may include a secure connection invitation or a message. The first device may send information, associated with the second device, to a first server; receive a response from the first server; obtain parameters based on the response indicating that the second device is subscribed to the first server; communicate the parameters to the first server; receive a parameters identifier associated with the parameters; store the parameters identifier in the secure connection invitation or the message; and send the secure connection invitation or the message to the second device. The second device may receive the parameters identifier to obtain the parameters to establish the secure connection or to decrypt the secure message.

Claims

1. A method comprising:

receiving, by a first device, an instruction to establish a secure connection with a second device or to send a secure message to the second device,

the instruction including a secure connection invitation or a message;

sending, by the first device, information associated with the second device to a first server;

receiving, by the first device, a response from the first server, the response indicating whether the second device is subscribed to the first server;

obtaining, by the first device, first parameters when the response indicates that the second device is subscribed to the first server;

communicating, by the first device, the first parameters to the first server;

receiving, by the first device and from the first server, a first parameters identifier associated with the first parameters;

storing, by the first device, the first parameters identifier in the secure connection invitation or the message; and

sending, by the first device, the secure connection invitation or the message to the second device,

the second device being capable of receiving the first parameters identifier stored by the secure connection invitation or the message to obtain the first parameters to aid in establishing the secure connection or to aid in decrypting the secure message.

2. The method of claim 1, further comprising:

receiving message sending options or connection options when the response indicates that the second device is not subscribed to the first server,

the connection options permitting the first device to establish an unsecured connection with the second device or to cancel the instruction to establish the secure connection with the second device, and

the message sending options permitting the first device to send an unsecured message to the second device or to cancel the instruction to send the secure message to the second device.

3. The method of claim 1,

where the instruction to establish the secure connection with the second device or to send the secure message to the second device is an instruction to establish the secure connection with the second device, and

where the method further comprises:

receiving a second parameters identifier from the second device based on sending the secure connection invitation to the second device;

communicating the second parameters identifier to the first server;

receiving, from the first server, second parameters based on communicating the second parameters identifier to the first server;

generating a security key based on the first parameters and the second parameters;

establishing the secure connection with the second device based on the security key; and

communicating with the second device using the secure connection.

4. The method of claim 1,

where the instruction to establish the secure connection with the second device or to send the secure message to the second device is an instruction to send the secure message to the second device, and

where the method further comprises:

generating a security key based on the first parameters; and

encrypting the message based on the security key to form the secure message,

storing the first parameters identifier in the message being based on forming the secure message.

5. The method of claim 1, further comprising:

initiating an authentication function with a second server;

receiving a server key from the second server to access the first server based on initiating the authentication function with the second server;

initiating an authentication function with the first server based on receiving the server key from the second server; and

receiving authorization to communicate with the first server based on the server key;

sending the information associated with the second device to the first server being based on receiving the authorization to communicate with the first server.

6. The method of claim 1, further comprising:

initiating an authentication function with a second server;

receiving authorization to communicate with the second server; and

receiving the first parameters from the second server based on receiving the authorization to communicate with the second server,

obtaining the first parameters being based on receiving the first parameters from the second server.

7. A system comprising:

a first device to;

receive an instruction to establish a secure connection with a second device or to send a secure message to the second device,

the instruction including a secure connection invitation or a message;

send information associated with the second device to a first server;

receive a response from the first server,

the response indicating whether the second device is subscribed to the first server;

receive message sending options or connection options based on the response indicating that the second device is not subscribed to the first server,

the connection options permitting the first device to establish an unsecured connection with the second device or to cancel the instruction to establish the secure connection with the second device, and

the message sending options permitting the first device to send an unsecured message to the second device or to cancel the instruction to send the secure message to the second device;

obtain first parameters, when the response indicates that the second device is subscribed to the first server;

communicate the first parameters to the first server;

receive, from the first server, a first parameters identifier associated with the first parameters;

store the first parameters identifier in the secure connection invitation or the message; and

send the secure connection invitation or the message to the second device,

the second device being capable of receiving the first parameters identifier stored by the secure connection invitation or the message to obtain the first parameters to aid in establishing the secure connection or to aid in decrypting the secure message.

8. The system of claim 7,

where the instruction to establish the secure connection with the second device or to send the secure message to the second device is an instruction to establish the secure connection with the second device, and

where the first device is further to:

receive a second parameters identifier from the second device based on sending the secure connection invitation to the second device;

communicate the second parameters identifier to the first server;

receive, from the first server, second parameters based on communicating the second parameters identifier to the first server;

generate a security key based on the first parameters and the second parameters;

establish the secure connection with the second device based on the security key; and

communicate with the second device using the secure connection.

9. The system of claim 7,

where the instruction to establish the secure connection with the second device or to send the secure message to the second device is an instruction to send the secure message to the second device,

where the first device is further to:

generate a security key based on the first parameters; and

encrypt the message based on the key to form the secure message, and

where, when storing the first parameters identifier in the message, the first device is to;

store the first parameters identifier in the message based on forming the secure message.

10. The system of claim 7,

where the first device is further to:

initiate an authentication function with a second server;

receive a server key from the second server to access the first server based on initiating the authentication function with the second server;

initiate an authentication function with the first server based on receiving the server key from the second server; and

receive authorization to communicate with the first server based on the server key, and

where, when sending the information associated with the second device to the first server, the first device is to;

send the information associated with the second device to the first server based on receiving the authorization to communicate with the first server.

11. The system of claim 7,

where the first device is further to:

initiate an authentication function with a second server;

receive authorization to communicate with the second server; and

receive the first parameters from the second server based on receiving authorization to communicate with the second server, and

where, when obtaining the first parameters, the first device is to;

obtain the first parameters based on receiving the first parameters from the second server.

12. A non-transitory computer-readable medium storing instructions, the instructions comprising:

a plurality of instructions, which, when executed by one or more processors associated with a first device, cause the one or more processors to;

receive an instruction to establish a secure connection with a second device or to send a secure message to the second device,

the instruction to establish the secure connection with the second device or to send the secure message to the second device including a secure connection invitation or a message;

initiate an authentication function with a first server;

receive a server key from the first server to access a the second server based on initiating the authentication function with the second server;

initiate an authentication function with the second server based on receiving the server key from the first server;

receive authorization to communicate with the second server based on the server key;

send information associated with the second device to the second server based on receiving the authorization to communicate with the second server;

receive a response from the second server,

the response indicating whether the second device is subscribed to the second server;

obtain first parameters when the response indicates that the second device is subscribed to the second server;

communicate the first parameters to the second server;

receive, from the second server, a first parameters identifier associated with the first parameters;

store the first parameters identifier in the secure connection invitation or the message; and

send the secure connection invitation or the message to the second device,

the second device being capable of receiving the first parameters identifier stored by the secure connection invitation or the message to obtain the first parameters to aid in establishing the secure connection or to aid in decrypting the secure message.

13. The non-transitory computer-readable medium of claim 12, where the instructions further comprise:

one or more instructions, which, when executed by the one or more processors, cause the one or more processors to;

receive message sending options or connection options when the response indicates that the second device is not subscribed to the second server,

the connection options permitting the first device to establish an unsecured connection with the second device or to cancel the instruction to establish the secure connection with the second device, and

the message sending options permitting the first device to send an unsecured message to the second device or to cancel the instruction to send the secure message to the second device.

14. The non-transitory computer-readable medium of claim 12,

where the instruction to establish the secure connection with the second device or to send the secure message to the second device is an instruction to establish the secure connection with the second device, and

where the instructions further comprise:

one or more instructions, which, when executed by the one or more processors, cause the one or more processors to;

receive a second parameters identifier from the second device based on sending the secure connection invitation to the second device;

communicate the second parameters identifier to the second server;

receive, from the second server, second parameters based on communicating the second parameters identifier to the first server;

generate a security key based on the first parameters and the second parameters;

establish the secure connection with the second device based on the security key; and

communicate with the second device using the secure connection.

15. The non-transitory computer-readable medium of claim 12,

where the instruction to establish the secure connection with the second device or to send the secure message to the second device is an instruction to send the secure message to the second device,

where the instructions further comprise:

one or more instructions, which, when executed by the one or more processors, cause the one or more processors to;

generate a security key based on the first parameters; and

encrypt the message based on the key to form the secure message, and

where one or more instructions, of the plurality of instructions, to store the first parameters identifier in the message, comprise;

one or more instructions, which, when executed by the one or more processors, cause the one or more processors to;

store the first parameters identifier in the message based on forming the secure message.

16. The non-transitory computer-readable medium of claim 12,

where the instructions further comprise:

one or more instructions, which, when executed by the one or more processors, cause the one or more processors to;

initiate an authentication function with the first server;

receive authorization to communicate with the second server; and

receive the first parameters from the first server based on receiving the authorization to communicate with the first server, and

where one or more instructions, of the plurality of instructions, to obtain the first parameters comprise;

one or more instructions, which, when executed by the one or more processors, cause the one or more processors to;

obtain the first parameters based on receiving the first parameters from the second server.

17. A method comprising:

receiving, by a first server and from a first user device, information regarding a second user device;

generating, by the first server, a response,

the response indicating whether the second user device is subscribed to the first server;

sending, by the first server, the response to the first user device;

receiving, by the first server and from the first user device, first parameters when the response indicates that the second user device is subscribed to the first server;

storing, by the first server, the first parameters;

generating, by the first server, a first parameters identifier associated with the first parameters;

providing, by the first server, the first parameters identifier to the first user device;

receiving, by the first server, the first parameters identifier from the second user device; and

providing, by the first server, the first parameters to the second user device;

the second user device being capable of generating a security key based on the first parameters or based on second parameters, associated with the second user device, to decrypt a secure message or establish a secure connection with the first user device.

18. The method of claim 17, further comprising:

providing options to the first user device when the response indicates that the second user device is not subscribed to the first server,

the options permitting the first user device to send an unsecured message to the second user device or to establish an unsecured connection with the second user device.

19. The method of claim 17, further comprising:

receiving the second parameters from the second user device;

generating a second parameters identifier associated with the second parameters;

providing the second parameters identifier to the second user device;

receiving the second parameters identifier from the first user device; and

providing the second parameters to the first user device,

the first user device being capable of generating a security key based on the first parameters and based on the second parameters, and

the first user device and the second user device being capable of establishing the secure connection based on the security key generated by the first user device and the security key generated by the second user device.

20. The method of claim 17, further comprising:

receiving a request from the second user device to communicate with the first server; and

authenticating the second user device to communicate with the first server based on a generic bootstrapping authentication process,

where receiving the first parameters identifier from the second user device is based on authenticating the second user device.

21. The method of claim 17, further comprising:

receiving a request from the first user device to communicate with the first server; and

authenticating the first user device to communicate with the first server based on a generic bootstrapping authentication process,

where receiving information regarding the second user device is based on authenticating the first user device.