User interface systems and methods for secure message oriented communications

• US 9,602,277 B2
• Filed: 11/05/2010
• Issued: 03/21/2017
• Est. Priority Date: 06/07/2010
• Status: Active Grant

• Current Assignee: Global Integrity, Inc.
• Original Assignee: Protected Mobility LLC
• Inventors: Marlow, William J., Cichielo, Robert, Sturniolo, Emil, Benware, Paul
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US12/940,213
• Publication Number:
  US 20110302405A1
• Time in Patent Office: 2,328 Days
• Field of Search: 713/150, 709/225
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/041 Key generation or derivation

Abstract

A convenient, easy to use ubiquitous secure communications capability can automatically encrypt and decrypt messages without requiring any special intermediating security component such as gateways, proxy servers or the like. Trusted/secure applications for the mobile workforce can significantly improve productivity and effectiveness while enhancing personal and organizational security and safety.

Claims

1. A method of providing end-to-end encrypted communications between a first end-user device including a first end-user device processor and a second end-user device including a second end-user device processor, the method comprising:

determining with the first end-user device processor whether the second end-user device is configured to securely communicate with the first end-user device;

if the determining determines the second end-user device is not configured to securely communicate with the first end-user device, the first end-user device processor configuring the first end-user device to send a clear text communication to the second end-user device;

if the determining determines the second end-user device is configured to securely communicate with the first end-user device, the first end-user device processor configuring the first end-user device to selectively send any of a clear text communication and a cipher text communication to the second end-user device;

autogenerating, with the first end-user device processor, a Public/Private key pair;

agreeing upon at least one shared secret based on a handshake communication between the first and second end-user devices without revealing the shared secret through the handshake communication, the first end-user device processor and the second end-user device processor each deriving at least part of the shared secret based at least on the Public key of the Public/Private key pair;

conditioned on the first end-user device processor configuring the first end-user device to enable the first end-user device to send a cipher text communication to the second end-user device, securely communicating an encrypted message from the first end-user device to the second end-user device, without requiring the encrypted message to be decrypted intermediate of the first end-user device and the second end-user device;

decrypting, using the shared secret, the communicated encrypted message at the second end-user device into message clear text;

the second end-user device making the message clear text available to a user only while the message clear text is being used; and

enabling downloading on demand of a secure communications application to the second end-user device, the secure communications application configuring the second end-user device to decrypt secure messages sent by the first end-user device and to encrypt secure messages to send to the first end-user device.

2. The method of claim 1 wherein said communicated encrypted message comprises an encrypted SMS message.

3. The method of claim 1 further including encrypting, at the first end-user device, an SMS message for decryption by the second end-user device.

4. The method of claim 1 further including, if said first device processor determines that the second end-user device is configured for secure communication with the first end-user device, communicating an unencrypted message from the first device to the second device, said message providing an indication that the first device wishes to send a secure message to the second device.

5. The method of claim 1 wherein the agreed-upon shared secret is derived from the public key autogenerated by the first end-user device and a public key associated with the second end-user device.

6. The method of claim 5 wherein the first end-user device processor autogenerates the user Public/Private key pair upon download or installation of a security application used to enable secure message communications.

7. The method of claim 1 wherein the first and second end-user device processors keep the communicated encrypted message encrypted except while the message clear text is being viewed by a user executing an application that coexists with other applications on the first and second end-user devices without interfering with the other applications.

8. The method of claim 1 wherein the secure communications capability is transparent to the user.

9. The method of claim 1 wherein determining whether the second end-user device is configured to securely communicate with the first end-user device is based on a challenge-response verification protocol, including:

sending a challenge to the second end-user device,

receiving a response to the challenge from the second end-user device, and

testing the response to the challenge by verifying a cryptographic hash value.

10. A system for providing end-to-end encrypted communications between a first end-user device and a second end-user device such that encrypted messages sent from the first end-user device to the second end-user device remain encrypted until decrypted by the second end-user device, the system comprising:

a first end-user device including a first processor;

a second end-user device including a second processor, the first device processor being configured to determine whether the second end-user device is configured for secure communications with the first end-user device;

the first and second end-user devices configuring to send clear text messages therebetween when the first device processor determines the second end-user device is not configured for secure communications with the first end-user device;

the first and second end-user devices being further structured to each generate a public/private key pair, to each derive at least part of the at least one shared secret based at least in part on a public key and to agree upon at least one shared secret based on a handshake communication between the first and second devices, the handshake communication being used to provide agreement between the first and second devices on the at least one shared secret without revealing the shared secret through communications between the first and second devices;

the first and second devices configuring to selectively communicate any of a clear text communication and a cipher text communication therebetween, based on at least the first processor determining that the second end-user device is configured for secure communications, including communicating an encrypted message between the first device and the second device without requiring the encrypted message to be decrypted intermediate of the first and second devices, and to use the shared secret to decrypt the encrypted message;

the first and second devices being further configured to keep the communicated encrypted messages encrypted except while being used or viewed.

11. The system of claim 10 wherein the first device processor determines whether the second device is configured for secure communications based on a challenge-response verification protocol that includes the first device sending a first challenge to the second end-user device and receiving a first response to the first challenge, the second device sending a second challenge to the first end-user device and receiving a second response to the second challenge from the first end-user device, the first end-user device first processor being configured to test the first response, and the second end-user device second processor being configured to test the second response.

12. An end-user device providing end-to-end secure encrypted communications with a further end-user device, the end-user device comprising:

a processor;

a display coupled to the processor

a communications module coupled to the processor; and

a storage device coupled to the processor, the storage device storing program instructions that when executed by the processor control the processor to;

automatically generate a public/private key pair;

determine whether the further end-user device is configured to securely communicate;

conditioned on the processor determining that the further end-user device is not configured to securely communicate, configuring to exchange clear text communications with the further end-user device;

agreeing with the further device on at least one shared secret based on a handshake communication between the device and the further device, including deriving at least part of the shared secret based at least in part on the public/private key pair and determining whether the further device agrees on the shared secret without revealing the shared secret through the handshake communication;

conditioned on the processor determining that the further end-user device is configured to securely communicate, configuring to exchange any of clear text and cipher text communications with the further end-user device, including receiving an encrypted message from the further device and using the shared secret to decrypt the received encrypted message into message clear text without requiring the encrypted message to be decrypted and re-encrypted intermediate of the first and further devices; and

keep the received encrypted message encrypted except while the processor displays or is otherwise using the message clear text.

13. The device of claim 12 wherein said message comprises an SMS message.

14. The device of claim 12 wherein the processor is configured to encrypt, an SMS message.

15. The device of claim 12 wherein the processor is configured to encrypt, an MMS message.

16. The device of claim 12 wherein the device is configured to enable downloading on demand of an application permitting the device to decrypt a secure message sent by the further device.

17. The device of claim 12 wherein the agreed-upon shared secret is unique to the device and the further device and the shared secret is derived from a public key associated with the device and a public key associated with the further device.

18. The device of claim 12 wherein the processor is further configured to autogenerate a user Public/Private key pair.

19. The device of claim 18 wherein the processor autogenerates the user Public/Private key pair upon download or installation of a security application used to communicate secure messages.

20. The device of claim 12 wherein the device is configured to keep communicated encrypted message encrypted except while being viewed by executing a downloaded application that coexists with other applications on the device without interfering with other applications.

21. The device of claim 12 wherein the secure communications capability is transparent to the user.

22. The device of claim 12 wherein execution of the instructions to determine whether the further end-user device is configured for secure communications implements a two-way challenge-response verification protocol comprising the end-user device sending a first challenge to the further end-user device and receiving a first response to the first challenge, the further end-user device sending a second challenge to the end-user device and receiving a second response to the second challenge from the end-user device, and verifying a cryptographic hash value provided by the first response.