Secure instant messaging

• US 20070003066A1
• Filed: 06/30/2005
• Published: 01/04/2007
• Est. Priority Date: 06/30/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Schwartz, Eyal, Holmes, John, Ford, Peter
• Granted Patent: US 7,949,138 B2
• Time in Patent Office: Days
• US Class Current: 380/286
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Secure instant messaging is described. In an embodiment, a messaging device encrypts a challenge identifier to generate an encrypted challenge message, and communicates the encrypted challenge message via a peer-to-peer communication link to a recipient messaging device. The recipient messaging device decrypts the encrypted challenge message and encrypts the challenge identifier as a return challenge identifier to generate an encrypted challenge return. The messaging device receives the encrypted challenge return from the recipient messaging device, decrypts the encrypted challenge return, and verifies that the return challenge identifier matches the challenge identifier to establish that communications are secure when communicated via the peer-to-peer communication link and, optionally, to establish control policies pertaining to a communication received at the recipient messaging device.

Claims

1. A method, comprising:

encrypting a challenge identifier to generate an encrypted challenge message;

communicating the encrypted challenge message via a peer-to-peer communication link to a recipient messaging device that decrypts the encrypted challenge message and encrypts the challenge identifier as a return challenge identifier to generate an encrypted challenge return;

receiving the encrypted challenge return from the recipient messaging device;

decrypting the encrypted challenge return; and

verifying that the return challenge identifier matches the challenge identifier to establish that communications are secure when communicated via the peer-to-peer communication link.

2. A method as recited in claim 1, further comprising:

randomly-generating the challenge identifier; and

storing the challenge identifier in memory.

3. A method as recited in claim 1, further comprising:

associating an issuance license with the recipient messaging device; and

storing the issuance license in memory to encrypt communications intended for the recipient messaging device.

4. A method as recited in claim 1, further comprising:

associating the an issuance license with the recipient messaging device;

obtaining a usage license corresponding to the issuance license; and

storing the usage license to decrypt communications received from the recipient messaging device.

5. A method as recited in claim 1, further comprising:

generating a communication to the recipient messaging device;

encrypting the communication with an encryption key embedded in an issuance license associated with the recipient messaging device to generate an encrypted communication; and

communicating the encrypted communication via the peer-to-peer communication link to the recipient messaging device that decrypts the encrypted communication.

6. A method as recited in claim 1, further comprising:

receiving an encrypted communication from the recipient messaging device via the peer-to-peer communication link; and

decrypting the encrypted communication with a usage license that corresponds to an issuance license which is associated with the recipient messaging device.

7. A method as recited in claim 1, wherein the secure communications communicated via the peer-to-peer communication link include instant messages.

8. A method as recited in claim 1, wherein the secure communications communicated via the peer-to-peer communication link include substantially real-time peer-to-peer communications.

9. A method as recited in claim 1, wherein the secure communications communicated via the peer-to-peer communication link include at least one of an instant message, a file transfer, an image transfer, a text-based communication, an audio communication, a video communication, or an audio/video communication.

10. An instant messaging system, comprising:

a peer-to-peer communication link; and

a first messaging device configured to establish that encrypted instant messages are secure when communicated from the first messaging device to the second messaging device via the peer-to-peer communication link.

11. An instant messaging system as recited in claim 10, wherein the first messaging device is further configured to establish that encrypted communications are secure when communicated via the peer-to-peer communication link, the encrypted communications including at least one of a file transfer, an image transfer, a text-based communication, an audio communication, a video communication, or an audio/video communication.

12. An instant messaging system as recited in claim 10, wherein the second messaging device is configured to establish that encrypted instant messages are secure when communicated from the second messaging device to the first messaging device via the peer-to-peer communication link.

13. An instant messaging system as recited in claim 10, wherein:

the first messaging device is further configured to encrypt a challenge identifier to generate an encrypted challenge, and communicate the encrypted challenge via the peer-to-peer communication link to the second messaging device;

the second messaging device is configured to decrypt the encrypted challenge, encrypt the challenge identifier as a return challenge identifier to generate an encrypted challenge return, and communicate the encrypted challenge return via the peer-to-peer communication link to the first messaging device; and

the first messaging device is further configured to decrypt the encrypted challenge return, and verify that the return challenge identifier matches the challenge identifier to establish that the encrypted instant messages are secure when communicated via the peer-to-peer communication link.

14. An instant messaging system as recited in claim 13, wherein the first messaging device is further configured to:

encrypt the challenge identifier with an encryption key embedded in an issuance license associated with the second messaging device to generate the encrypted challenge;

obtain a usage license corresponding to the issuance license; and

decrypt the encrypted challenge return with the usage license.

15. An instant messaging system as recited in claim 13, wherein the first messaging device is further configured to randomly generate the challenge identifier.

16. An instant messaging system as recited in claim 13, wherein the first messaging device is further configured to:

associate an issuance license with the second messaging device;

maintain the issuance license to encrypt instant messages;

encrypt an instant message with an encryption key embedded in the issuance license to generate an encrypted instant message; and

communicate the encrypted instant message to the second messaging device via the peer-to-peer communication link.

17. An instant messaging system as recited in claim 13, wherein the first messaging device is further configured to:

obtain a usage license corresponding to an issuance license that is associated with the second messaging device;

maintain the usage license to decrypt encrypted instant messages;

receive an encrypted instant message from the second messaging device via the peer-to-peer communication link; and

decrypt the encrypted instant message with the usage license.

18. One or more computer readable media comprising computer executable instructions that, when executed, direct an instant messaging device to:

encrypt a challenge identifier to generate an encrypted challenge message;

communicate the encrypted challenge message via a peer-to-peer communication link to a recipient messaging device;

decrypt an encrypted challenge return from the recipient messaging device; and

verify that a return challenge identifier received in the encrypted challenge return from the recipient messaging device matches the challenge identifier to establish that instant messages are secure when communicated via the peer-to-peer communication link.

19. One or more computer readable media as recited in claim 18, further comprising computer executable instructions that, when executed, direct the instant messaging device to:

associate an issuance license with the recipient messaging device;

maintain the issuance license to encrypt instant messages intended for the recipient messaging device;

obtain a usage license corresponding to the issuance license; and

maintain the usage license to decrypt instant messages received from the recipient messaging device.

20. One or more computer readable media as recited in claim 18, further comprising computer executable instructions that, when executed, direct the instant messaging device to:

generate an instant message for communication to the recipient messaging device;

encrypt the instant message with an encryption key embedded in an issuance license that is associated with the recipient messaging device to generate an encrypted instant message;

communicate the encrypted instant message as a secure communication to the recipient messaging device via the peer-to-peer communication link;

receive a second encrypted instant message as a secure communication from the recipient messaging device via the peer-to-peer communication link; and

decrypt the second encrypted instant message with a usage license corresponding to the issuance license that is associated with the recipient messaging device.