Secure instant messaging system

• US 9,071,597 B2
• Filed: 10/05/2012
• Issued: 06/30/2015
• Est. Priority Date: 02/20/2003
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Lord, Robert B., Hayes, Terry N, Ubertin, Justin
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US13/646,579
• Publication Number:
  US 20130036302A1
• Time in Patent Office: 998 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure instant messaging (IM) system integrates secure instant messaging into existing instant messaging systems. A certificate authority (CA) issues security certificates to users binding the user'"'"'s IM screen name to a public key, used by sending users to encrypt messages and files for the user. The CA uses a subscriber database to keep track of valid users and associated information, e.g. user screen names, user subscription expiration dates, and enrollment agent information. A user sends his certificate to an instant messaging server which publishes the user'"'"'s certificate to other users. Users encrypt instant messages and files using an encryption algorithm and the recipient'"'"'s certificate. A sending user can sign instant messages using his private signing key. The security status of received messages is displayed to recipients.

Claims

1. A process of facilitating the exchange of secure data via an instant messaging system comprising the steps of:

receiving a certificate, wherein the certificate is issued to a first user and associated with the first user'"'"'s screen name;

wherein the certificate includes a public key;

responsive to receiving the certificate, determining based on the first user'"'"'s screen name, a list of preferred users associated with the first user'"'"'s screen name;

sending the certificate to a second IM client that is associated with a second user on the list of preferred users;

receiving an encrypted IM message from the second IM client, wherein the encrypted IM message is encrypted using the public key included in the certificate;

sending the encrypted IM message to a first IM client associated with the first user.

2. The process of claim 1, wherein

the certificate is issued by a certificate authority;

and

the certificate is received from the first IM client.

3. The process of claim 1, further comprising:

calculating a hash value for the certificate;

sending the hash value to the second IM client;

sending the certificate responsive to receiving a request to send the certificate to the second IM client.

4. A process of facilitating the exchange of secure data via an instant messaging (IM) system comprising the steps of:

receiving at a second IM client a hash of a certificate issued to a first user;

selectively requesting, based on the hash, the certificate issued to the first user;

receiving the certificate, and storing the certificate in association with the hash;

wherein the certificate includes a public key associated with the first user;

receiving an IM message entered by a second user, the IM message addressed to the first user;

encrypting, using the first user'"'"'s public key, the IM message entered by the second user; and

sending the encrypted IM message addressed to the first user.

5. The process of claim 4, wherein the hash is a first hash and selectively requesting further comprises:

retrieving a second hash stored in association with the certificate issued to the first user;

comparing the first hash with the second hash;

requesting the certificate responsive to determining that the second hash does not match the first hash;

or

requesting the certificate responsive to failing to find the second hash stored in association with the certificate;

or

using the certificate stored in association with the second hash instead of requesting the certificate responsive to determining that the second hash matches the first hash.

6. The process of claim 4, wherein encrypting the IM message entered by the second user further comprises:

generating a conversation encryption key value; and

storing the conversation encryption key value in the encrypted IM message.

7. The process of claim 6, further comprising:

receiving an encrypted IM response message entered by the first user;

decrypting the encrypted IM response message using the conversation encryption key value; and

encrypting subsequent IM messages addressed to the first user using the conversation encryption key value.

8. The process of claim 4, wherein encrypting the IM message from the second user with the first user'"'"'s public key includes attaching an encryption algorithm to the encrypted IM message;

wherein the attached encryption algorithm is used to encrypt the encrypted IM message.

9. An IM server for the secure exchange of data via an instant message (IM) system comprising:

a processor programmed for receiving a certificate, wherein the certificate is issued to a first user and associated with the first user'"'"'s screen name;

wherein the certificate includes a public key;

a processor programmed for, responsive to receiving the certificate, determining based on the first user'"'"'s screen name, a list of preferred users associated with the first user'"'"'s screen name;

a processor programmed for sending the certificate to a second IM client that is associated with a second user on the list of preferred users;

a processor programmed for receiving an encrypted IM message from the second IM client, wherein the encrypted IM message is encrypted using the public key included in the certificate;

a processor programmed for sending the encrypted IM message to a first IM client associated with the first user.

10. The IM server of claim 9, wherein:

the certificate is issued by a certificate authority; and

the certificate is received from the first IM client.

11. The IM server of claim 9, further comprising:

a processor programmed for calculating a hash value for the certificate;

a processor programmed for sending the hash value to the second IM client; and

a processor programmed for sending the certificate responsive to receiving a request to send the certificate to the second IM client.