Secure instant messaging system

• US 9,509,681 B2
• Filed: 05/15/2015
• Issued: 11/29/2016
• Est. Priority Date: 02/20/2003
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Lord, Robert B., Hayes, Terry N., Uberti, Justin
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/713,267
• Publication Number:
  US 20150264042A1
• Time in Patent Office: 564 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure instant messaging (IM) system integrates secure instant messaging into existing instant messaging systems. A certificate authority (CA) issues security certificates to users binding the user'"'"'s IM screen name to a public key, used by sending users to encrypt messages and files for the user. The CA uses a subscriber database to keep track of valid users and associated information, e.g. user screen names, user subscription expiration dates, and enrollment agent information. A user sends his certificate to an instant messaging server which publishes the user'"'"'s certificate to other users. Users encrypt instant messages and files using an encryption algorithm and the recipient'"'"'s certificate. A sending user can sign instant messages using his private signing key. The security status of received messages is displayed to recipients.

Claims

1. A method to secure communication of data via a messaging system across a computer network, comprising:

accessing a certificate at a first messaging client, the certificate sent by a second messaging client via a messaging server, wherein the certificate associates a screen name with a public key value, the screen name being associated with a second user of the second messaging client, wherein a first user of the first messaging client is associated to the screen name of the second user by being listed on at least one list of preferred users of the second user as determined by the messaging server;

encrypting an electronic message using the public key value associated with the screen name of the second user; and

sending the encrypted message to the messaging server to be sent to the second messaging client.

2. The method of claim 1 wherein the messaging server is an instant messaging server, and wherein the electronic message is an instant message.

3. The method of claim 1 wherein the certificate is issued by a certificate authority.

4. The method of claim 1 further comprising:

requesting the messaging server for updated certificate information associated with the second user;

receiving the updated certificate information from the messaging server;

determining that the updated certificate information does not match the certificate;

requesting the messaging server for an updated certificate associated with the second user; and

receiving the updated certificate from the messaging server.

5. The method of claim 1 further comprising:

receiving a hash value from the messaging server;

comparing the hash value with a hash value for the certificate stored in a cache accessible by the first messaging client;

in response to the hash value not matching the cached hash value or the cached hash value not existing;

sending a request for an updated certificate to the messaging server;

receiving the updated certificate from the messaging server; and

caching the hash value in the cache accessible by the first messaging client.

6. The method of claim 1 wherein encrypting the message includes:

generating a conversation encryption key value; and

storing the conversation encryption key value in the encrypted message,

wherein the conversation encryption key value is configured to be used by the second messaging client to decrypt the encrypted message during an instant messaging conversation.

7. The method of claim 1 further comprising:

signing the encrypted message with a private signing key associated with the screen name of the first user, wherein the second messaging client is configured to verify the signed message using a certificate of the first user.

8. The method of claim 1 wherein the certificate is associated with a particular physical location of the second user.

9. A method to secure communication of data via a messaging system across a computer network, comprising:

sending a first certificate from a first messaging client to a messaging server, wherein the first certificate associates a first screen name with a first public key value, the first screen name being associated with a first user of the first messaging client, wherein the first certificate is sent by the messaging server to users who are associated to the first screen name of the first user by being listed on at least one list of preferred users of the first user;

receiving an electronic encrypted message from a second messaging client via the messaging server, the encrypted message encrypted using the first public key value, wherein the second messaging client is associated with a second user included on the at least one list of preferred users; and

decrypting the encrypted message using a private key associated with the first user.

10. The method of claim 9 further comprising receiving a second certificate at the first messaging client, the second certification sent by the second messaging client via the messaging server, wherein the second certificate associates a second screen name with a second public key value, the second screen name being associated with the second user.

11. The method of claim 10 further comprising:

requesting the messaging server for updated certificate information associated with the second user;

receiving the updated certificate information from the messaging server;

determining that the updated certificate information does not match the second certificate;

requesting the messaging server for an updated certificate associated with the second user; and

receiving the updated certificate from the messaging server.

12. The method of claim 9 wherein the first certificate is issued by a certificate authority.

13. The method of claim 9 wherein the messaging server is an instant messaging server, and wherein the electronic message is an instant message.

14. The method of claim 9 wherein the encrypted message is received with a wrapping algorithm and a wrapping key, and further comprising:

extracting the wrapping key from the encrypted message; and

using the wrapping algorithm and the wrapping key to unwrap the encrypted message.

15. The method of claim 9 wherein decrypting the message includes:

obtaining a conversation encryption key value from decrypting the encrypted message; and

reusing the conversation encryption key in subsequent messages during an instant message conversation with the second messaging client.

16. The method of claim 9 wherein the encrypted message is signed, and further comprising verifying the signed message using the first public key value.

17. A system to secure communication of data, the system comprising:

a cache storing a certificate at a first messaging client, the certificate sent by a second messaging client via a messaging server, wherein the certificate associates a screen name with a public key value, the screen name being associated with a second user of the second messaging client, wherein a first user of the first messaging client is associated to the screen name of the second user by being listed on at least one list of preferred users of the second user as determined by the messaging server;

at least one processor configured to access the cache and configured to;

encrypt an electronic message using the public key value associated with the screen name of the second user; and

send the encrypted message to the messaging server to be sent to the second messaging client.

18. The system of claim 17 wherein the messaging server is an instant messaging server, and wherein the electronic message is an instant message.

19. The system of claim 17 wherein the at least one processor is further configured to:

request the messaging server for updated certificate information associated with the second user;

receive the updated certificate information from the messaging server;

determine that the updated certificate information does not match the accessed certificate;

request the messaging server for an updated certificate associated with the second user; and

receive the updated certificate from the messaging server.

20. The system of claim 17 wherein the at least one processor is further configured to:

sign the encrypted message with a private signing key associated with the screen name of the first user, wherein the second messaging client is configured to verify the signed message using a certificate of the first user.