Digital security bubble

• US 9,667,417 B1
• Filed: 07/02/2015
• Issued: 05/30/2017
• Est. Priority Date: 07/16/2012
• Status: Active Grant

• Current Assignee: Wickr Inc. (Amazon.com, Inc.)
• Original Assignee: Wickr Inc. (Amazon.com, Inc.)
• Inventors: Coppa, Kara Lynn, Howell, Christopher A., Statica, Robert
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US14/791,196
• Time in Patent Office: 698 Days
• Field of Search: 713151
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2203/04104 Multi-touch detection in digitiser, i.e. details about the simultaneous detection of a plurality of touching locations, e.g. multiple fingers or pen and finger
• CPC Class Codes: G06F 2203/04808 Several contacts: gestures triggering a specific function, e.g. scrolling, zooming, right-click, when the user establishes several contacts with the surface simultaneously; e.g. using several fingers or a combination of fingers and pen
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: G06F 3/04886 by partitioning the display area of the touch-screen or the surface of the digitising tablet into independently controllable areas, e.g. virtual keyboards or menus
• CPC Class Codes: G06V 20/64 Three-dimensional objects
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0869 : involving random numbers or seeds
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3066 : involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3236 : using cryptographic hash functions

Abstract

A digital security bubble encapsulation is received from a sender. The encrypted digital security bubble encapsulation includes an encrypted message, an encrypted first key, and an identifier associated with an intended recipient. The encrypted digital security bubble encapsulation is decrypted. The received identifier and a device identifier are compared. The encrypted first key is decrypted in response to a determination that the identifier received in the digital security bubble encapsulation matches the device identifier. The encrypted message is decrypted using the first key.

Claims

1. A system, comprising:

a processor configured to;

receive an encrypted encapsulation from a sender, wherein the encrypted encapsulation includes an encrypted message, an encrypted first key, and a device identifier associated with an intended recipient wherein the processor is further configured to receive notification of the encrypted encapsulation from a security platform and download the encrypted encapsulation from the security platform in response to receiving the notification;

decrypt the encrypted encapsulation;

compare the received device identifier with a local device identifier;

decrypt the encrypted first key in response to a determination that the received device identifier matches the local device identifier;

decrypt the encrypted message using the first key to produce a decrypted message; and

provide the decrypted message to a recipient;

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the device identifier is based at least in part on at least one hardware identifier.

3. They system of claim 1, wherein the first key is a symmetric key.

4. The system of claim 1, wherein the encrypted encapsulation includes a plurality of encrypted first keys.

5. The system of claim 4, wherein each of the plurality of encrypted first keys is encrypted with a second key associated with an intended recipient.

6. The system of claim 1, wherein the processor is further configured to decrypt the encrypted first key using a second key.

7. The system of claim 6, wherein the second key is a private key of the recipient.

8. The system of claim 1, wherein the encrypted encapsulation includes at least one message control option.

9. The system of claim 8, wherein the at least one message control option includes a lifetime of the message.

10. The system of claim 9, wherein the processor is further configured to delete the decrypted message after an expiration of the lifetime.

11. The system of claim 1, wherein the at least one message control option is selected from the group consisting of:

sharing, saving, forwarding, recalling, and deleting.

12. A method, comprising:

receiving an encrypted encapsulation from a sender, wherein the encrypted encapsulation includes an encrypted message, an encrypted first key, and a device identifier associated with an intended recipient wherein the processor is further configured to receive notification of the encrypted encapsulation from a security platform and download the encrypted encapsulation from the security platform in response to receiving the notification;

decrypting the encrypted encapsulation;

comparing the received device identifier with a local device identifier;

decrypting the encrypted first key in response to a determination that the received device identifier matches the local device identifier;

decrypting the encrypted message using the first key to produce a decrypted message; and

providing the decrypted message to a recipient.

13. The method of claim 12 wherein the device identifier is based at least in part on at least one hardware identifier.

14. The method of claim 12, wherein the first key is a symmetric key.

15. The method of claim 12, wherein the encrypted encapsulation includes a plurality of encrypted first keys, wherein each of the plurality of encrypted first keys is encrypted with a second key associated with an intended recipient.

16. The method of claim 12, further comprising:

decrypting the encrypted first key using a second key, wherein the second key is a private key of the recipient.

17. The method of claim 12, wherein the encapsulation includes at least one message control option selected from the group consisting of message lifetime, sharing, saving, forwarding, recalling, and deleting.

18. The method of claim 17, further comprising:

deleting the decrypted message after an expiration of the lifetime option.

19. A computer program product embodied in a tangible computer readable storage medium and comprising computer instructions for:

receiving an encrypted encapsulation from a sender, wherein the encrypted encapsulation includes an encrypted message, an encrypted first key, and a device identifier associated with an intended recipient wherein the processor is further configured to receive notification of the encrypted encapsulation from a security platform and download the encrypted encapsulation from the security platform in response to receiving the notification;

decrypting the encrypted encapsulation;

comparing the received device identifier with a local device identifier;

decrypting the encrypted first key in response to a determination that the received device identifier matches the local device identifier;

decrypting the encrypted message using the first key to produce a decrypted message; and

providing the decrypted message to a recipient.

20. The computer program product of claim 19, further comprising computer instructions for:

deleting the decrypted message after an expiration of a lifetime option included in encapsulation.