Enterprise messaging platform

• US 9,866,591 B1
• Filed: 07/28/2015
• Issued: 01/09/2018
• Est. Priority Date: 06/25/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Wickr Inc. (Amazon.com, Inc.)
• Inventors: Statica, Robert, Howell, Christopher A., Coppa, Kara Lynn
• Primary Examiner(s): Abyaneh, Ali
• Assistant Examiner(s): Wade, Shaqueal
• Application Number:
  US14/811,765
• Time in Patent Office: 896 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 1/1607 Details of the supervisory signal
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A secure messaging platform for an enterprise environment is disclosed. The secure messaging platform enables users to exchange encrypted communications. Further, the secure messaging platform allows enterprise platforms to review the encrypted communications to ensure that they comply with company policies. Messages that comply with company policies may be provided to their intended recipients, while messages that fail to comply with company policies are not provided to their intended recipients. Additionally, the encrypted communications may be retained for a predetermined time.

Claims

1. A system, comprising:

a processor configured to;

receive an encrypted digital security bubble encapsulation from a sender, wherein the encrypted digital security bubble encapsulation includes an encrypted message, an encrypted first key, a key identifier, and a time-to-live value;

decrypt the encrypted digital security bubble encapsulation;

retrieve a private key from a pool of private keys using the key identifier received in the digital security bubble encapsulation;

decrypt the encrypted first key using the private key retrieved from the pool of private keys;

decrypt the encrypted message using the first key to produce a decrypted message;

analyze the decrypted message to determine whether the decrypted message is compliant with a set of corporate policies; and

in response to determining that the decrypted message is compliant with the set of corporate policies, provide the encrypted digital security bubble encapsulation, including the encrypted message, the encrypted first key, the key identifier, and the time-to-live value to one or more recipients; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1, wherein the processor is further configured to store the decrypted message in a retention database for a predetermined period of time.

3. The system of claim 2, wherein the retention database is configured to encrypt the decrypted message with a unique key.

4. The system of claim 1, wherein the processor is further configured to send an acknowledgement to the sender indicating that the encrypted digital security bubble encapsulation has been provided to the one or more recipients.

5. The system of claim 1, wherein the processor is further configured to block delivery of the encrypted digital security bubble encapsulation to the one or more recipients in response to determining that the decrypted message is non-compliant with at least one corporate policy.

6. The system of claim 5, wherein the processor is configured to notify the sender that the message was not delivered to the one or more recipients due to a compliance violation.

7. The system of claim 1, wherein the processor is further configured to send a negative acknowledgement to the sender when the decrypted message is determined to be non-compliant with at least one corporate policy.

8. The system of claim 7, wherein the processor is further configured to transmit instructions to the sender to delete the non-compliant message.

9. The system of claim 1, wherein providing the encrypted digital security bubble encapsulation to the one or more recipients includes sending an acknowledgement to the sender device to transmit the encrypted digital security bubble encapsulation to the one or more recipients.

10. A method, comprising:

receiving an encrypted digital security bubble encapsulation from a sender, wherein the encrypted digital security bubble encapsulation includes an encrypted message, an encrypted first key, a key identifier, and a time-to-live value;

decrypting the encrypted digital security bubble encapsulation;

retrieving a private key from a pool of private keys using the key identifier received in the digital security bubble encapsulation;

decrypting the encrypted first key using the private key retrieved from the pool of private keys;

decrypting the encrypted message using the first key to produce a decrypted message;

analyzing the decrypted message to determine whether the decrypted message is compliant with a set of corporate policies; and

in response to determining that the decrypted message is compliant with the set of corporate policies, providing the encrypted digital security bubble encapsulation, including the encrypted message, the encrypted first key, the key identifier, and the time-to-live value to one or more recipients.

11. The method of claim 10, further comprising storing the decrypted message in a retention database for a predetermined period of time.

12. The method of claim 11, wherein the retention database is configured to encrypt the decrypted message with a unique key.

13. The method of claim 10, further comprising sending an acknowledgement to the sender indicating that the encrypted digital security bubble encapsulation has been provided to the one or more recipients.

14. The method of claim 10, further comprising blocking delivery of the encrypted digital security bubble encapsulation to the one or more recipients in response to determining that the decrypted message non-compliant with at least one corporate policy.

15. The method of claim 14, further comprising notifying the sender that the message was not delivered to the one or more recipients due to a compliance violation.

16. The method of claim 10, further comprising sending a negative acknowledgement to the sender when the decrypted message is determined to be non-compliant with at least one corporate policy.

17. The method of claim 16, further comprising transmitting instructions to the sender to delete the non-compliant message.

18. The method of claim 10, wherein providing the encrypted digital security bubble encapsulation to the one or more recipients includes sending an acknowledgement to the sender device to transmit the encrypted digital security bubble encapsulation to the one or more recipients.

19. A computer program product embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving an encrypted digital security bubble encapsulation from a sender, wherein the encrypted digital security bubble encapsulation includes an encrypted message, an encrypted first key, a key identifier, and a time-to-live value;

decrypting the encrypted digital security bubble encapsulation;

retrieving a private key from a pool of private keys using the key identifier received in the digital security bubble encapsulation;

decrypting the encrypted first key using the private key retrieved from the pool of private keys;

decrypting the encrypted message using the first key to produce a decrypted message;

analyzing the decrypted message to determine whether the decrypted message is compliant with a set of corporate policies; and

in response to determining that the decrypted message is compliant with the set of corporate policies, providing the encrypted digital security bubble encapsulation, including the encrypted message, the encrypted first key, the key identifier, and the time-to-live value to one or more recipients.

20. The computer program product recited in claim 19, further comprising computer instructions for storing the decrypted message in a retention database for a predetermined period.

21. The computer program product of claim 20, wherein the retention database is configured to encrypt the decrypted message with a unique key.

22. The computer program product of claim 19, further comprising computer instructions for sending an acknowledgement to the sender indicating that the encrypted digital security bubble encapsulation has been provided to the one or more recipients.

23. The computer program product of claim 19, further comprising computer instructions for blocking delivery of the encrypted digital security bubble encapsulation to the one or more recipients in response to determining that the decrypted message is determined to be non-compliant with at least one corporate policy.

24. The computer program product of claim 23, further comprising computer instructions for notifying the sender that the message was not delivered to the one or more recipients due to a compliance violation.

25. The computer program product of claim 19, further comprising computer instructions for sending a negative acknowledgement to the sender when the decrypted message is determined to be non-compliant with at least one corporate policy.

26. The computer program product of claim 25, further comprising computer instructions for transmitting instructions to the sender to delete the non-compliant message.

27. The computer program product of claim 19, wherein providing the encrypted digital security bubble encapsulation to the one or more recipients when the decrypted message is determined to be compliant with one or more corporate policies further comprises computer instructions for sending an acknowledgement to the sender device to transmit the encrypted digital security bubble encapsulation to the one or more recipients.