Federated messaging

Patent metadata

Field	Value
Publication number	US-11095662-B2
Application number	US-201715689239-A
Country	US
Kind code	B2
Filing date	Aug 29, 2017
Priority date	Aug 29, 2017
Publication date	Aug 17, 2021
Grant date	Aug 17, 2021

Abstract

The present disclosure describes a method, system, and non-transitory computer readable medium that includes instructions that permit users of different secure communication networks to exchange secure communications. A secure communication platform includes a user database that allows users from different secure communication networks to access keys for recipients outside of their network. Additionally, the secure communication platform provides a high degree of trust regarding the sender's identity, allowing the receiving network to trust the sender.

First claim

What is claimed is:

1. A method for federated messaging, the method comprising:
receiving, by a first server from a first device belonging to a first secure communication network, a first communication for a second device belonging to a second secure communication network, wherein the first communication comprises encrypted routing data and an encrypted payload;
decrypting, by the first server, the encrypted routing data to obtain a first security group identifier associated with a first group to which the first device belongs and a second security group identifier associated with a second group, that is different from the first group, to which the second device belongs;
determining, by the first server, whether a first set of permissions associated with the first security group identifier permit the first device to communicate with the second secure communication network; and
determining, by the first server, whether a second set of permissions associated with the second security group identifier permit the second device to communicate with the first secure communication network;
providing, by the first server, the first communication to the second device on the second secure communication network when the first device and the second device are permitted to communicate;
receiving, by the first server from the first device, a second communication for a third device belonging to a third secure communication network, wherein the second communication comprises the first security group identifier and a third security group identifier associated with a third group, that is different from the first group, to which the third device belongs;
determining whether the first set of permissions associated with the first security group identifier permit the first device to communicate with the third secure communication network;
determining, by the first server, whether a third set of permissions associated with the third security group identifier permit the third device to communicate with the first secure communication network; and
discarding, by the first server, the first communication when at least one of the first set of permissions do not permit the first device to communicate with the third secure communication network or the third set of permissions do not permit the third device to communicate with the first secure communication network.

2. The method of claim 1 , wherein decrypting the encrypted routing data comprises using a first key.

3. The method of claim 2 , wherein the first key is a private key associated with the first server.

4. The method of claim 1 , comprising:
receiving, by the first server from the first device, a third communication for a fourth device belonging to a fourth secure communication network, wherein the third communication comprises the first security group identifier and a fourth security group identifier associated with a fourth group, that is different from the first group, to which the fourth device belongs;
determining, by the first server, whether the first secure communication network and the fourth secure communication network are the same network; and
providing, by the first server, the third communication to the fourth device when the first secure communication network is the same network as the fourth secure communication network.

5. A non-transitory computer-readable medium comprising instructions that, when executed by at least one processor, perform the steps of:
receiving a first communication from a first device belonging to a first secure communication network for a second device belonging to a second secure communication network, wherein the first communication comprises encrypted routing data and an encrypted payload;
decrypting the encrypted routing data to obtain a first security group identifier associated with a first group to which the first device belongs and a second security group identifier associated with a second group, that is different from the first group, to which the second device belongs;
determining whether a first set of permissions associated with the first security group identifier permit the first device to communicate with the second secure communication network; and
determining whether a second set of permissions associated with the second security group identifier permit the second device to communicate with the first secure communication network;
providing the first communication to the second device on the second secure communication network when the first device and the second device are permitted to communicate;
receiving, from the first device, a second communication for a third device belonging to a third secure communication network, wherein the second communication comprises the first security group identifier and a third security group identifier associated with a third group, that is different from the first group, to which the third device belongs;
determining whether the first set of permissions associated with the first security group identifier permit the first device to communicate with the third secure communication network;
determining whether a third set of permissions associated with the third security group identifier permit the third device to communicate with the first secure communication network; and
discarding the second communication when at least one of the first set of permissions do not permit the first device to communicate with the third secure communication network or the third set of permissions do not permit the third device to communicate with the first secure communication network.

6. The non-transitory computer-readable medium of claim 5 , comprising instructions that, when executed by the at least one processor, perform the steps of:
decrypting the encrypted routing data using a first key.

7. The non-transitory computer-readable medium of claim 6 , wherein the first key is a private key associated with a first server.

8. The non-transitory computer-readable medium of claim 5 , comprising instructions that, when executed by the at least one processor, perform the steps of:
receiving, from the first device, a third communication for a fourth device belonging to a fourth secure communication network, wherein the third communication comprises the first security group identifier and a fourth security group identifier associated with a fourth group, that is different from the first group, to which the fourth device belongs;
determining whether the first secure communication network and the fourth secure communication network are the same network; and
providing the third communication to the fourth device when the first secure communication network is the same network as the fourth secure communication network.

9. The method of claim 1 , wherein the first secure communication network is associated with a first corporation and the second secure communication network is associated with a second corporation different than the first corporation.

10. The method of claim 1 , further comprising storing, by the first server and in a single database, profile information associated with users in each of the first secure communication network, the second secure communication network, and the third secure communication network.

11. The non-transitory computer-readable medium of claim 5 , wherein the first secure communication network is associated with a first corporation and the second secure communication network is associated with a second corporation different than the first corporation.

12. The non-transitory computer-readable medium of claim 5 , comprising instructions that, when executed by the at least one processor, perform the steps of storing, in a single dat

Assignees

• Wickr Inc
• Amazon Tech Inc

Inventors

• Bhatnagar Arjun
• Howell Christopher

Classifications

• G06Q10/107 Primary

  Computer-aided management of electronic mailing [e-mailing] · CPC title

• H04L51/56

  Unified messaging, e.g. interactions between e-mail, instant messaging or converged IP messaging [CPM] · CPC title

• H04L51/212

  using filtering or selective blocking · CPC title

• H04L51/214

  using selective forwarding · CPC title

• H04L9/08

  Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} · CPC title