Device independent secure messaging

Patent metadata

Field	Value
Publication number	US-11411932-B2
Application number	US-201715818685-A
Country	US
Kind code	B2
Filing date	Nov 20, 2017
Priority date	Nov 20, 2017
Publication date	Aug 9, 2022
Grant date	Aug 9, 2022

Abstract

Systems, devices, media, and methods are presented for device independent secure messaging. The systems and methods generate an encrypted message by encrypting message content, designated for a specified recipient, with an encryption key. The systems and methods select a set of recipient keys, associated with the specified recipient, from a plurality of member keys. For each recipient key, the systems and methods encrypt the encryption key to generate a set of encrypted keys and transmit the encrypted message and an encrypted key of the set of encrypted keys to one or more client devices associated with the specified recipient. The systems and methods then receive an acknowledgement indicating a termination status of the encrypted message.

First claim

What is claimed is:

1. A method, comprising:
encrypting, by one or more processors, message content of a message with an encryption key, by performing operations comprising:
identifying a first portion of the message content designated for one or more servers;
identifying a second portion of the message content designated for a specified recipient; and
encrypting the second portion of the message content with the encryption key to generate an encrypted message;

selecting a set of recipient keys from a plurality of member keys, the set of recipient keys associated with client devices that are used by the specified recipient to access a verified member account of a social messaging system;
generating a common key for each recipient key of the set of recipient keys, each common key computed between a recipient key and a public key of a sender of the encrypted message or a client device associated with the sender of the encrypted message, to generate a set of common keys;
exchanging, with the specified recipient, a one-time nonce at specified time intervals wherein the one-time nonce is valid during a specified time period and replaces a previous one-time nonce that has a time period that has expired;
generating a symmetric key for each common key of the set of common keys by applying a key derivation function to a respective common key of the set of common keys using the one-time nonce, to generate a set of symmetric keys;
encrypting the encryption key for each symmetric key of the set of symmetric keys to generate a set of encrypted keys;
transmitting, to each client device of the client devices that is associated with each recipient key used to encrypt the encrypted key, the encrypted message, an encrypted key of the set of encrypted keys that is associated with the recipient key for that client device that was used to encrypt the encrypted key, and the first portion of the message content, the first portion of the message content being transmitted unencrypted; and
receiving an acknowledgement indicating a termination status of the encrypted message.

2. The method of claim 1 , wherein the set of recipient keys are a set of public keys associated with the specified recipient and the one or more client devices that are used to log into a message account of the specified recipient.

3. The method of claim 1 , wherein the encryption key is a key pair including a private key and a public key, the method further comprising:
generating the encrypted message using the private key;
encrypting the public key using the set of recipient keys to generate a set of encrypted public keys; and
transmitting the encrypted message and one of the set of encrypted public keys to the one or more client devices.

4. The method of claim 1 , wherein the acknowledgement is received from a key database, the acknowledgement indicating a new recipient key for the specified recipient, the method further comprising:
receiving, from the key database storing the plurality of member keys, the new recipient key associated with the specified recipient;
encrypting the encryption key using the new recipient key to generate a new encrypted key; and
transmitting the encrypted message and the new encrypted key to one of the one or more client devices associated with the new recipient key.

5. The method of claim 1 , further comprising:
selecting a plurality of recipient keys including a plurality of sets of recipient keys associated with a plurality of specified recipients, wherein the plurality of sets of recipient keys comprises the set of recipient keys and the plurality of specified recipients comprises the specified recipient;
encrypting the encryption key using the plurality of recipient keys to generate a plurality of encrypted keys;
transmitting to the plurality of specified recipients the plurality of encrypted keys and the encrypted message; and
receiving a plurality of acknowledgements indicating a termination status of the encrypted message for the plurality of specified recipients.

6. The method of claim 1 , further comprising:
detecting a session termination for a sending client device associated with a member, the member sending of the encrypted message;
generating a symmetric key for the sending client device and the member;
encrypting a local state of the member on the sending client device with the symmetric key; and
transmitting a member log to a key database, the member log including a member identifier, a device identifier, and the symmetric key.

7. The method of claim 1 , wherein the encrypted messages is further designated for a second specified recipient and a recipient key associated with the second specified recipient has a value indicating that the second specified recipient is a fake recipient instead of an encryption key.

8. A system, comprising:
one or more processors; and
a non-transitory processor-readable storage medium storing processor executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
encrypting message content of a message with an encryption key, by performing operations comprising:
identifying a first portion of the message content designated for one or more servers;
identifying a second portion of the message content designated for a specified recipient; and
encrypting the second portion of the message content with the encryption key to generate an encrypted message;
selecting a set of recipient keys from a plurality of member keys, the set of recipient keys associated with client devices that are used by the specified recipient to access a verified member account of a social messaging system;

generating a common key for each recipient key of the set of recipient keys, each common key computed between a recipient key and a public key of a sender of the encrypted message or a client device associated with the sender of the encrypted message, to generate a set of common keys;
exchanging, with the specified recipient, a one-time nonce at specified time intervals wherein the one-time nonce is valid during a specified time period and replaces a previous one-time nonce that has a time period that has expired;
generating a symmetric key for each common key of the set of common keys by applying a key derivation function to a respective common key of the set of common keys using the one-time nonce, to generate a set of symmetric keys;
encrypting the encryption key for each symmetric key of the set of symmetric keys to generate a set of encrypted keys;
transmitting, to each client device of the client devices that is associated with each recipient key used to encrypt the encrypted key, the encrypted message, an encrypted key of the set of encrypted keys that is associated with the recipient key for that client device that was used to encrypt the encrypted key, and the first portion of the message content, the first portion of the message content being transmitted unencrypted; and
receiving an acknowledgement indicating a termination status of the encrypted message.

9. The system of claim 8 , wherein the set of recipient keys are a set of public keys associated with the specified recipient and the one or more client devices that are used to log into a message account of the specified recipient.

10. The system of claim 8 , wherein the encryption key is a key pair including a private key and a public key, the method further comprising:
generating the encrypted message using the private key;
encrypting the public key using the set of recipient keys to generate a set of encrypted public keys; and
transmitting the encrypted message and one of the set of encrypted public keys to the one or more cl

Assignees

• Snap Inc

Inventors

• Duong Michael
• Garg Anirudh
• Sankuratripati Subhash
• Xue Edward Chenhui
• Yung Marcel M

Classifications

• H04L9/0822

  using key encryption key · CPC title

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L9/0844

  with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title