System and method for secure instant messaging

Patent metadata

Field	Value
Publication number	US-8958559-B2
Application number	US-201113224599-A
Country	US
Kind code	B2
Filing date	Sep 2, 2011
Priority date	Jun 3, 2011
Publication date	Feb 17, 2015
Grant date	Feb 17, 2015

Abstract

A system and method for secure instant messaging are described. For example, in one embodiment, a first user identifies a second user for an instant messaging session with the ID code of the second user. The first user is provided with network information for the second user and a public key associated with the second user. The first user encrypts an instant message using the public key of the second user and a private key. In one embodiment, the first user encrypts the content of the instant message (e.g., any text and/or attachments) using the public key of the second user and signs the content using the private key of the first user. The encrypted message is transmitted from the first user to the second user. The second user decrypts the instant message using the second user's private key and verifies the signature with the first user's public key.

First claim

We claim:

1. A method for implementing secure instant messaging comprising:
receiving, by an identity service from a mobile device of first user, a request to establish an instant messaging session with a second user, the request including an identification code identifying the second user;
determining, by the identity service, whether the second user has one or more mobile devices registered on a network service;
if the second user has one or more mobile devices registered, providing, by the identity service to the mobile device of the first user, addressing information identifying the one or more mobile devices of the second user and a public key associated with the second user;
providing, by the identity service to a push notification service, a session key comprising a signature generated with identification codes of the first and second users and network information for the mobile devices of the first and second users;
receiving, by a push notification service from the mobile device of the first user, an encrypted instant message generated by the mobile device of the first user using the public key of the second user and a private key of the first user;
transmitting, by the push notification service to a secure instant message service, the session key and the encrypted instant message;
verifying, by the secure instant message service, the encrypted message using the identification codes of the first and second users, the network information of the first and second users, and the session key;
receiving, be the push notification service from the secure instant message service, the verified encrypted message; and
transmitting, by the push notification service to the one or more mobile devices of the second user, the verified encrypted instant message, the one or more mobile devices of the second user subsequently decrypting the verified encrypted instant message using a private key of the second user.

2. The method as in claim 1 wherein the identification code comprises an email address of the second user.

3. The method as in claim 1 wherein the address information comprises a token uniquely identifying the one or more mobile devices of the second user on the network service.

4. The method as in claim 1 wherein determining further comprises:
querying a registration database to determine if the second user is registered on the network service, the registration database associating the second user with one or more identification codes.

5. The method as in claim 1 wherein encrypting the instant message further comprises encrypting content of the instant message including any text and/or attachments using the public key of the second user and signing the content using the private key of the first user.

6. The method as in claim 5 wherein decrypting the verified encrypted instant message further comprises decrypting the content using the second user's private key and verifying the signature on the content using the first user's public key.

7. The method as in claim 6 wherein the one or more mobile devices of the second user retrieves the first user's public key from the identity service.

8. The method as in claim 1 wherein verifying comprises regenerating the session key at the secure instant messaging service.

9. A system implementing secure instant messaging including a non-transitory memory for storing program code and at least one processor for processing the program code to perform the operations of:
receiving, by an identity service from a mobile device for a first user, a request to establish an instant messaging session with a second user, the request including an identification code identifying the second user;
determining, by the identity service, whether the second user has one or more mobile devices registered on a network service;
if the second user has one or more mobile devices registered, providing, by the identity service to the mobile device of the first user, addressing information identifying the one or more mobile devices of the second user and a public key associated with the second user;
receiving, by a push notification service from the mobile device of the first user, an encrypted instant message generated by the mobile device of the first using the public key of the second user and a private key of the first user;
providing, by the identity service to the push notification service a session key comprising a signature generated with identification codes of the first and second user and network information of the mobile devices of the first and second users;
transmitting, by the push notification service to a secure instant message service, the session key and the encrypted instant message;
verifying, by the secure instant message service, the encrypted instant message using the identification codes of the first and second users, the network information of the first and second users and the session key;
receiving, by the push notification service from the secure message service, the verified encrypted instant message; and
transmitting, by the push notification service to the one or mobile devices of the second user, the verified encrypted instant message, the one or more mobile devices of the second user subsequently decrypting the verified encrypted message using a private key of the second user.

10. The system as in claim 9 wherein the identification code comprises an email address of the second user.

11. The system as in claim 9 wherein the address information comprises a token uniquely identifying the one or more mobile devices of the second user on the network service.

12. The system as in claim 9 wherein determining further comprises:
querying a registration database to determine if the second user is registered on the network service, the registration database associating the second user with one or more identification codes.

13. The system as in claim 9 wherein encrypting the instant message further comprises encrypting content of the instant message including any text and/or attachments using the public key of the second user and signing the content using the private key of the first user.

14. The system as in claim 13 wherein decrypting the verified encrypted instant message further comprises decrypting the content using the second user's private key and verifying the signature on the content using the first user's public key.

15. The system as in claim 14 wherein the one or more mobile devices of the second user retrieves the first user's public key from the identity service.

16. The non-transitory machine-readable medium as in claim 13 wherein decrypting the verified encrypted message further comprises decrypting the content using the second user's private key and verifies the signature on the content using the first user's public key.

17. The non-transitory machine-readable medium as in claim 16 wherein the second user retrieves the first user's public key from the identity service.

18. The system as in claim 9 wherein verifying comprises regenerating the session key at the secure instant messaging service.

19. A non-transitory machine-readable medium having program code stored thereon which, when executed by a machine, causes the machine to perform the operations of:
receiving, by an identity service from a mobile device of a first user, a request to establish an instant messaging, session with a second user, the request including an identification code identifying the second user;
determining, by the identity service, whether the second user has one or more mobile devi

Assignees

• Medina Alexander A
• Vyrros Andrew H
• Bleau Darryl N
• Davey Jeffrey T
• Santamaria Justin E
• Wood Justin N
• Apple Inc

Inventors

• Medina Alexander A
• Vyrros Andrew H
• Bleau Darryl N
• Davey Jeffrey T
• Santamaria Justin E
• Wood Justin N

Classifications

• H04L63/0442 Primary

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• H04W12/06

  Authentication · CPC title

• H04L12/22 Primary

  Arrangements for preventing the taking of data from a data transmission channel without authorisation (means for verifying the identity or the authority of a user of a secure or secret communication system H04L9/32) · CPC title

• H04L51/04

  Real-time or near real-time messaging, e.g. instant messaging [IM] · CPC title