Encrypted group communication method

Embodiments herein include, for example, a method, comprising: generating a shared symmetric key to begin a communication session among a group of users by a first user; distributing, by the first user, the generated shared symmetric key to each user in the group of users; communicating within the communication session among a group of users, where each user encrypts a message to the group of users to be distributed through the communication session using the generated shared symmetric key, and each user decrypts a message received from the communication session using the generated shared symmetric key.

BACKGROUND

Technical Field

The embodiments herein generally relate to cryptography, and, more particularly, to a method of encrypted group communications.

Description of the Related Art

With communication occurring through a variety of communication channels, often to a group of individuals, information such as personal data and other sensitive information may be passed across a public network, such as the Internet. Such communication may include, for example, credential information, payment information, and/or personal account management information. To protect sensitive information, the information can be transmitted over a secure transmission connection provided by an encryption system.

Conventional encryption systems are often difficult to use and thereby introduce weaknesses in the overall systems. For example, asymmetric encryption relies on complex mathematics applied to private and public information (e.g., private and public keys) and is inherently inefficient. Symmetric encryption is significantly more efficient, but relies on secret information (e.g., a password, passphrase, or private key) that must remain private between all persons or devices with authorized access to the encrypted data.

The difficulties of conventional encryption systems increase when the secret information is publicly known. For example, when the secret information is publicly known, the entire encryption system becomes compromised and must be revised (e.g., resetting passwords, passphrases, private keys, etc.). Since various methods to obtain this secret information are well known and frequently use—techniques such as such as man-in-the-middle attacks, social engineering—it is therefore desirable to reduce exposure to an encryption system's private information when communication within a group and thereby reducing the potential attack surface employing such an encryption system.

SUMMARY

In view of the foregoing, an embodiment herein provides a method, comprising: generating a shared symmetric key to begin a communication session among a group of users by a first user; distributing, by the first user, the generated shared symmetric key to each user in the group of users; communicating within the communication session among a group of users, wherein each user encrypts a message to the group of users to be distributed through the communication session using the generated shared symmetric key, and each user decrypts a message received from the communication session using the generated shared symmetric key. In such a method, additional users may be added to the communication session when the first user distributes to the additional users the generated shared symmetric key. In addition, changing users within the group of users to reform the communication session among a new group of users may include: generating a new shared symmetric key by the first user; distributing, by the first user, the generated new shared symmetric key to each user in the new group of users; communicating to the communication session among a new group of users, wherein each user encrypts a message to the new group of users to be distributed through the communication session using the generated new shared symmetric key, and each user decrypts a message received from the communication session using the generated new shared symmetric key.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The embodiments herein provide a method of encrypted group communication. For example, a user (e.g., “Alice”) of an encrypted communication system (e.g., the Cyph™ secure messaging platform) would like to engage several other users to the system (e.g., “Bob,” “Carl,” and “David”) in an encrypted group communication. Conventional encrypted communication systems, however, require significant resources to encrypt and maintain encrypted group communications. For example, convention encrypted communication systems require N, to as many as N! (where N is the number of messages transmitted to the group), long-lived sessions (e.g., last multiple messages or multiple sessions). According to the embodiments herein, however, all encrypted group communications between Alice, Bob, Carl and David require N short-lived secure communication sessions and 1 long-lived session. As such, the embodiments herein are more efficient in computation use and network bandwidth use. These benefits are especially important in energy-constrained environments (such as communication that occurs on a mobile device relying on stored energy (e.g., a battery) to power the device). Additionally, the embodiments herein are simple, and more convenient, to implement, compared to conventional encrypted group communication systems

Referring now to the drawings, and more particularly toFIGS. 1 through 3, where similar reference characters denote corresponding features consistently throughout the figures, there are shown preferred embodiments.

FIG. 1illustrates a flow diagram illustrating a method1of an encrypted group communication according to an embodiment herein. As shown inFIG. 1, in step10, a first user (e.g., Alice) initiates a group communication session (e.g., on the Cyph™ secure messaging platform) with a Server (e.g., a computing device shown inFIGS. 2 and 3) and generates a shared symmetric key to be used by the group. According to one embodiment herein, Alice specifies all users in the group when initiating the group communication session. The first user then distributes the shared symmetric key individually to the other users (e.g., “Bob,” “Carl” and “David”) invited to the group communication. For example, Alice distributes the shared symmetric key to Bob, Carl and David on at least one of the following communication platforms: the Cyph™ secure messaging platform, the Off-The-Record (“OTR”) messaging platform and email messages using Pretty Good Privacy (“PGP”) encryption. Embodiments described herein, however, are not limited to these distribution methods and may include other methods of distribution known to those skilled in the art. According to one embodiment herein, when a user joins or leaves the group, the most senior member (e.g., Alice) may generate and redistribute a new shared symmetric key.

According to step20, any time a party communicates to the group using the secure group communication, that party encrypts the communication with the shared symmetric key. Moreover, according to step30, all parties decrypt communications sent to the group using the shared symmetric key. While not shown inFIG. 1, according to one embodiment herein, the secure group communication session terminates when the shared symmetric key is revoked.

FIG. 2illustrates an implementation of an exemplary networking environment (e.g., cloud computing environment500) for the embodiments described herein is shown and described. The cloud computing environment500may include one or more resource providers502a,502b,502c(collectively,502). Each resource provider502may include computing resources. In some implementations, computing resources may include any hardware and/or software used to process data. For example, computing resources may include hardware and/or software capable of executing algorithms, computer programs, and/or computer applications. In some implementations, exemplary computing resources may include application servers and/or databases with storage and retrieval capabilities. Each resource provider502may be connected to any other resource provider502in the cloud computing environment500. In some implementations, the resource providers502may be connected over a computer network508. Each resource provider502may be connected to one or more computing device504a,504b,504c(collectively,504), over the computer network508.

The cloud computing environment500may include a resource manager506. The resource manager506may be connected to the resource providers502and the computing devices504over the computer network508. In some implementations, the resource manager506may facilitate the provision of computing resources by one or more resource providers502to one or more computing devices504. The resource manager506may receive a request for a computing resource from a particular computing device504. The resource manager506may identify one or more resource providers502capable of providing the computing resource requested by the computing device504. The resource manager506may select a resource provider502to provide the computing resource. The resource manager506may facilitate a connection between the resource provider502and a particular computing device504. In some implementations, the resource manager506may establish a connection between a particular resource provider502and a particular computing device504. In some implementations, the resource manager506may redirect a particular computing device504to a particular resource provider502with the requested computing resource.

The embodiments herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment including both hardware and software elements. The embodiments that are implemented in software include but are not limited to, firmware, resident software, microcode, etc.

A representative hardware environment for practicing the embodiments herein is depicted inFIG. 3. This schematic drawing illustrates a hardware configuration of an information handling/computer system600in accordance with the embodiments herein. The system comprises at least one processor or central processing unit (CPU)610. The CPUs610are interconnected via system bus612to various devices such as a random access memory (RAM)614, read-only memory (ROM)616, and an input/output (I/O) adapter618. The I/O adapter618can connect to peripheral devices, such as disk units611and tape drives613, or other program storage devices that are readable by the system. The system can read the inventive instructions on the program storage devices and follow these instructions to execute the methodology of the embodiments herein. The system further includes a user interface adapter619that connects a keyboard615, mouse617, speaker624, microphone622, and/or other user interface devices such as a touch screen device (not shown) to the bus612to gather user input. Additionally, a communication adapter620connects the bus612to a data processing network625, and a display adapter621connects the bus612to a display device623which may be embodied as an output device such as a monitor, printer, or transmitter, for example.

For example,FIG. 3includes exemplary embodiments of a computing device and a mobile computing device that can be used to implement the techniques described in this disclosure. As a computing device, system600is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. As a mobile computing device, system600is intended to represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart-phones, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to be limiting.

Thus, as a computing device, system600includes a processor (e.g., CPUs610), a memory614, storage units (e.g., ROM616, disk units611, tape drives613), a high-speed interface618connecting to the memory614and multiple high-speed expansion ports619, and a low-speed interface (not shown) connecting to a low-speed expansion port (not shown) and a storage device. Each of the processors, the memory614, the storage device, the high-speed interface618, the high-speed expansion ports619, and the low-speed interface, are interconnected using various busses (e.g., bus612), and may be mounted on a common motherboard or in other manners as appropriate. The processor can process instructions for execution within the computing device, including instructions stored in the memory614or on the storage device to display graphical information for a GUI on an external input/output device, such as a display623coupled to the high-speed interface619. In other implementations, multiple processors and/or multiple buses may be used, as appropriate, along with multiple memories and types of memory. Also, multiple computing devices may be connected, with each device providing portions of the necessary operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).

The memory614stores information within the computing device. In some implementations, the memory614is a volatile memory unit or units. In some implementations, the memory614is a non-volatile memory unit or units. The memory614may also be another form of computer-readable medium, such as a magnetic or optical disk.

The storage device is capable of providing mass storage for the computing device. In some implementations, the storage device may be or contain a computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device, or a tape device, a flash memory or other similar solid state memory device, or an array of devices, including devices in a storage area network or other configurations. Instructions can be stored in an information carrier. The instructions, when executed by one or more processing devices (for example, processor), perform one or more methods, such as those described above. The instructions can also be stored by one or more storage devices such as computer- or machine-readable mediums (for example, the memory614, the storage device, or memory on the processor).

The high-speed interface618manages bandwidth-intensive operations for the computing device, while the low-speed interface manages lower bandwidth-intensive operations. Such allocation of functions is an example only. In some implementations, the high-speed interface618is coupled to the memory614, the display623(e.g., through a graphics processor or accelerator), and to the high-speed expansion ports619, which may accept various expansion cards (not shown). In the implementation, the low-speed interface is coupled to the storage device and the low-speed expansion port. The low-speed expansion port, which may include various communication ports (e.g., USB, Bluetooth®, Ethernet, wireless Ethernet) may be coupled to one or more input/output devices, such as a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, e.g., through a network adapter.

The computing device may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a standard server, or multiple times in a group of such servers. In addition, it may be implemented in a personal computer such as a laptop computer. It may also be implemented as part of a rack server system. Alternatively, components from the computing device may be combined with other components in a mobile device (not shown), such as a mobile computing device. Each of such devices may contain one or more of the computing device and the mobile computing device, and an entire system may be made up of multiple computing devices communicating with each other.

As a mobile computing device, system600includes a processor (e.g., CPUs610), a memory614, an input/output device such as a display623, a communication interface620, and a transceiver (not shown), among other components. The mobile computing device may also be provided with a storage device, such as a micro-drive or other device, to provide additional storage. Each of the processor, the memory614, the display623, the communication interface620, and the transceiver, are interconnected using various buses (e.g., bus612), and several of the components may be mounted on a common motherboard or in other manners as appropriate.

The processor can execute instructions within the mobile computing device, including instructions stored in the memory614. The processor may be implemented as a chipset of chips that include separate and multiple analog and digital processors. The processor may provide, for example, for coordination of the other components of the mobile computing device, such as control of user interfaces, applications run by the mobile computing device, and wireless communication by the mobile computing device.

The processor may communicate with a user through a control interface619and a display interface (not shown) coupled to the display623. The display623may be, for example, a TFT (Thin-Film-Transistor Liquid Crystal Display) display or an OLED (Organic Light Emitting Diode) display, or other appropriate display technology. The display interface may comprise appropriate circuitry for driving the display623to present graphical and other information to a user. The control interface619may receive commands from a user and convert them for submission to the processor. In addition, an external interface (not shown) may provide communication with the processor, so as to enable near area communication of the mobile computing device with other devices. The external interface may provide, for example, for wired communication in some implementations, or for wireless communication in other implementations, and multiple interfaces may also be used.

The memory614stores information within the mobile computing device. The memory614can be implemented as one or more of a computer-readable medium or media, a volatile memory unit or units, or a non-volatile memory unit or units. An expansion memory (not shown) may also be provided and connected to the mobile computing device through an expansion interface (not shown), which may include, for example, a SIMM (Single In Line Memory Module) card interface. The expansion memory may provide extra storage space for the mobile computing device, or may also store applications or other information for the mobile computing device. Specifically, the expansion memory may include instructions to carry out or supplement the processes described above, and may include secure information also. Thus, for example, the expansion memory may be provide as a security module for the mobile computing device, and may be programmed with instructions that permit secure use of the mobile computing device. In addition, secure applications may be provided via the SIMM cards, along with additional information, such as placing identifying information on the SIMM card in a non-hackable manner.

The memory may include, for example, flash memory and/or NVRAM memory (non-volatile random access memory), as discussed below. In some implementations, instructions are stored in an information carrier. The instructions, when executed by one or more processing devices (for example, processor), perform one or more methods, such as those described above. The instructions can also be stored by one or more storage devices, such as one or more computer- or machine-readable mediums (for example, the memory614, the expansion memory, or memory on the processor). In some implementations, the instructions can be received in a propagated signal, for example, over the transceiver or the external interface.

The mobile computing device may communicate wirelessly through the communication interface620, which may include digital signal processing circuitry where necessary. The communication interface620may provide for communications under various modes or protocols, such as GSM voice calls (Global System for Mobile communications), SMS (Short Message Service), EMS (Enhanced Messaging Service), or MMS messaging (Multimedia Messaging Service), CDMA (code division multiple access), TDMA (time division multiple access), PDC (Personal Digital Cellular), WCDMA (Wideband Code Division Multiple Access), CDMA2000, or GPRS (General Packet Radio Service), among others. Such communication may occur, for example, through the transceiver using a radio-frequency. In addition, short-range communication may occur, such as using a Bluetooth®, Wi-Fi™, or other such transceiver (not shown). In addition, a GPS (Global Positioning System) receiver module (not shown) may provide additional navigation- and location-related wireless data to the mobile computing device, which may be used as appropriate by applications running on the mobile computing device.

The mobile computing device may also communicate audibly using an audio codec, which may receive spoken information from a user and convert it to usable digital information. The audio codec may likewise generate audible sound for a user, such as through a speaker (e.g., speaker612or in a handset of the mobile computing device). Such sound may include sound from voice telephone calls, may include recorded sound (e.g., voice messages, music files, etc.) and may also include sound generated by applications operating on the mobile computing device.

The mobile computing device may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a cellular telephone (not shown). It may also be implemented as part of a smart-phone, personal digital assistant, or other similar mobile device.