WO2015148365A1 - Messagerie sécurisée utilisant un dispositif de sécurité mobile sans fil - Google Patents

Messagerie sécurisée utilisant un dispositif de sécurité mobile sans fil Download PDF

Info

Publication number
WO2015148365A1
WO2015148365A1 PCT/US2015/021976 US2015021976W WO2015148365A1 WO 2015148365 A1 WO2015148365 A1 WO 2015148365A1 US 2015021976 W US2015021976 W US 2015021976W WO 2015148365 A1 WO2015148365 A1 WO 2015148365A1
Authority
WO
WIPO (PCT)
Prior art keywords
security device
mobile security
computing device
encryption
mobile
Prior art date
Application number
PCT/US2015/021976
Other languages
English (en)
Inventor
Peter Hauser
Original Assignee
Peter Hauser
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Peter Hauser filed Critical Peter Hauser
Publication of WO2015148365A1 publication Critical patent/WO2015148365A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/33—Security of mobile devices; Security of mobile applications using wearable devices, e.g. using a smartwatch or smart-glasses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices

Definitions

  • This application relates to secure messaging and, in particular, securing messaging utilizing a mobile security device that may be paired to a decryption device.
  • Devices such as smart watches, connected music players (e.g. iPod Touch and iPod Nano devices), smartphones, tablet computers, and eBook readers facilitate
  • a system for sending and receiving encrypted messages includes a mobile security device and a computing device.
  • the computing device comprises a memory, an encryption and/or decryption key stored in the memory, a communication port for sending and receiving the secure messages, a wireless transceiver to wirelessly communicate with the mobile security device, and an encryption/decryption engine to determine whether the wireless transceiver is in communication with the mobile security device and encrypt or decrypt the secure messages if the wireless transceiver is in communication with the mobile security device.
  • a system in another embodiment, includes a first computing device.
  • the first computing device includes a wireless transceiver, and an encryption engine to retrieve an encryption key associated with a recipient from an encryption key database, encrypt a message to the recipient, and send the message to the recipient.
  • the system also includes a mobile security device associated with the recipient having a wireless transceiver and a second computing device also associated with the recipient.
  • the second computing device includes a wireless receiver to receive the encrypted message, and a decryption engine to determine whether the mobile security device is in wireless communication with the second computing device and to decrypt the encrypted message if the mobile security device is in wireless communication with the second computing device.
  • a method for encrypting a message includes wirelessly pairing a mobile security device to a mobile computing device; receiving, by the mobile computing device, an encrypted message; determining, by the mobile computing device, whether the mobile security device is in communication with the mobile computing device; and decrypting the encrypted message, by the mobile computing device, if the mobile security device is in communication with the mobile computing device.
  • FIG. 1 is a block diagram of a system for sending and receiving secure messages.
  • FIG. 2 is a block diagram of a computing device for sending and receiving secure messages.
  • FIG. 3 is a block diagram of a mobile security device for sending and receiving secure messages.
  • FIG. 4 is a block diagram of a mobile security device for sending and receiving secure messages.
  • FIG. 5, FIG. 6, FIG. 7, FIG. 8, FIG. 9, FIG. 10, FIG. 11, FIG. 12, FIG. 13, and FIG. 13 are graphical displays of an application for sending and receiving secure messages.
  • FIG. 14 is a communication diagram of a process for sending and receiving secure messages.
  • This disclosure relates to secure end-to-end private messaging whereby messages are visible to the sender and receiver, and encrypted from the point where the sender submits the message, to the point where the receiver reads the message with a peer-to-peer encryption and authentication.
  • the system may prevent and/or discourage man-in-the- middle attack and where a wireless device is required to be connected in order to view the message (e.g. hardware lock) and the attacker views, relays, and/or alters the
  • only the sender and receiver are able to access the messages.
  • a system 100 for sending and receiving secure messages includes a mobile security device 102, which may be associated with a user 104.
  • Mobile security device 102 may be a worn device such as a watch, a key fob, or the like.
  • Mobile security device 102 may be in wireless communication with computing device 106.
  • Computing device 106 may be a mobile device such as a mobile phone, a PDA, a tablet, etc. In other embodiments, computing device 106 may be a laptop computer, a desktop computer, etc. Like mobile security device 102, computing device 106 may also be associated with user 104. For example, computing device 106 may the owned or carried by the user, may be issued to the user (by an employer for example), or may be provisioned for a user by a 3rd party such as a bank, etc.
  • Computing device 106 may include a wireless transceiver to communicate with mobile security device 102.
  • the wireless transceiver may be configured to communicate in accordance with a wireless communication protocol including, for example, a wireless network protocol, a personal network protocol, etc.
  • computing device 106 and mobile security device 102 communicate, and may be paired to each other, in accordance with Bluetooth or Bluetooth Low Energy protocols.
  • Computing device 106 may also include an encryption / decryption engine 108.
  • Encryption/decryption engine may comprise an encryption engine for encrypting secure messages, a decryption engine for decrypting secure messages, or both and may be a secure element capable of managing secure transactions.
  • Encryption / decryption engine 108 may be a custom circuit designed for encryption and decryption, software executed by a processor of computing device, a custom processor designed for encryption and decryption, or a combination of these things.
  • Computing device 106 may include a network transceiver that can communication over communications channel 110 to network 112.
  • Network 112 may be a cellular network, a local area network ("LAN”), a wide area network (“WAN”), an internet, etc., and the network transceiver is of a type capable of communicating with network 112.
  • network 112 may comprise multiple networks in
  • network 112 may include multiple cellular networks, multiple LANs, multiple WANs, multiple personal area networks (“PANs”), and the like.
  • PANs personal area networks
  • Data store 114 may also communicate computing device 106 via network 112.
  • Data store 114 may be an online computing device such as a server that can store data including encryption and decryption keys.
  • the encryption and decryption keys stored in data store 114 may each be associated with a message recipient, such as user 104.
  • data store 114 is a server running a database or cloud storage, or multiple servers running a database or cloud storage.
  • the servers that comprise data store 114 need not be traditional server computers, desktop computers and the like.
  • the servers that comprise data store 114 may include any device that can provide a storage area for data and can be access from network 112.
  • the servers may include laptops, mobile devices, so-called mini or thumb stick computers, etc.
  • the servers that comprise data store 114 may be capable of issuing secure keys to the computing device 106 via the same network 112.
  • System 100 may also include computing device 116, which may be associated with user 118, and may include encryption / decryption engine 120.
  • Computing device 116 may be the same as or similar to computing device 106, and encryption / decryption engine 120 may be the same as or similar to encryption / decryption engine 108.
  • user 118 may also have a mobile security device (not shown) which may be the same as or similar to mobile security device 102, and may be in communication with and/or paired to computing device 116.
  • a mobile security device (not shown) which may be the same as or similar to mobile security device 102, and may be in communication with and/or paired to computing device 116.
  • System 100 may be used for secure communication between computing devices 106 and 1 16.
  • user 118 may compose message 122 on computing device 116, and address the message to user 104.
  • Data store 114 may include an encryption key 124 associated with user 104.
  • encryption key 124 is a public key of a public private key pair, a symmetric key, or any type of cryptographic key that can be used to encrypt message 122 so that message 122 may be decrypted by user 104.
  • computing device 1 16 may determine whether it has a copy of encryption key 124 stored locally in a memory. If not, computing device 116 may communicate with data store 114 to retrieve encryption key 124, which may then be stored in memory, secure element, or non- volatile storage by computing device 116. Encryption / decryption engine 122 may then encrypt message 122 using encryption key and computing device 116 may send the encrypted message to computing device 106 over network 112. In an embodiment, encryption / decryption engine 120 will retrieve encryption key 124 each time a message is to be encrypted, and discard encryption key 124 without saving a local copy after encryption key 124 is used to encrypt message 122.
  • Message 122 may be transmitted from computing device 116 to computing device 106 in various ways.
  • computing device 106 may be running a server application to receive the message and computing device 116 may open a communication port directly to computing device 106 and transmit the message directly to computing device 106.
  • computing device 106 may transmit the message to an intermediate server communicating on network 112, which can then deliver the message to computing device 106.
  • Message 122 may take various forms. It may comprise a text message, an email, a data stream, or any type of data that can be transmitted between computing devices.
  • message 122 may contain various types of data including, but not limited to, text data, image data, location information, monetary fund transfer information, or other information that requires a secure data channel for communication, etc.
  • encryption / decryption engine may 108 may attempt to decrypt message 122.
  • decryption key 126 may be a private decryption key, a symmetrical key, or any other type of cryptographic key that can decrypt message 122.
  • decryption key 126 may be stored in a memory or in a secure element of computing device 106.
  • decryption key 126 may be stored in data store 114. In this case, encryption / decryption engine 108 may communicate with data store 114 to retrieve decryption key 126, which it can then store in a memory or discard after use.
  • mobile security device 102 may be associated with user 102 and may be in communication with computing device 106.
  • encryption / decryption engine may determine whether mobile security device 102 is within a proximity of computing device 106. For example, encryption / decryption engine may check to see whether wireless communication link 128 is present. If communication link 128 is broken, for example, encryption / decryption engine 108 may determine that mobile security device 106 is not in proximity to or is not communicating with computing device 106.
  • encryption / decryption engine may send a query message to mobile security device 102 and await a response. If no response is received from mobile security device 102, then encryption / decryption engine 108 may determine that mobile security device is not present and/or is not in proximity to computing device 106.
  • the query message may be encrypted and/or may contain unique identifiers to identify computing device 106 and/or mobile security device 102.
  • encryption / decryption engine 108 may determine that mobile security device is not present and/or is not in proximity to computing device 106
  • encryption / decryption engine 108 may check whether mobile security device 102 is paired or bonded to computing device 106 (via a Bluetooth pairing, for example). If not paired or bonded, encryption / decryption engine 108 may determine that mobile security device does not have a secure connection or is not present and/or is not in proximity to computing device 106.
  • encryption / decryption engine 108 may determine whether a signal parameter of communication link 128 meets a predetermined threshold. For example, if computing device 106 and mobile security device 102 are relatively far apart, the wireless signal strength of communication link 128 may be diminished indicating that user 104 is not within a predetermined proximity of computing device 102. If, for example, the signal strength falls below a particular threshold, encryption / decryption engine 108 may determine that mobile security device is not present and/or is not in proximity to computing device 106.
  • the thresholds can be further set by the user to establish a "safe distance" security level that ensures that access to the Secure and Private Notifications is only possible when the security device is within a specified distance of the phone and/or tablet.
  • the encryption / decryption engine 108 may periodically send communications to the mobile security device 102 to ensure that the mobile security device 102 has not been tampered with and is still being worn by the user and is in proximity of the computing device 106. Under these conditions, should the mobile security device 128 be removed or otherwise altered, it may return a code that informs the computing device 102 of said changes in its security state and thus the computing device 102 may determine that the mobile security device 128 has been compromised.
  • encryption / decryption engine 108 determines that mobile security device is not present, has been compromised, and/or is not in proximity to computing device 106, it may indicate that user 104 is not nearby or is otherwise not currently available to view the message on computing device 106. Thus, encryption / decryption engine may decline to decrypt message 122 until it determines that mobile security device 102 is present and/or is in proximity to computing device 106. In this case, if encryption / decryption engine does not immediately decrypt message 122, message 122 may not be immediately displayed and may be discarded or stored in a memory for later decryption when it is determined that mobile security device 102 is present and/or is in proximity to computing device 106.
  • FIG. 2 illustrates an example architecture for a computing device 200, which may be the same as or similar to mobile computing device 108 and/or mobile computing device 120.
  • Computing device 200 includes an antenna 202 and transceiver 204 for communicating wirelessly.
  • computing device 200 may have multiple antennas, transceivers, receivers, transmitters, etc. according to design preferences for
  • computing device has at least two antennas, one for communicating with a wireless network (e.g. a cellular network or wireless LAN) and another for communicating via a personal area network (e.g. a Bluetooth network).
  • a wireless network e.g. a cellular network or wireless LAN
  • a personal area network e.g. a Bluetooth network
  • Communication engine 206 may be a hardware or software communication stack for processing incoming and outgoing network communications. In an embodiment, communication engine 206 may determine whether computing device 200 is in
  • a mobile security device such as a smartphone
  • Computing device 200 may also have a processor 208 for executing software programs and application.
  • Processor 208 may be a general purpose processor, a custom processor, or any type of processor that can execute software.
  • the software programs and any data may be stored in memory 210 and may be read by (or written to by) processor 208.
  • Computing device 200 may also include an encryption / decryption engine 212, which maybe the same as or similar to encryption / decryption engine 108 and/or 120.
  • Encryption engine 212 may be a circuit or processor that can encrypt or decrypt messages received from communication engine 206.
  • encryption / decryption engine 212 may be a mobile app or other type of software application stored in memory 210 and executable by processor 208.
  • the encryption / decryption engine 212 maybe a separate secure element (e.g. a tamper-resistant platform or element such as a one chip secure microcontroller) that is connected via electrical signals with the communication engine 206.
  • encryption / decryption engine may access an encryption key stored in memory 210.
  • the encryption / decryption key may be hard coded into encryption / decryption engine 212, or may be hard coded in another storage area of computing device 200, such as a ROM, secure element, a hard wired circuit, a logic circuit that produces the key, etc.
  • encryption / decryption engine 212 may communicate with communication engine 206 to determine if computing device 200 is in communication with or in proximity to a paired mobile security device such as mobile security device 102, as described above. Encryption / decryption engine may also check the mobile security device to ensure that the mobile security device is the one associated with the user of computing device 200. It may check the mobile security device by checking a unique identifier associated with the mobile security device, by checking network pairing parameters, etc. If computing device 200 is in communication with the mobile security device, and the mobile security device is the one associated with the user/recipient of the message, then encryption / decryption engine 212 may decrypt the message so that it can be displayed to the user by computing device 200.
  • mobile security device 300 may be the same as or similar to mobile security device 102.
  • mobile security device 300 may comprise a watch having a watch display 302 and watch band 304 to be worn by a user.
  • mobile security device 300 may be a key fob, a coin or other small device that can be kept in a pocket, etc.
  • Various types of mobile security devices may be described in U.S. Patent Application No.
  • Mobile security device may also be a device that can be sewn into clothing such as a hat, shirt, pants, etc., or into an accessory such as a purse or briefcase.
  • Mobile security device 200 may include one or more indicators such as LEDs, LCDs, etc. that can indicate to the user when a message is received, when a message is encrypted or decrypted, when monetary funds are received, etc.
  • the secure message may be decrypted by and/or displayed by mobile security device 102. Additionally, the user may use mobile security device 102 to compose and send a secure message, a transfer of funds, a secure image, etc.
  • Mobile security device 300 includes an antenna 305 and transceiver 307 for communicating wirelessly over a personal area network.
  • mobile security device 300 may have multiple antennas, transceivers, receivers, transmitters, etc. according to design preferences for communicating across multiple networks.
  • mobile security device 300 has at least two antennas, one for communicating with a wireless network (e.g. a cellular network or wireless LAN) and another for communicating via a personal area network (e.g. a Bluetooth network).
  • a wireless network e.g. a cellular network or wireless LAN
  • a personal area network e.g. a Bluetooth network
  • Communication engine 306 may be a hardware or software communication stack for processing incoming and outgoing network communications. In an embodiment, communication engine 306 may determine or assist in determining whether mobile security device 300 is in communication with a computing device, such as computing device 106.
  • Mobile security device 300 may also have a processor 308 for executing software programs and application.
  • Processor 308 maybe a general purpose processor, a custom processor, or any type of processor that can execute software.
  • the software programs and any data may be stored in memory 310 which may be read by (or written to by) processor 308.
  • Mobile security device 300 may also include an encryption / decryption engine 212, which may be the same as or similar to encryption / decryption engine 108 and/or 120.
  • Encryption engine 312 may be a circuit or processor that can encrypt or decrypt messages received from communi cation engine 306. In another embodiment, encryption / decryption engine 312 may be a mobile app or other type of software application stored in memory 310 and executable by processor 308.
  • encryption / decryption engine may access an encryption key stored in memory 310, which may comprise a secure element.
  • the encryption / decryption key may be hard coded into encryption / decryption engine 312, or may be hard coded in another storage area of mobile security device 300, such as a ROM, a hard wired circuit, a logic circuit that produces the key, etc.
  • encryption / decryption engine 312 may communicate with communication engine 306 to determine if mobile security device 300 is in communication with or in proximity to a paired computing device such as computing device 106, as described above. Encryption / decryption engine may also check the computing device to ensure that the computing device is the one associated with the user of mobile security device 300. It may check the computing device by checking a unique identifier associated with the computing device, by checking network pairing parameters, a MAC address of the computing device, etc.
  • encryption / decryption engine 312 may decrypt the message so that it can be displayed to the user by mobile security device 300.
  • mobile security device 300 may indicate to the user that an encrypted message has been received, decrypted, and is ready for viewing by illuminating an LED, for example.
  • Mobile security device 300 may also indicate the type of message received, e.g. whether the message is a text message, an email, a transfer of funds, etc., by illuminating another LED, displaying an LED flashing pattern, etc.
  • encryption / decryption engine 212 may discard the message or store it in a memory for later decryption.
  • Mobile security device 400 may be the same as or similar to mobile security device 102.
  • Mobile security device 400 may include a Bluetooth® Low Energy Radio 402 System On an Integrated Circuit (SOIC) 404.
  • SOIC 404 may include a processor and memory 406 to manage a Button and Input Interface 408, Audio Driver 410, Motor Driver 412, Display Driver 414 and LED Driver 416.
  • SOIC 404 may receive stable power from a Charging and Power Conditioning Circuit 418 that also provides the current battery information to the chip via an analog IO.
  • the RF Matching Circuit 2 matches the digital radio's output to the Antenna 1.
  • Bluetooth® Low Energy Technology defines two Generic Attribute Profile (GATT) roles: A) GATT Client that receives data sent via the Attribute Protocol and that sends Attribute Protocol requests, commands, and confirmations. B) The GATT Server that stores the data transported over the Attribute Protocol and that accepts Attribute Protocol requests, commands and confirmations from the GATT client. The GATT server also responds to requests and sends asynchronous indications and notifications to specified events.
  • GATT Generic Attribute Profile
  • the GATT server is a device that sends information periodically (such as a sensor) and the GATT client is a mobile device that collects such information.
  • Mobile security device 102 and computing device 106 may leverage a so-called Connected Device Protocol, and may be referred to as so-called connected devices. This proprietary protocol may be designed to run atop of the Bluetooth® Low Energy technology GATT service.
  • the Connected Device Protocol may support a GATT service relationship and may define two distinct roles as follows: A) Connected Device Client: The Client may use the Connected Device Service on the Connected Device Server. An example of a client device may be computing device 106. B) Connected Device Server: The Server may be an instantiation of the Connected Device Service. An example of a server device may be mobile security device 102, a watch or other mobile phone accessory.
  • the Connected Device Protocol can include bidirectional interaction without disrupting the GATT Client and GATT Server relationship
  • the Connected Device Profile may enable experiences that would otherwise be limited by the other platforms (such as the iOS platform) or may require more complex role structures to be established.
  • the Connected Device Profile may enable the rapid implementation of new Connected Device use cases while leveraging the native radio available on the mobile phone platform together with a custom mobile application.
  • active application may take precedence over background applications.
  • an active photography application may interpret a Short Button Press (SBP) event from a Connected Module as a shutter release and a Long Button Press may trigger the video feature, while a background application may have a different interpretation of the same event(s).
  • SBP Short Button Press
  • a background application may have a different interpretation of the same event(s).
  • an active secure message application may interpret a button press on mobile security device 106 as an
  • secure messaging may be provided through an authentication protocol that comprises two or more unique elements to identify computing device 106 and/or mobile security device 102: a BDADDR (MAC address of the device), the user's unique identifier (established at the point the user authenticates him or herself to the app via an OAUTH or equivalent protocol).
  • a BDADDR MAC address of the device
  • OAUTH OAUTH or equivalent protocol
  • each device in system 100 may include a unique, authenticated serial number that is associated with each respective device (which can be used for
  • System 100 may provide a secure and private method for peer-to-peer
  • the system may provide a secure and private peer to peer channel of
  • authenticated devices are able to view the contents of any given message.
  • System 100 may offer temporary methods of sending images between two or more individuals.
  • the messages may persist for a user-determined duration (e.g. Is, 5s, etc.).
  • secure messages may be discarded immediately after viewing. Because the messages sent in system 100 are encrypted, any intermediate server on which the message is stored or through which the message passes may not be able to snoop the contents of the message.
  • System 100 may provide secure and temporary peer-to-peer messaging where the user is authenticated before viewing the message, and where the user may only view the message once before it is destroyed, and where the message is not visible unless the intended recipient is identified or authenticated.
  • Such a system can allow people to engage in secure and private conversations with the knowledge that their conversation was not being monitored or recorded. By adding the element of hardware security, there is a high level of certainty that only the person for whom the message was created will receive and view the message.
  • system 100 may be used to send secure authentication information for peer-to-peer monetary transfers between users.
  • the messages may enable one user to transfer funds in real-time to another user via the secure channel and reduce risk of interception.
  • Example 1 A process for adding a contact
  • a key pair for the contact is generated. Public keys may be sent to and stored in data store 114. A user may then select another user from local address book on computing device 1 16. Computing device 116 may send an invitation to computing device 106 and user 104 to engage in secure messaging through system 100. If user 104 is already subscribed to the secure messaging server, the system may invite the user 104 to use the service. Otherwise, the system may send an email invitation to install and setup use of the service, to generate a personal encryption / decryption key pair, etc. User 104 may then acknowledge the friend request. In an embodiment, if user 104 chooses not to
  • a message from user 118 to user 104 is generated on computing device 116.
  • Encryption / decryption engine retrieves the public key associated with user 104 from data store 1 14, and uses it to encrypt the message. Encryption / decryption engine may also sign the message with a private signature key of user 1 18. The message is then sent to or through network 112, where it may pass through one or more servers (not shown) to arrive at computing device 106.
  • Encryption / decryption engine 108 may then determine if mobile security device is communicating with and/or in proximity of computing device 106, as described above. If mobile security device is communicating with and/or in proximity of computing device 106, encryption / decryption engine 108 may decrypt the message using user 104's private decryption key, which may be stored in a memory or circuit of computing device 106. If mobile security device is not communicating with and/or in proximity of computing device 106 or has been tampered- with, encryption / decryption engine 108 may ask user 104 for a password or PIN prior to decrypting the message. If mobile security device is not communicating with and/or in proximity of computing device 106 and no password or PIN is provided, encryption / decryption engine 108 may discard the message or store it in a memory for later decryption.
  • the "screenshot" feature of the mobile device can be disabled so that the secure message cannot be copied via the screenshot function.
  • System 100 can facilitate private and secure communicate between a sender and an intended recipient without exposing the conversation to anybody else, and without the need for cumbersome methods of authentication. Furthermore, because system 100 may utilize proximity of the mobile security device to authorize decryption, and because end- to-end authentication is utilized, the likelihood that the message will be intercepted and viewed by someone other than the intended recipient is reduced.
  • System 100 may also utilize a step-wise authentication process, including, but not limited to: A) authenticating the phone (e.g. determining that the phone is registered to the intended recipient), B) authenticating the secure messaging application that is loaded on the phone, C) authenticating the user (OAUTH) who is signed-in to the app, D)
  • a computing devices 106, 116 support mobile applications and operating systems (e.g. Android, iOS, Windows ME) and may be used to communicate with other users that have phones supporting a similar and compatible applications and/or operating systems.
  • mobile applications and operating systems e.g. Android, iOS, Windows ME
  • mobile security device 102 may notify the user. This can reduce the chance of missing a notification and also of the message being viewed by someone who is not the intended recipient of the message.
  • the system may also be used without encryption (and thus only authentication).
  • a password option may be provided to enable the feature (e.g. via a gesture on the screen, or via a numeric password).
  • a biometric action can be used (e.g. the user swipes their finger across the biometric lock to enable the feature).
  • a security library such as the KeyChain API may be used so that system- wide keys are bound to hardware root of trust for the device. This provides a mechanism and/or memory location to create or store private keys that cannot be exported off the device, even in the event of a root or kernel compromise.
  • Private Messaging Service Data can be recorded upon initial launch, and each time the user changes the device configuration.
  • Private Messaging Service Data includes but is not limited to: Date/time the setting was changed, Phone's geo-location (if background location updates are enabled), Phone language setting,
  • the last known configuration is currently saved, with the time it was last changed. In other embodiments, additional configurations can be saved.
  • Events can be recorded during usage: App install / update, App launch / close (+ session length), Notification opened.
  • Methods for developers to add their own events from the application are also provided in an API. Events can be aggregated per hour, day and month and may be retrieved through an admin API for the Private Messaging service or viewed as graphs on the dashboard.
  • Direct notifications can also be sent and received, and the device can be tagged.
  • tags are user-defined preferences, state of the app, level of usage, special codes, etc. Tagging can be done on the device itself (e.g. through SDK methods) and can be used filter for notifications.
  • FIG. 5 is a login screen that allows a user to enter a username and password to access the application.
  • FIG. 6 is a welcome screen that allows a user to create an account for secure messaging.
  • FIG. 7 is screen that allows a user to add contacts from a favorites list, a contacts list, or a
  • FIG. 8 allows a user to choose a privacy level.
  • the user can choose password protection so that the user can access secure messages by entering a password, hardware protection so that the user can access secure messages by using a paired mobile security device 102 within a proximity of the application, hardware+button protection so that the user can access secure message by pressing a button on secure mobile device 102, or hardware+password security so that the user can access secure messages by providing a paired mobile security device 102 and a password.
  • FIG. 9 a map is displayed by the application, showing the location of other nearby users who can send and receive secure messages.
  • FIGs. 10-12 illustrate a sequence of secure messages, after decryption has occurred, sent and received by the application.
  • a notification 1102 that funds have been sent or received is displayed.
  • a map location is displayed.
  • FIG. 13 illustrates notification settings that a user can set. The user can turn notifications on or off for various types of secure messages such as calls, texts, social media, funds sent or received, etc.
  • Figure 14 is a communication diagram of a process for sending a secure message.
  • a user may sign in 1402 and register 1404 for the secure messaging service.
  • a key pair may be generated 1406 and the public key may be stored 1408 in a data store.
  • the user may select friends 1410 with whom to communicate using secure messaging from various contact lists.
  • the user may invite a friend 1412 to communicate via secure messaging.
  • An invitation to communication may be sent to the friend 1414.
  • the application may create a friend connection between the user and the friend 1418.
  • the application may request 1422 and receive 1424 the friend's public key.
  • the application may then encrypt 1426 and/or sign 1428 the message.
  • the message may then be sent 1430 to the recipient. If push messaging is enabled, the message is pushed to the recipient's computing device 1432.
  • the recipient's computing device may then unlock 1434, decrypt 1436, and verify 1438 the message and source of the message, which can then be displayed on the recipient's computing device.

Abstract

Un système d'envoi et de réception de messages cryptés comprend un dispositif de sécurité mobile et un dispositif informatique. Le dispositif informatique comprend une mémoire, une clé de chiffrement/déchiffrement stockée dans la mémoire, un port de communication pour envoyer et recevoir les messages sécurisés, un émetteur-récepteur sans fil pour communiquer sans fil avec le dispositif de sécurité mobile, et un moteur chiffrement/déchiffrement pour déterminer si l'émetteur-récepteur sans fil est en communication avec le dispositif de sécurité mobile et crypter ou déchiffrer les messages sécurisés si l'émetteur-récepteur sans fil est en communication avec le dispositif de sécurité mobile.
PCT/US2015/021976 2014-03-22 2015-03-23 Messagerie sécurisée utilisant un dispositif de sécurité mobile sans fil WO2015148365A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US201461969145P 2014-03-22 2014-03-22
US61/969,145 2014-03-22

Publications (1)

Publication Number Publication Date
WO2015148365A1 true WO2015148365A1 (fr) 2015-10-01

Family

ID=54196264

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2015/021976 WO2015148365A1 (fr) 2014-03-22 2015-03-23 Messagerie sécurisée utilisant un dispositif de sécurité mobile sans fil

Country Status (1)

Country Link
WO (1) WO2015148365A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9779557B2 (en) 2015-08-18 2017-10-03 Carfit Corp. Automotive activity monitor

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20050048936A (ko) * 2003-11-20 2005-05-25 주식회사 팬택 무선통신단말기에서의 근거리 무선통신 보호 방법
US20060153370A1 (en) * 2005-01-07 2006-07-13 Beeson Curtis L Generating public-private key pair based on user input data
US7284123B2 (en) * 2003-01-14 2007-10-16 Samsung Electroncis Co., Ltd. Secure communication system and method for integrated mobile communication terminals comprising a short-distance communication module
US20140068494A1 (en) * 2012-09-04 2014-03-06 Google Inc. Information navigation on electronic devices

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7284123B2 (en) * 2003-01-14 2007-10-16 Samsung Electroncis Co., Ltd. Secure communication system and method for integrated mobile communication terminals comprising a short-distance communication module
KR20050048936A (ko) * 2003-11-20 2005-05-25 주식회사 팬택 무선통신단말기에서의 근거리 무선통신 보호 방법
US20060153370A1 (en) * 2005-01-07 2006-07-13 Beeson Curtis L Generating public-private key pair based on user input data
US20140068494A1 (en) * 2012-09-04 2014-03-06 Google Inc. Information navigation on electronic devices

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9779557B2 (en) 2015-08-18 2017-10-03 Carfit Corp. Automotive activity monitor

Similar Documents

Publication Publication Date Title
US10237247B2 (en) User interface systems and methods for secure message oriented communications
US11265319B2 (en) Method and system for associating a unique device identifier with a potential security threat
US10341860B2 (en) Learned dual band WIFI network association
KR101911653B1 (ko) 모바일 디바이스들에 대한 네트워크 대역폭 공유
US11687920B2 (en) Facilitating a fund transfer between user accounts
KR102395799B1 (ko) 메신저 서비스를 제공하는 장치 및 방법
US8595810B1 (en) Method for automatically updating application access security
US8625796B1 (en) Method for facilitating authentication using proximity
US9578445B2 (en) Systems and methods to synchronize data to a mobile device based on a device usage context
CA2898609C (fr) Protocole cryptographique pour dispositifs portables
US20150172920A1 (en) System for proximity based encryption and decryption
EP2777212B1 (fr) Messagerie sécurisée
US20090095812A1 (en) System and method for managing multiple smart card sessions
US10154024B2 (en) Push notification activation
CN109075966B (zh) 通信安全系统和方法
WO2015148365A1 (fr) Messagerie sécurisée utilisant un dispositif de sécurité mobile sans fil
US20180262488A1 (en) Method and system for providing secure communication
GB2525472A (en) Method & system for enabling authenticated operation of a data processing device
US10181951B2 (en) Protected encryption key recovery
US20130337773A1 (en) Method and device for transmitting a verification request to an identification module
US10205599B2 (en) Methods and systems of increasing security quality of computing-device communications
CN107026817B (zh) 一种密码自动输入的系统
US11863538B2 (en) Methods and systems for generating a symmetric key for mobile device encryption
CN109104361B (zh) 即时通信方法、装置、电子设备及存储介质
CN103580866A (zh) 用于安全接入服务的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15768746

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15768746

Country of ref document: EP

Kind code of ref document: A1