Federated messaging
The present disclosure describes a method, system, and non-transitory computer readable medium that includes instructions that permit users of different secure communication networks to exchange secure communications. A secure communication platform includes a user database that allows users from different secure communication networks to access keys for recipients outside of their network. Additionally, the secure communication platform provides a high degree of trust regarding the sender's identity, allowing the receiving network to trust the sender.
1. A method for federated messaging, the method comprising:
receiving, by a first server from a first device belonging to a first secure communication network, a first communication for a second device belonging to a second secure communication network, wherein the first communication comprises encrypted routing data and an encrypted payload;
decrypting, by the first server, the encrypted routing data to obtain a first security group identifier associated with a first group to which the first device belongs and a second security group identifier associated with a second group, that is different from the first group, to which the second device belongs;
determining, by the first server, whether a first set of permissions associated with the first security group identifier permit the first device to communicate with the second secure communication network; and
determining, by the first server, whether a second set of permissions associated with the second security group identifier permit the second device to communicate with the first secure communication network;
providing, by the first server, the first communication to the second device on the second secure communication network when the first device and the second device are permitted to communicate;
receiving, by the first server from the first device, a second communication for a third device belonging to a third secure communication network, wherein the second communication comprises the first security group identifier and a third security group identifier associated with a third group, that is different from the first group, to which the third device belongs;
determining whether the first set of permissions associated with the first security group identifier permit the first device to communicate with the third secure communication network;
determining, by the first server, whether a third set of permissions associated with the third security group identifier permit the third device to communicate with the first secure communication network; and
discarding, by the first server, the first communication when at least one of the first set of permissions do not permit the first device to communicate with the third secure communication network or the third set of permissions do not permit the third device to communicate with the first secure communication network.
2. The method of claim 1 , wherein decrypting the encrypted routing data comprises using a first key.
3. The method of claim 2 , wherein the first key is a private key associated with the first server.
4. The method of claim 1 , comprising:
receiving, by the first server from the first device, a third communication for a fourth device belonging to a fourth secure communication network, wherein the third communication comprises the first security group identifier and a fourth security group identifier associated with a fourth group, that is different from the first group, to which the fourth device belongs;
determining, by the first server, whether the first secure communication network and the fourth secure communication network are the same network; and
providing, by the first server, the third communication to the fourth device when the first secure communication network is the same network as the fourth secure communication network.
5. A non-transitory computer-readable medium comprising instructions that, when executed by at least one processor, perform the steps of:
receiving a first communication from a first device belonging to a first secure communication network for a second device belonging to a second secure communication network, wherein the first communication comprises encrypted routing data and an encrypted payload;
decrypting the encrypted routing data to obtain a first security group identifier associated with a first group to which the first device belongs and a second security group identifier associated with a second group, that is different from the first group, to which the second device belongs;
determining whether a first set of permissions associated with the first security group identifier permit the first device to communicate with the second secure communication network; and
determining whether a second set of permissions associated with the second security group identifier permit the second device to communicate with the first secure communication network;
providing the first communication to the second device on the second secure communication network when the first device and the second device are permitted to communicate;
receiving, from the first device, a second communication for a third device belonging to a third secure communication network, wherein the second communication comprises the first security group identifier and a third security group identifier associated with a third group, that is different from the first group, to which the third device belongs;
determining whether the first set of permissions associated with the first security group identifier permit the first device to communicate with the third secure communication network;
determining whether a third set of permissions associated with the third security group identifier permit the third device to communicate with the first secure communication network; and
discarding the second communication when at least one of the first set of permissions do not permit the first device to communicate with the third secure communication network or the third set of permissions do not permit the third device to communicate with the first secure communication network.
6. The non-transitory computer-readable medium of claim 5 , comprising instructions that, when executed by the at least one processor, perform the steps of:
decrypting the encrypted routing data using a first key.
7. The non-transitory computer-readable medium of claim 6 , wherein the first key is a private key associated with a first server.
8. The non-transitory computer-readable medium of claim 5 , comprising instructions that, when executed by the at least one processor, perform the steps of:
receiving, from the first device, a third communication for a fourth device belonging to a fourth secure communication network, wherein the third communication comprises the first security group identifier and a fourth security group identifier associated with a fourth group, that is different from the first group, to which the fourth device belongs;
determining whether the first secure communication network and the fourth secure communication network are the same network; and
providing the third communication to the fourth device when the first secure communication network is the same network as the fourth secure communication network.
9. The method of claim 1 , wherein the first secure communication network is associated with a first corporation and the second secure communication network is associated with a second corporation different than the first corporation.
10. The method of claim 1 , further comprising storing, by the first server and in a single database, profile information associated with users in each of the first secure communication network, the second secure communication network, and the third secure communication network.
11. The non-transitory computer-readable medium of claim 5 , wherein the first secure communication network is associated with a first corporation and the second secure communication network is associated with a second corporation different than the first corporation.
12. The non-transitory computer-readable medium of claim 5 , comprising instructions that, when executed by the at least one processor, perform the steps of storing, in a single database, profile information associated with users in each of the first secure communication network, the second secure communication network, and the third secure communication network.
13. A server comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the server to:
receive, from a first device belonging to a first secure communication network, a first communication for a second device belonging to a second secure communication network, wherein the first communication comprises encrypted routing data and an encrypted payload;
decrypt the encrypted routing data to obtain a first security group identifier associated with a first group to which the first device belongs and a second security group identifier associated with a second group, that is different from the first group, to which the second device belongs;
determine whether a first set of permissions associated with the first security group identifier permit the first device to communicate with the second secure communication network; and
determine whether a second set of permissions associated with the second security group identifier permit the second device to communicate with the first secure communication network;
provide the first communication to the second device on the second secure communication network when the first device and the second device are permitted to communicate;
receive, from the first device, a second communication for a third device belonging to a third secure communication network, wherein the second communication comprises the first security group identifier and a third security group identifier associated with a third group, that is different from the first group, to which the third device belongs;
determine whether the first set of permissions associated with the first security group identifier permit the first device to communicate with the third secure communication network;
determine whether a third set of permissions associated with the third security group identifier permit the third device to communicate with the first secure communication network; and
discard the first communication when at least one of the first set of permissions do not permit the first device to communicate with the third secure communication network or the third set of permissions do not permit the third device to communicate with the first secure communication network.
14. The server of claim 13 , wherein decrypting the encrypted routing data comprises using a first key.
15. The server of claim 14 , wherein the first key is a private key associated with the server.
16. The server of claim 13 , wherein the instructions, when executed by the one or more processors, cause the server to:
receive, from the first device, a third communication for a fourth device belonging to a fourth secure communication network, wherein the third communication comprises the first security group identifier and a fourth security group identifier associated with a fourth group, that is different from the first group, to which the fourth device belongs;
determine whether the first secure communication network and the fourth secure communication network are the same network; and
provide the third communication to the fourth device when the first secure communication network is the same network as the fourth secure communication network.
17. The server of claim 13 , wherein the first secure communication network is associated with a first corporation and the second secure communication network is associated with a second corporation different than the first corporation.
18. The server of claim 13 , wherein the instructions, when executed by the one or more processors, cause the server to:
store, in a single database, profile information associated with users in each of the first secure communication network, the second secure communication network, and the third secure communication network.