Granted Patent B1

US 11,005,829 · App. 15/784,735 · Granted May 11, 2021

Inventors: Keith Johnson (Cambridge, MA); Julio Viera (Brooklyn, NY); Joao Santos (Boston, MA)

Assignee: Fuze, Inc.

H04L63/062H04L9/0861H04L9/14H04L9/30H04L9/3247H04L63/0428

Abstract

Claims (62)

1. A computer-implemented method for providing end-to-end encryption of data between devices, comprising:

receiving, from a messaging application of a sending device, an encryption request comprising unencrypted data and information about an allowed audience comprising at least one of an identity of one or more entities or an identity of a group of entities that are allowed to access the unencrypted data, wherein each of the one or more entities or the group of entities that are allowed to access the unencrypted data is an application;

authenticating a sender of the encryption request;

in response to successfully authenticating the sender of the encryption request, generating an encryption key based on a first data key of a plurality of data keys received, from a key management entity in response to the encryption request, wherein the key management entity is a third party entity, separate and independent of an entity that generates the encryption key;

encrypting the unencrypted data into encrypted data using the encryption key;

encoding the information about the allowed audience into an encoded header of the encrypted data, including an identity of a recipient of the encrypted data;

receiving, from a messaging application of a receiving device, a decryption request comprising the encrypted data transmitted from the sending device to the receiving device;

authenticating a receiver of the decryption request;

in response to receiving the decryption request from the receiving device and successfully authenticating the receiver of the decryption request, decoding the information about the allowed audience encoded in the encrypted data, including the identity of the recipient of the encrypted data;

confirming that the receiver is allowed access to the unencrypted data based on the decoded information about the allowed audience, including the identity of the recipient of the encrypted data;

in response to confirming that the receiver is allowed access to the unencrypted data, re-generating the encryption key when the decoded information about the allowed audience indicates that an entity requesting decryption of the encrypted data through the receiving device is allowed access to the unencrypted data; and

decrypting the encrypted data into unencrypted data using the re-generated encryption key.

2. The computer-implemented method of claim 1 , wherein the decoded information about the allowed audience in the encrypted data comprises an identity of a group of entities, the method further comprising:

in response to determining that the entity requesting access to the encrypted data is a member of the identified group of entities; and

if the decoded information about the allowed audience indicates that an entity requesting decryption of the encrypted data through the receiving device is allowed access to the unencrypted data, re-generating the encryption key.

3. The computer-implemented method of claim 1 , wherein the entity requesting encryption of the unencrypted data is a user or an application.

4. The computer-implemented method of claim 1 , wherein each entity of the group has an owner role or a publisher role and the entity requesting access to the encrypted data through the receiving device allowed access to the unencrypted data is a member of the group and the entity has a publisher role.

5. The computer-implemented method of claim 1 , further comprising:

signing the unencrypted data using a signature of an entity that is requesting encryption of the unencrypted data by generating the signature based on generating a private key for the entity that is requesting encryption; and

verifying the unencrypted data that is decrypted from the encrypted data by generating a public key for the entity that is requesting decryption of the encrypted data and verifying the signature using the public key.

6. The computer-implemented method of claim 1 , wherein the encryption key includes an expiration date indicating whether the encryption key is valid, the method further comprising:

encrypting the unencrypted data into encrypted data if the expiration data indicates that the encryption key is valid.

7. A system for secure end-to-end encryption between devices, comprising:

one or more processors;

a computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium including instructions that, when executed by the one or more processors, cause the one or more processors to:

receive, from a messaging application of a sending device, an encryption request comprising unencrypted data and information about an allowed audience comprising at least one of an identity of one or more entities or an identity of a group of entities that are allowed to access the unencrypted data, wherein each of the one or more entities or the group of entities that are allowed to access the unencrypted data is an application;

authenticate a sender of the encryption request;

in response to successfully authenticating the sender of the encryption request, generate, an encryption key based on a first data key of a plurality of data keys received from a key management entity, wherein the key management entity is a third party entity that is separate and independent of the sending device and an entity that generates the encryption key;

encrypt the unencrypted data into encrypted data using the encryption key;

encode the information about the allowed audience into an encoded header of the encrypted data, including an identity of a recipient of the encrypted data;

receive, from a messaging application of a receiving device, a decryption request comprising the encrypted data transmitted from the sending device to the receiving device;

authenticate a receiver of the decryption request;

in response to receiving the decryption request from the receiving device and successfully authenticating the receiver of the decryption request, decode the information about the allowed audience encoded in the encrypted data, including the identity of the recipient of the encrypted data;

confirm that the receiver is allowed access to the unencrypted data based on the decoded information about the allowed audience, including the identity of the recipient of the encrypted data;

in response to confirming that the receiver is allowed access to the unencrypted data, re-generate the encryption key when the decoded information about the allowed audience indicates that an entity requesting decryption of the encrypted data through the receiving device is allowed access to the unencrypted data; and

decrypt the encrypted data into unencrypted data using the re-generated encryption key.

8. The system of claim 7 , wherein the decoded information about the allowed audience in the encrypted data comprises an identity of a group of entities and the instructions further cause the processor to:

re-generate the encryption key in response to determining that the entity requesting access to the encrypted data is a member of the identified group of entities and if the decoded information about the allowed audience indicates that an entity requesting decryption of the encrypted data through the receiving device is allowed access to the unencrypted data.

9. The system of claim 7 , wherein the entity requesting encryption of the unencrypted data is a user or an application.

10. The system of claim 7 , wherein each entity of the group has an owner role or a publisher role, the entity requesting access to the encrypted data through the receiving device allowed access to the unencrypted data is a member of the group and the entity has a publisher role.

11. The system of claim 7 , wherein the instructions further cause the one or more processors to:

sign the unencrypted data using a signature of an entity that is requesting encryption of the unencrypted data, by generating the signature based on generating a private key for the entity that is requesting encryption; and

verify the unencrypted data that is decrypted from the encrypted data by generating a public key for the entity that is requesting decryption of the encrypted data and verifying the signature using the public key.

12. The system of claim 7 , wherein the encryption key includes an expiration date indicating whether the encryption key is valid and the instructions further cause the one or more processors to encrypt the unencrypted data into encrypted data if the expiration data indicates that the encryption key is valid.

13. A non-transitory machine-readable storage medium comprising machine-readable instructions that, when executed by a processor, cause the processor to perform operations, the operations comprising:

receiving, from a messaging application of a sending device, an encryption request comprising unencrypted data and information about an allowed audience comprising at least one of an identity of one or more entities or an identity of a group of entities that are allowed to access the unencrypted data, wherein each of the one or more entities or the group of entities that are allowed to access the unencrypted data is an application;

authenticating a sender of the encryption request;

in response to successfully authenticating the sender of the encryption request, generating, an encryption key based on a first data key of a plurality of data keys received, from a key management entity, wherein the key management entity is a third party entity that is separate and independent of an entity that generates the encryption key;

encrypting the unencrypted data into encrypted data using the encryption key;

encoding the information about the allowed audience into an encoded header of the encrypted data, including an identity of a recipient of the encrypted data;

receiving, from a messaging application of a receiving device, a decryption request comprising the encrypted data transmitted from the sending device to the receiving device;

authenticating a receiver of the decryption request;

in response to receiving the decryption request from the receiving device and successfully authenticating the receiver of the decryption request, decoding the information about the allowed audience encoded in the encrypted data, including the identity of the recipient of the encrypted data;

confirming that the receiver is allowed access to the unencrypted data based on the decoded information about the allowed audience, including the identity of the recipient of the encrypted data;

in response to confirming that the receiver is allowed access to the unencrypted data, re-generating the encryption key, when the decoded information about the allowed audience indicates that an entity requesting decryption of the encrypted data through the receiving device is allowed access to the unencrypted data; and

decrypting the encrypted data into unencrypted data using the re-generated encryption key.

14. The non-transitory machine-readable storage medium of claim 13 , wherein the decoded information about the allowed audience in the encrypted data comprises an identity of a group of entities and the operations further comprise:

re-generating the encryption key in response to determining that the entity requesting access to the encrypted data is a member of the identified group of entities and if the decoded information about the allowed audience indicates that an entity requesting decryption of the encrypted data through the receiving device is allowed access to the unencrypted data.

15. The non-transitory machine-readable storage medium of claim 13 , wherein the entity requesting encryption of the unencrypted data is a user or an application.

16. The non-transitory machine-readable storage medium of claim 13 , wherein each entity of the group has an owner role or a publisher role, the entity requesting access to the encrypted data through the receiving device allowed access to the unencrypted data is a member of the group and the entity has a publisher role.

17. The non-transitory machine-readable storage medium of claim 13 , wherein the encryption key includes an expiration date indicating whether the encryption key is valid, the operations further comprising:

encrypting the unencrypted data into encrypted data if the expiration data indicates that the encryption key is valid.

Assignments (8)

Cited By (2)

US 12,199,959 US 12,621,278