End-to-end encryption for personal communication nodes
Systems, methods, software and apparatus enable end-to-end encryption of group communications by implementing a pairwise encryption process between a pair of end user devices that are members of a communication group. One end user device in the pairwise encryption process shares a group key with the paired end user device by encrypting the group key using a message key established using the pairwise encryption process. The group key is shared among group members using the pairwise process. When a transmitting member of the group communicates with members, the transmitting member generates a stream key, encrypts stream data using the stream key, encrypts the stream key with the group key, then transmits the encrypted stream key and encrypted stream data to group members. The group key can be updated through the pairwise encryption process. A new stream key can be generated for each transmission of streaming data such as voice communications.
1. A method comprising:
establishing a cryptographically secure communication group, including an initiator communication node and a plurality of communication nodes, for streaming audio communication, including:
establishing a one-to-one encrypted session between the initiator communication node and each of the plurality of communication nodes;
providing a group key from the initiator communication node to each of the plurality of communication nodes over respective one-to-one encrypted sessions;
generating a stream key at the initiator communication node;
distributing the stream key from the initiator communication node to the plurality of communication nodes via one-to-several fan-out communication, with the stream key encrypted with the group key; and
transmitting streaming data encrypted with the stream key from the initiator communication node to the plurality of communication nodes using one-to-several fan-out communication.
2. The method of claim 1 wherein the stream key comprises an ephemeral symmetric key.
3. The method of claim 1 further comprising:
after establishing the cryptographically secure communication group, receiving a second stream key at the initiator communication node from a selected node of the plurality of communication nodes;
decrypting the second stream key using the group key; and
receiving, at the initiator communication node from the selected node, streaming data encrypted with the second stream key.
4. The method of claim 1 further comprising:
establishing the cryptographically secure communication group further includes:
obtaining, at the initiator communication node, a public key for each of the plurality of communication nodes from a remote management server configured to provide communication services for communication nodes;
generating, at the initiator communication node, a message key for each of the plurality of communication nodes based on the respective public key;
encrypting the group key using the message keys; and
providing, from the initiator communication node to each of the plurality of communication nodes, the group key encrypted with the message key corresponding to the destination plurality of communication nodes.
5. The method of claim 4 further comprising:
establishing the cryptographically secure communication group further includes:
generating a secret ephemeral key and a public ephemeral key at the initiator communication node;
generating, at the initiator communication node, a chain key for each of the plurality of communication nodes based on the secret ephemeral key and respective public key;
generating the message keys based on the chain keys; and
providing, from the initiator communication node to each of the plurality of communication nodes, the public ephemeral key, enabling the plurality of communication nodes to calculate the message key to decrypt the group key.
6. The method of claim 5 further comprising:
the public key for each of the plurality of communication nodes includes a public identity key and a public signed pre-key;
generating the chain key for each of the plurality of communication nodes includes:
generating a root key based on the public identity key, the public signed pre-key, and the secret ephemeral key; and
generating the chain key based on the root key.
7. The method of claim 5 further comprising:
updating the chain key each time a new message key is needed, such that the message key and chain key are ephemeral.
8. An apparatus comprising:
an initiator communication node configured to establish a cryptographically secure communication group, including the initiator communication node and a plurality of communication nodes, for streaming audio communication, including:
establish a one-to-one encrypted session with each of the plurality of communication nodes;
provide a group key to each of the plurality of communication nodes over respective one-to-one encrypted sessions;
generate a stream key;
distribute the stream key to the plurality of communication nodes via one-to-several fan-out communication, with the stream key encrypted with the group key; and
transmit streaming data encrypted with the stream key to the plurality of communication nodes using one-to-several fan-out communication.
9. The apparatus of claim 8 wherein the stream key comprises an ephemeral symmetric key.
10. The apparatus of claim 8 comprising the initiator communication node further configured to:
after establishing the cryptographically secure communication group, receive a second stream key from a selected node of the plurality of communication nodes;
decrypt the second stream key using the group key; and
receive streaming data encrypted with the second stream key from the selected node.
11. The apparatus of claim 8 further comprising:
the initiator communication node configured to establish the cryptographically secure communication group further including:
obtain a public key for each of the plurality of communication nodes from a remote management server configured to provide communication services for communication nodes;
generate a message key for each of the plurality of communication nodes based on the respective public key;
encrypt the group key using the message keys; and
provide, to each of the plurality of communication nodes, the group key encrypted with the message key corresponding to the destination plurality of communication nodes.
12. The apparatus of claim 11 further comprising:
the initiator communication node configured to establish the cryptographically secure communication group further including:
generate a secret ephemeral key and a public ephemeral key;
generate a chain key for each of the plurality of communication nodes based on the secret ephemeral key and respective public key;
generate the message keys based on the chain keys; and
provide, to each of the plurality of communication nodes, the public ephemeral key, enabling the plurality of communication nodes to calculate the message key to decrypt the group key.
13. The apparatus of claim 12 further comprising:
the public key for each of the plurality of communication nodes includes a public identity key and a public signed pre-key;
the initiator communication node configured to generate the chain key for each of the plurality of communication nodes, further including:
generate a root key based on the public identity key, the public signed pre-key, and the secret ephemeral key; and
generate the chain key based on the root key.
14. The apparatus of claim 12 further configured to:
update the chain key each time a new message key is needed, such that the message key and chain key are ephemeral.
15. A memory device storing instructions that, when executed, cause a processor to perform a method comprising:
establishing a cryptographically secure communication group, including an initiator communication node and a plurality of communication nodes, for streaming audio communication, including:
establishing a one-to-one encrypted session between the initiator communication node and each of the plurality of communication nodes;
providing a group key from the initiator communication node to each of the plurality of communication nodes over respective one-to-one encrypted sessions;
generating a stream key at the initiator communication node;
distributing the stream key from the initiator communication node to the plurality of communication nodes via one-to-several fan-out communication, with the stream key encrypted with the group key; and
transmitting streaming data encrypted with the stream key from the initiator communication node to the plurality of communication nodes using one-to-several fan-out communication.
16. The memory device of claim 15 wherein the stream key comprises an ephemeral symmetric key.
17. The memory device of claim 16 storing instructions that, when executed, cause the processor to perform the method further comprising:
after establishing the cryptographically secure communication group, receiving a second stream key at the initiator communication node from a selected node of the plurality of communication nodes;
decrypting the second stream key using the group key; and
receiving, at the initiator communication node from the selected node, streaming data encrypted with the second stream key.
18. The memory device of claim 17 storing instructions that, when executed, cause the processor to perform the method further comprising:
establishing the cryptographically secure communication group further includes:
obtaining, at the initiator communication node, a public key for each of the plurality of communication nodes from a remote management server configured to provide communication services for communication nodes;
generating, at the initiator communication node, a message key for each of the plurality of communication nodes based on the respective public key;
encrypting the group key using the message keys; and
providing, from the initiator communication node to each of the plurality of communication nodes, the group key encrypted with the message key corresponding to the destination plurality of communication nodes.
19. The memory device of claim 18 storing instructions that, when executed, cause the processor to perform the method further comprising:
establishing the cryptographically secure communication group further includes:
generating a secret ephemeral key and a public ephemeral key at the initiator communication node;
generating, at the initiator communication node, a chain key for each of the plurality of communication nodes based on the secret ephemeral key and respective public key;
generating the message keys based on the chain keys; and
providing, from the initiator communication node to each of the plurality of communication nodes, the public ephemeral key, enabling the plurality of communication nodes to calculate the message key to decrypt the group key.
20. The memory device of claim 19 storing instructions that, when executed, cause the processor to perform the method further comprising:
the public key for each of the plurality of communication nodes includes a public identity key and a public signed pre-key;
generating the chain key for each of the plurality of communication nodes includes:
generating a root key based on the public identity key, the public signed pre-key, and the secret ephemeral key;
generating the chain key based on the root key; and
updating the chain key each time a new message key is needed, such that the message key and chain key are ephemeral.