Research And Implementation Of Security IM System Based On XMPP And OTR Based On IOS Platform

With the rapid development of the Internet and mobile Internet, PC-based and mobile-based Instant Messaging (IM) client softwares has become extremely one of important communication tools in our life and work. At present, domestic and international popular IM software including GTalk, MSN, QQ, micro-channel, Skype, Line and so on. In order to protect their own commercial interests, each of companies uses a closed IM protocol, results in different of IM softwares could not communicate with each other so that bringing in convenience to users. With the rapid growth in the number of users of IM, the security problem of IM becomes more outstanding and important. Messages transported over the Internet may be eavesdropped, listened or tampered during transmission, which brings huge losses to users. Thus, IM currently faces two main challenges. One is the interoperability between different Instant Messaging softwares based on different protocols, and another one is the serious security issue.For the problem of the interoperability between different IM softwares based on different protocols, this thesis studies and analyzes XMPP protocol, including its architecture, communication mechanism and security mechanisms, and its features such as open source, scalability, security, etc.For the security problem of IM, this thesis proposes the security features of IM system. This thesis argues that, in addition to ensuring confidentiality, integrity and authenticity for IM system, it also should provide perfect forward security (PFS) and repudiability. PFS means that it is possible to protect the security of the history message for users, even if the user accidentally leaked secret key. Repudiability means that the author of the messages can deny that he is the author of the messages and no one can prove that he is indded the author of the message. IM encryption protocol is the key point for ensuring the security of IM, and this thesis researches and analyzes "off-the-record messaging" security protocol using for IM, referred to as "OTR". The protocol is more suitable than PGP and S/MIME for casual conversation and meets the security features of IM systems. OTR encrypts messages by using AES symmetric encryption algorithm and short-term secret keys, which achieves PFS, while ensuring the confidentiality of messages; OTR uses a hybrid approach to authentication, using both digital signatures and MAC, to achieve repudiability, while ensuring integrity and reliability for IM. SecurelM does not provide authentication although providing PFS. PGP and S/MIME both provide encryption and authentication, but do not provide PFS because the encryption keys are typically long-lived, and do not provide repudiability because the digital signatures are non-repudiable.This thesis introduces the iOS system and its programming techniques, designs and programms secure IM softwarebased on iOS by using Objective-C. OTR security protocol is used as the upper layer protocols of XMPP, which achieves PFS and repudiability, while ensuring the confidentiality, reliability and authenticity for messages. After testing the system, it has been proved that system has stability and achieves encryption, and the encryption process does not affect system performance.