Federated messaging

A system for federated messaging, the system comprising:

• at least one interface configured to:
• receive a first communication from a first device belonging to a first secure communication network for a second device belonging to a second secure communication network, wherein the first communication comprises encrypted routing data and an encrypted payload;
• and
• receive user information from a federated database;
• a processor configured to:
• decrypt the encrypted routing data to obtain a first device identifier of the first device and a second device identifier of the second device;
• obtain, from the user information in the federated database, a first security group identifier associated with a first group to which the first device belongs and a second security group identifier associated with a second group, different from the first group, to which the second device belongs;
• determine whether a first set of permissions associated with the first security group identifier permit the first device to communicate with the second secure communication network and a second set of permissions associated with the second security group identifier permit the second device to communicate with the first secure communication network;
• provide the first communication to the second device on the second secure communication network based on the determination;
• and
• discard the first communication as a result of determining that at least one of the first set of permissions do not permit the first device to communicate with the second secure communication network and the second set of permissions do not permit the second device to communicate with the first secure communication network;
• and
• a memory coupled to the processor and configured to store the first set of permissions and second set of permissions and to provide the processor with instructions for determining whether the first device and the second device are permitted to communicate.

A non-transitory computer-readable medium comprising instructions that, as a result of being executed by at least one processor, perform the steps of:

• receiving a first communication from a first device belonging to a first secure communication network for a second device belonging to a second secure communication network, wherein the first communication comprises encrypted routing data and an encrypted payload;
• decrypting the encrypted routing data to obtain a first device identifier of the first device and a second device identifier of the second device;
• obtaining, from a federated database, a first security group identifier associated with a first group to which the first device belongs and a second security group identifier associated with a second group, different from the first group, to which the second device belongs;
• determining whether a first set of permissions associated with the first security group identifier permit the first device to communicate with the second secure communication network and a second set of permissions associated with the second security group identifier permit the second device to communicate with the first secure communication network;
• providing the first communication to the second device on the second secure communication network based on the determination;
• and
• discarding the first communication as a result of determining that at least one of the first set of permissions do not permit the first device to communicate with the second secure communication network and the second set of permissions do not permit the second device to communicate with the first secure communication network.