Method for implementing transport layer safety of SIP network based on sharing cryptographic key

Abstract

The invention discloses a realization method for transport layer security in a session initiation protocol (SIP) network based on a shared key. The method comprises the following steps: (a) a shared main key and a derivation algorithm are stored at a SIP terminal and in an authentication center (AuC); (b) the SIP terminal is interacted with a network side device based on a SIP security negotiation standard frame, the support for the security protocol of the transport layer is increased, and the SIP terminal and the SIP network side respectively generate the required encryption and integrity protection keys, so as to realize the transport layer security of the SIP network. By adopting the method, the TCP negotiation in the SIP network can be realized, the method not only can be suitable for the connection transport of the SIP such as TCP, UDP, etc., but also can ensure the security of information transmission in the SIP network; the method not only can be suitable for soft switching and IMS network, but also can be suitable for other networks which adopt the SIP as the control protocol, for example, the SIP-based VoIP network.

Description

technical field [0001] The present invention relates to a network using the Session Initiation Protocol (SIP), hereinafter referred to as the SIP network, in particular to a method for realizing security of the transmission layer in the SIP network. Background technique [0002] Session Initiation Protocol (SIP) is a kind of multimedia communication control protocol, which has been widely used in softswitches, IP Multimedia Subsystem (IMS) and other networks. Since SIP runs on the open IP protocol, its security has always been the focus of attention. At present, the security mechanism that has been standardized on the user access side is IPSec (IP Security) access proposed by 3GPP, and the SIP security solution is TLS (Transport Layer Security) recommended by IETF (Internet Engineering Task Force), but it has not been adopted. Adopted by 3GPP. Both solutions currently have pros and cons. [0003] The problem of IPSec access is: when accessing in the existing network, NA(P...

AI Technical Summary

Problems solved by technology

[0003] The problem with IPSec access is that NA(P)T (Network Address (Port) Translation) is ubiquitous when accessing in an existing network. When NA(P) works, it is necessary to transfer the IP address from the internal network address to the external network. For address conversion, port mapping is required in some scenarios, so the NA(P)T device will change the source IP of the message and the port number of the transport layer in the IP message, both of which are the objects of IPSec integrity protection , when using IPSec integrity protection, changing the two will cause the receiving end to think that the message has been tampered with when performing integrity verification, resulting in verification failure and discarding the message; if encryption is used, NA(P)T cannot read If the transport layer port information is obtained, port mapping cannot be performed, resulting in communication failure.

However, the current TLS access default key negotiation uses a certificate mechanism, which is very difficult to implement in a network that supports user roaming / nomadic like IMS, because the secure connection is established between the terminal and the access server. However, the access server cannot independently verify the legitimacy of the user certificate, making this method difficult to implement, and the digital certificate authentication method has not been widely used in the SIP network.

Images