SIP (Session Initiation Protocol)-based dual-authentication security protection method and system

Abstract

The invention discloses a dual-authentication security protection method and system based on an SIP (Session Initiation Protocol), and relates to the technical field of communication. The method comprises the following steps of: before actual communication occurs, generating an account authentication scheme based on bidirectional authentication of an SIP (Session Initiation Protocol), and generating a message credibility authentication scheme based on message credibility of the SIP; the client and the server are authenticated by adopting the account authentication scheme; a message credibility authentication scheme is adopted to manage keys between entities, and SIP messages exchanged between different entities are protected; and the client and the server carry out interactive communication. The present invention provides an identity mutual authentication service and exchanges session keys between communication entities. The potential security threat of the SIP protocol is effectively reduced, the availability and reliability of the system are optimized, and a firmer security guarantee is provided for multimedia communication in the power industry.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a dual authentication security protection method and system based on the SIP protocol. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] At present, the IMS technology system and soft switch technology system are commonly used in the dispatching and switching systems. Both technology systems use the Session Initiation Protocol (SIP) to realize interactive communication between users. However, in recent years, network attacks have become more frequent and the means of attack have become more diverse. The situation of network security protection has become more severe. Considering the importance of power grid administration and dispatching and switching systems, the security mechanism of SIP is relatively weak, and there are security risks such as insufficient identity authentication, brute force attacks and message forgery. It is urgent to carry out research on the security reinforcement method of SIP protocol adapted to the power industry.

[0004] The SIP protocol is designed to be simple, flexible and highly scalable, but lacks effective security mechanisms. In the power grid, the SIP protocol is vulnerable to a variety of security threats, including: registration hijacking attacks, where attackers hijack user registration information to gain control of SIP devices; server impersonation attacks, where attackers disguise themselves as legitimate servers to trick users into sending sensitive information; message tampering attacks, where attackers tamper with the content of messages in transit, resulting in communication failures or information leaks; and session change attacks, where attackers change user session information, affecting the integrity and reliability of communications.

[0005] Therefore, how to ensure the security of the SIP protocol in interactive communications and meet the dispatching and command requirements of the IMS technology application in the power dispatching exchange network has become a technical problem that needs to be urgently solved in the existing technology. Summary of the invention

[0006] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a dual authentication security protection method and system based on the SIP protocol, which provides identity mutual authentication services and exchanges session keys between communication entities through the user authentication SIP (UA-SIP) solution and the message security SIP (MS-SIP) solution. It effectively reduces the potential security threats of the SIP protocol, optimizes the availability and reliability of the system, and provides a more solid security guarantee for multimedia communications in the power industry.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0008] The first aspect of the present invention provides a dual authentication security protection method based on the SIP protocol, comprising the following steps:

[0009] Before actual communication occurs, an account authentication scheme is generated based on the two-way authentication of the SIP protocol, and a message trust authentication scheme is generated based on the message trust of the SIP protocol;

[0010] Use account authentication scheme to authenticate the client and server;

[0011] A message trust authentication scheme is used to manage keys between entities and protect SIP messages exchanged between different entities, including clients, servers, user agents, user agent servers, SIP servers, and registrars;

[0012] The client and server communicate interactively.

[0013] Furthermore, the account authentication scheme includes four stages:

[0014] During the setup phase, the user is registered as a legitimate user of the remote server;

[0015] During the login phase, the client logs in to the proxy server through an insecure channel to obtain services;

[0016] During the authentication phase, the proxy server and the client authenticate each other based on pre-shared parameters;

[0017] During the registration phase, the client registers the URI address with the proxy SIP server.

[0018] Furthermore, the specific steps of registering the user as a legitimate user of the remote server include:

[0019] Client user C freely chooses his identity ID C and password PW C ;

[0020] The client then selects a random password Seed C , and calculate the check value v;

[0021] The client C establishes a secure connection with the server S and sends v and ID C and Seed C To the proxy server S;

[0022] After receiving the message, the proxy server S calculates the password verification value and uses ID C PW as an index v and Seed C Stored in its database.

[0023] Furthermore, the specific steps for the client to log in to the proxy server through an insecure channel to obtain services include:

[0024] Client C generates a random number and generates a temporary public key based on the random number generated by client C;

[0025] Client C sends a request message with a temporary public key to proxy server S;

[0026] When the proxy server S receives the request message, it uses ID C Retrieve Seed C and PW v ;

[0027] The proxy server S generates a random number and uses the random number generated by the proxy server S to calculate the temporary public key and private key;

[0028] The proxy server S sends a message with a temporary public key and private key to the client C.

[0029] Furthermore, based on the pre-shared parameters, the steps of mutual identity authentication between the proxy server and the client include:

[0030] After receiving the message with temporary public key and private key sent by proxy server S to client C during the login phase, the client starts to check the temporary public key and private key;

[0031] After the check is passed, client C generates a random number as a unique identifier for this interaction and encrypts the session;

[0032] Client C generates a challenge message and sends it to proxy server S;

[0033] After receiving the challenge information, the proxy server S decrypts the challenge information;

[0034] After successful decryption, the proxy server S constructs the server authentication code and sends the authentication message to the client C;

[0035] After receiving the authentication message, client C performs decryption and verification. If the decryption and verification are successful, the authentication is completed.

[0036] Furthermore, the specific steps for the client to register the URI address with the proxy SIP server include:

[0037] At the end of the authentication phase, the client generates an S-Rister message and sends it to the proxy server S;

[0038] After receiving the S-Register message, the proxy server S decrypts the message to obtain the Register information and checks it;

[0039] The SIP server processes the Register message to register the URI of client C;

[0040] The proxy server S sends an S-OK message to the client;

[0041] When client C receives the S-OK message from proxy server S, client C decrypts the message using the session key and checks it. If it is correct, client C will accept the authentication ticket in the S-OK message.

[0042] Furthermore, the message trust authentication scheme includes three stages:

[0043] In the call initialization phase, user agents that have registered on the proxy server attempt to call each other in an encrypted environment;

[0044] During the session phase, the user agent that successfully attempts to call conducts the SIP session in an encrypted process;

[0045] During the session termination phase, one user agent ends the SIP session by sending an S-BYE message, and the other user agent responds with an S-OK message.

[0046] The second aspect of the present invention provides a dual authentication security protection system based on the SIP protocol, comprising:

[0047] The scheme construction module is configured to generate an account authentication scheme based on the two-way authentication of the SIP protocol and generate a message trust authentication scheme based on the message trust of the SIP protocol before actual communication occurs;

[0048] An authentication module, configured to authenticate the client and the server using an account authentication scheme;

[0049] A security module configured to manage keys between entities using a message trust authentication scheme and protect SIP messages exchanged between different entities, wherein the entities include a client, a server, a user agent, a user agent server, a SIP server, and a registration server;

[0050] The communication module is configured for interactive communication between the client and the server.

[0051] The third aspect of the present invention provides a medium on which a program is stored. When the program is executed by a processor, the steps of the dual authentication security protection method based on the SIP protocol as described in the first aspect of the present invention are implemented.

[0052] A fourth aspect of the present invention provides a device, comprising a memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the dual authentication security protection method based on the SIP protocol as described in the first aspect of the present invention are implemented.

[0053] One or more of the above technical solutions have the following beneficial effects:

[0054] The present invention discloses a dual authentication security protection method and system based on the SIP protocol. The dual authentication security reinforcement method based on the SIP protocol has stronger identity authentication capability. The present invention adopts a four-time challenge / response handshake technology to realize two-way authentication of user identity. Compared with the traditional identity authentication method, the security protection capability is stronger and can effectively prevent attacks such as offline password guessing attacks and server deception.

[0055] The dual authentication security reinforcement method based on the SIP protocol of the present invention has stronger message protection capability and high security. The present invention adopts a message trust authentication scheme to provide full protection for the interactive information between the server and the user end, effectively prevent middleman attacks, and ensure the security of the message.

[0056] The dual authentication security reinforcement method based on the SIP protocol of the present invention improves the security of the State Grid switching network. The State Grid administrative switching network adopts the IMS technology system. Compared with the traditional SIP protocol security protection solution, the present invention effectively prevents various network attacks and significantly improves the security of the switching network operation.

[0057] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0059] Figure 1 A flowchart of an account authentication scheme generated in Embodiment 1 of the present invention;

[0060] Figure 2 This is a flow chart of the message trust authentication solution in Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0061] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0062] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "include" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or their combinations;

[0063] Embodiment 1:

[0064] The first embodiment of the present invention provides a dual authentication security protection method based on the SIP protocol, which can improve the security and reliability of power administration and dispatching exchange systems. Specifically, it includes the following steps:

[0065] Step 1: Before actual communication occurs, the account authentication scheme UA-SIP is generated based on the two-way authentication of the SIP protocol, and the message trust authentication scheme MS-SIP is generated based on the message trust of the SIP protocol.

[0066] In a specific implementation, initial parameters are first set for the account authentication scheme and the message trust authentication scheme.

[0067] Step 2: Use the account authentication scheme to authenticate the client and server.

[0068] The account authentication scheme UA-SIP is used to perform two-way authentication of user identity. The UA-SIP is a new two-way authentication scheme for SIP, which uses four-way challenge or response handshake technology to achieve two-way authentication of user identity. It includes four stages: setup stage, login stage, authentication stage and registration stage. Figure 2 As shown, the following steps are included:

[0069] Step 2.1: During the setup phase, the user is registered as a legitimate user of the remote server.

[0070] Step 2.1.1: Client user C freely chooses his identity ID C and password PW C .

[0071] Step 2.1.2: The client then chooses a random password Seed C , and calculate the check value v.

[0072] In a specific implementation, a check value v and a secret exponent x are calculated according to the following formula:

[0073] x=H(Seed C ||ID C ||PW C),

[0074] v = g x .

[0075] Step 2.1.3: Establish a secure connection between client C and server S, and send v and ID C and Seed C To the proxy server S.

[0076] Step 2.1.4: After receiving the message, the proxy server S calculates the password verification value and sends the password to the proxy server with ID C PW as an index v and Seed C Stored in its database.

[0077] In a specific implementation, upon receiving the message M1=(v||Seed C ||ID C ), the proxy server S calculates the password check value Where S P is the server's private key, which is a random bit string with high entropy. Finally, the proxy server S is represented by ID C PW as an index v and Seed C Stored in its database.

[0078] Step 2.2: During the login phase, the user uses the client to try to log in to the proxy server S through an insecure channel to obtain services.

[0079] Step 2.2.1: Client C generates random numbers a1 and a2 in the range [1,q), and generates a temporary public key based on the random numbers generated by client C and

[0080] Step 2.2.2: Client C sends a request message M2 with a temporary public key = (A1||A2||ID C ) is sent to the proxy server S.

[0081] Step 2.2.3: When the proxy server S receives the request message M2, it uses ID C Retrieve Seed C and PW v . And calculate

[0082] Step 2.2.4: The proxy server S generates a random number b∈[1,q) and uses the random number generated by the proxy server S to calculate the temporary public key and private key.

[0083] In a specific implementation, firstly, the temporary public key B1=g is calculated using the random number generated by the proxy server S. b and private key w = H(v b ||A1||A2||Seed C ),

[0084] Then according to the temporary public key B1 = g b and private key w = H(v b ||A1||A2||Seed C ) Calculate the second temporary public key B2 and the first challenge code Ch1, the formula is as follows:

[0085] B2=(A1·A2·v) b·w ,

[0086] Ch1=H(w||B1||B2).

[0087] Among them, if the proxy server S does not have the credentials of the client C, it will communicate securely with the registration server to obtain these credentials.

[0088] Step 2.2.5: The proxy server S sends a message M3=H(B1||B2||Ch1||Seed) with a temporary public key and private key to the client C. C ).

[0089] Step 2.3: During the authentication phase, based on the pre-shared parameters, the proxy server S and the client C perform mutual identity authentication. If successful, a unique session key is generated and shared.

[0090] Step 2.3.1: After receiving the message with the temporary public key and private key sent by the proxy server S to the client C during the login phase, the client starts to check the temporary public key and private key.

[0091] In a specific implementation, upon receiving message M3, client C calculates x and w:

[0092] x=H(Seed C ||ID C ||PW C ),

[0093]

[0094] Client C checks whether the received challenge code Ch1 is equal to the calculated challenge code. If they are not equal, client C will terminate the session and authentication process with server S. Otherwise, client C will start calculating the second challenge code.

[0095] Client C calculates public key A and session key K cAnd the second challenge code Ch2.

[0096] A=(A1·B1·v)a 2·w ,

[0097]

[0098] Step 2.3.2: After the check is passed, Client C generates a random number that is difficult for an attacker to guess as a unique identifier for this interaction and encrypts the session.

[0099] The hard-to-guess random numbers are generated using cryptographically secure random number generators that can provide stronger randomness and unpredictability. This step can be implemented in the prior art and will not be described in detail.

[0100] In a specific implementation, encrypting the session specifically includes: using the session key K c Encrypt N1 and Ch2 to construct the first authentication code Auth-C1=E(K C , [CH2||N1]).

[0101] Subsequent messages received from proxy server S must contain the hash value of N1.

[0102] Step 2.3.3: Client C generates challenge information M4=(Auth-C1||A) and sends it to proxy server S.

[0103] Step 2.3.4: After receiving the challenge information, the proxy server S decrypts the challenge information.

[0104] In a specific implementation, after receiving the challenge message, the proxy server S calculates the session key K s .

[0105]

[0106] Through calculation, we can see that K s =K c =K sc , where K sc is the session key shared between S and C. The proxy server S uses K s Decrypt Auth-C1 to extract Ch2 and N1. Then, S calculates the second challenge code Ch2.

[0107] The proxy server S compares the second challenge code Ch2 extracted from Auth-C1 with the calculated challenge code For comparison. Then the proxy server S terminates the session with the client C, otherwise the proxy server S calculates the third challenge code

[0108] Step 2.3.5: After decryption is successful, the proxy server S constructs the server authentication code and sends an authentication message to the client C.

[0109] In a specific implementation, the proxy server S uses the session key K s Ch3 and H(N1) are encrypted to construct the server authentication code.

[0110] Step 2.3.6: After receiving the authentication message, client C performs decryption and verification. If the decryption and verification are successful, the authentication is completed.

[0111] In a specific implementation, after receiving the server authentication code message M5=Auth-C2, the client C uses the session key K c Decrypt the message to extract Ch3, and verify Ch3 and H(N1). If they are incorrect, client C will terminate the session. Otherwise, client C confirms that the message is sent by proxy server S, and the authentication is successful. The random number N1 is used to ensure that C is responding to a new message, which is to prevent replay attacks.

[0112] Step 2.4: Registration phase, which is the last phase in the A-SIP protocol: In this phase, the client registers the URI address to the proxy SIP server or register SIP server so that the user can contact the client through this address.

[0113] Step 2.4.1: At the end of the authentication phase, the client generates an M6=S-Rister message and sends it to the proxy server S.

[0114] In a specific implementation, at the end of the authentication phase, the client generates the following S-Rister message.

[0115] S-Register=E(K sc ,[Register|H 2 (N1)]).

[0116] Among them, Register is a standard SIP registration message, H 2 (N1) = H(H(N1)).

[0117] Step 2.4.2: After receiving the S-Register message, the proxy server S decrypts the message to obtain the Register information and 2 (N1) Perform inspection.

[0118] Step 2.4.3: The SIP server processes the Register message to register the URI of client C.

[0119] Step 2.4.4: The proxy server S sends an M7=S-OK message to the client.

[0120] S-OK=E(K sc ,[OK||H 3 (N1)TKT cs ]),

[0121] TKT cs =E(K p ,[URI c ||IP s ||LT1]).

[0122] Among them, OK is a standard SIPOK message, H 3 (N1) = H(H 2 (N1)), TKT cs It is the ticket used by client C for subsequent authentication to obtain VoIP services from the proxy server.

[0123] Step 2.4.5: When client C receives the S-OK message from proxy server S, client C decrypts the message using the session key and checks it. If it is correct, client C will accept the authentication ticket TKT in the S-OK message. cs .

[0124] Among them, the bill TKT cs Contains the client's registered address URIc and the proxy server's network address IPS. To prevent attackers from reusing the ticket, it contains a timestamp TS1, indicating the date and time the ticket was issued, and a validity period LT1, indicating how long the ticket is valid. In addition, the ticket uses the server's private key K p The ticket is encrypted so that it cannot be modified by Client C or an attacker. The ticket helps reduce the number of times the user has to enter the password. The ticket is reusable during a single login session. Client C can use the ticket multiple times to access the same proxy server during the validity period of the ticket.

[0125] Step 3: Use the message trust authentication scheme MS-SIP to manage the keys between entities and protect the SIP messages exchanged between different entities. The entities include clients, servers, user agents, user agent servers, SIP servers, and registration servers.

[0126] In a specific implementation, a message trust authentication scheme MS-SIP is used to ensure message integrity and security. Message trust measures whether the signaling and media streams transmitted under the SIP protocol come from legitimate and expected communication parties, and ensures that they are not maliciously modified or stolen during transmission. This is especially important in critical business scenarios such as power grid audio and video conferencing, and is related to the stability and confidentiality of communications. A key protection scheme MS-SIP (Message Security-SIP) for the SIP protocol is proposed for message trust authentication, which is used for key management between entities and to protect SIP messages exchanged between different entities. The MS-SIP scheme is implemented in three stages: call initialization stage, session stage, and session termination stage.

[0127] like Figure 2 As shown, the specific steps include:

[0128] Step 3.1: During the call initialization phase, user agents that have registered on the proxy server attempt to call each other in an encrypted environment.

[0129] Step 3.1.1: User agent C attempts to call user agent D, where both user agent C and user agent D are registered on proxy server S.

[0130] In a specific implementation, the user agent C sends a message M1=S-INVITEc to the proxy server to initiate a session. S-INVITEc contains the standard SIP invitation message INVITEc and the credentials, identity authentication Auth-C3, timestamp, and message lifecycle obtained from the proxy server S during the registration phase. The message S-INVITEc uses the last session key K shared with S. sc The identity authentication includes the URI of client C, the network address of client S and the random number N2.

[0131] Step 3.1.2: After receiving the S-INVITEc message, the proxy server decrypts it using the last session key shared with User Agent C and checks TS2 and LT2 to ensure that the message lifetime has not expired.

[0132] Step 3.1.3: Then, decrypt the credential using its own private key and verify its validity using the timestamp and lifecycle contained in the credential.

[0133] In addition, the URIc and IPs contained in the authentication message Auth-C3 are compared with the corresponding information in the ticket. If the ticket is valid, the IPs are correct, and the URIc matches the registered URI of the user agent C, the proxy server S will verify the identity of the user agent C and process the SIP-INVITE message.

[0134] To prevent replay attacks, the validity period of the S-INVITEc message is very short, much shorter than the validity period of the ticket.

[0135] To further prevent opponents from replaying tickets TKT cs , Notes TKT cs The session key is used together with the S-INVITEc message for encryption.

[0136] Step 3.1.4: S-INVITE sent by proxy server S D The message is encrypted using the session key KSD shared between the proxy server S and the user agent D. The message contains its validity period LT3, timestamp TS3, and random number N3 to prevent replay attacks.

[0137] Step 3.1.5: The proxy server S also sends an S-TRYINGc message to the user agent C. The message contains a standard SIP TRYING message and H(N2). These contents are transmitted through the session key K sc encryption.

[0138] In a specific implementation, the proxy server S returns the hash value of N2 received from M1 to the user agent C to indicate the freshness of the reply.

[0139] Each time User Agent C sends an S-INVITEc message, a timer is started. If User Agent C receives an S-TRYINGc message before the timer expires, the timer stops and the sender continues to send the next message. If the timer times out or N2 is incorrect, User Agent C terminates the session and re-initiates another session by sending an S-INVITEc message.

[0140] Step 3.1.6: The message from M4 to M7 consists of a standard SIP RINGING or OK message and the hash value H of the last received random number. j (N)=H j-1 (N) These messages are encrypted using a session key shared between the user agent and the proxy server to prevent tampering or forgery.

[0141] In addition, a random number is used to ensure that the message is fresh and has not been replayed by an adversary. If user agent D accepts the call request, it sends the message S-OK C , the proxy server S passes S-OK C The message forwards the SIP OK message to User Agent C.

[0142] Step 3.1.7: To achieve mutual authentication between User Agent C and User Agent D, the server sends authentication messages Auth-CD1 and Auth-CD2. To ensure message integrity and mutual authentication, the contents of Auth-CD1 and Auth-CD2 are encrypted using the session key shared between the User Agent and the server.

[0143] In a specific implementation, Auth-CD1 and Auth-CD2 contain a session key K CD1 A copy of the key is used to protect the messages exchanged directly between C and D. In addition, it also contains C's URI, the server's network address IPs, the hash value of the random number last exchanged with the server, the random number N4, the timestamp, and the message validity period, etc., in order to prevent forgery and replay attacks.

[0144] Step 3.2: During the session phase, the user agent that successfully attempts the call conducts the SIP session in an encrypted process.

[0145] In a specific implementation, at the end of initialization, user agent C sends an S-ACKc message to user agent D, the content of which uses the session key The S-ACKc message contains the standard SIP ACK message, as well as the hash of N4 proposed by the server in the authenticator. In addition, it contains a new random session key proposed by the user agent C. use Encrypting the content of the S-ACKc message and exchanging N4 ensures bidirectional authentication and prevents replay attacks. After receiving S-ACKc, user agent D can extract and process the standard SIP ACK message to start a media session with user agent C.

[0146] The protection of media streams is not within the scope of this solution.

[0147] Step 3.3: During the session termination phase, one user agent ends the SIP session by sending an S-BYE message, and the other user agent responds with an S-OK message.

[0148] In a specific embodiment, these messages include standard SIP BYE and OK messages. In addition, to prevent replay attacks, the S-BYE message includes a hash value of the received random number, a timestamp, and a lifetime. The content of these messages uses the last session key shared between User Agent C and User Agent D. Encryption is performed.

[0149] Step 4: The client and server communicate interactively.

[0150] In a specific implementation, after passing the account authentication scheme UA-SIP and the message trust authentication scheme MS-SIP, the client and the server can interact normally.

[0151] Embodiment 2:

[0152] Embodiment 2 of the present invention provides a dual authentication security protection system based on the SIP protocol, including:

[0153] The scheme construction module is configured to generate an account authentication scheme based on the two-way authentication of the SIP protocol and generate a message trust authentication scheme based on the message trust of the SIP protocol before actual communication occurs;

[0154] An authentication module, configured to authenticate the client and the server using an account authentication scheme;

[0155] A security module configured to manage keys between entities using a message trust authentication scheme and protect SIP messages exchanged between different entities, wherein the entities include a client, a server, a user agent, a user agent server, a SIP server, and a registration server;

[0156] The communication module is configured for interactive communication between the client and the server.

[0157] Embodiment three:

[0158] The third embodiment of the present invention provides a medium on which a program is stored. When the program is executed by a processor, the steps of the dual authentication security protection method based on the SIP protocol as described in the first embodiment of the present invention are implemented.

[0159] Embodiment 4:

[0160] Embodiment 4 of the present invention provides a device, including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps of the dual authentication security protection method based on the SIP protocol as described in Embodiment 1 of the present invention are implemented.

[0161] The steps involved in the above embodiments 2, 3 and 4 correspond to the method embodiment 1. For the specific implementation methods, please refer to the relevant description part of embodiment 1.

[0162] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0163] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A dual authentication security protection method based on SIP protocol, characterized in that: The following steps are involved: Before actual communication occurs, an account authentication scheme is generated based on the two-way authentication of the SIP protocol, and a message trust authentication scheme is generated based on the message trust of the SIP protocol; Use account authentication scheme to authenticate the client and server; A message trust authentication scheme is used to manage keys between entities and protect SIP messages exchanged between different entities, including clients, servers, user agents, user agent servers, SIP servers, and registrar servers; The client and server communicate interactively.

2. The dual authentication security protection method based on the SIP protocol as claimed in claim 1, characterized in that: The account authentication scheme consists of four stages: During the setup phase, the user is registered as a legitimate user of the remote server; During the login phase, the client logs in to the proxy server through an insecure channel to obtain services; During the authentication phase, the proxy server and the client authenticate each other based on pre-shared parameters; During the registration phase, the client registers the URI address with the proxy SIP server.

3. The dual authentication security protection method based on the SIP protocol as claimed in claim 2, characterized in that: The specific steps to register a user as a legitimate user of the remote server include: Client user C freely chooses his identity ID C and password PW C ; The client then selects a random password Seed C , and calculate the check value v; The client C establishes a secure connection with the server S and sends v and ID C and Seed C To the proxy server S; After receiving the message, the proxy server S calculates the password verification value and uses ID C PW as an index v and Seed C Stored in its database.

4. The dual authentication security protection method based on the SIP protocol as claimed in claim 3, characterized in that: The specific steps for a client to log in to a proxy server through an insecure channel to obtain services include: Client C generates a random number and generates a temporary public key based on the random number generated by client C; Client C sends a request message with a temporary public key to proxy server S; When the proxy server S receives the request message, it uses ID C Retrieve Seed C and PW v ; The proxy server S generates a random number and uses the random number generated by the proxy server S to calculate the temporary public key and private key; The proxy server S sends a message with a temporary public key and private key to the client C.

5. The dual authentication security protection method based on the SIP protocol as claimed in claim 4, characterized in that: Based on the pre-shared parameters, the steps for mutual identity authentication between the proxy server and the client include: After receiving the message with temporary public key and private key sent by proxy server S to client C during the login phase, the client starts to check the temporary public key and private key; After the check is passed, client C generates a random number as a unique identifier for this interaction and encrypts the session; Client C generates a challenge message and sends it to proxy server S; After receiving the challenge information, the proxy server S decrypts the challenge information; After successful decryption, the proxy server S constructs the server authentication code and sends the authentication message to the client C; After receiving the authentication message, client C performs decryption and verification. If the decryption and verification are successful, the authentication is completed.

6. The dual authentication security protection method based on the SIP protocol as claimed in claim 5, characterized in that: The specific steps for the client to register the URI address to the proxy SIP server include: At the end of the authentication phase, the client generates an S-Rister message and sends it to the proxy server S; After receiving the S-Register message, the proxy server S decrypts the message to obtain the Register information and checks it; The SIP server processes the Register message to register the URI of client C; The proxy server S sends an S-OK message to the client; When client C receives the S-OK message from proxy server S, client C decrypts the message using the session key and checks it. If it is correct, client C will accept the authentication ticket in the S-OK message.

7. The dual authentication security protection method based on the SIP protocol as claimed in claim 1, characterized in that: The message trust authentication scheme consists of three stages: In the call initialization phase, user agents that have registered on the proxy server attempt to call each other in an encrypted environment; During the session phase, the user agent that successfully attempts to call conducts the SIP session in an encrypted process; During the session termination phase, one user agent ends the SIP session by sending an S-BYE message, and the other user agent responds with an S-OK message.

8. A dual authentication security protection system based on SIP protocol, characterized in that: include: The scheme construction module is configured to generate an account authentication scheme based on the two-way authentication of the SIP protocol and generate a message trust authentication scheme based on the message trust of the SIP protocol before actual communication occurs; An authentication module, configured to authenticate the client and the server using an account authentication scheme; A security module configured to manage keys between entities using a message trust authentication scheme and protect SIP messages exchanged between different entities, wherein the entities include a client, a server, a user agent, a user agent server, a SIP server, and a registration server; The communication module is configured for interactive communication between the client and the server.

9. A computer-readable storage medium, characterized in that: A plurality of instructions are stored therein, and the instructions are suitable for being loaded by a processor of a terminal device and executing the dual authentication security protection method based on the SIP protocol as described in any one of claims 1-7.

10. A terminal device, characterized in that: The invention comprises a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; and the computer-readable storage medium is used to store a plurality of instructions, wherein the instructions are suitable for being loaded by the processor and executing the dual-authentication security protection method based on the SIP protocol according to any one of claims 1 to 7.

Images