Two-factor authentication of participants when setting up a telephone call

Abstract

When establishing a telephone call, the identity of the caller(s) or all participants must be determined or verified with a high degree of certainty. This should function with as many known telephony technologies as possible and be provider-independent. The invention relates to a method for achieving this using two-factor authentication. The method is independent of the participant's device (e.g., landline telephone, mobile phone, SIP client), access method (e.g., SIP, PBX, PSTN), or provider (e.g., Telekom, Sipgate, O2).

Description

[0001] The invention relates to a method for using two-factor authentication of participants when establishing a telephone call. Problem

[0002] When establishing a telephone call, the identity of the caller(s) or all participants must be established or verified with a high degree of security. This should work using as many common telephony technologies as possible and be provider-independent. Technical status

[0003] Technical solutions already existing in this field that are to be replaced or improved by this reported invention (current state of the art): • Authentication via the telephone connection (landline): The authentication of the subscriber is used for billing purposes only. The authentication information remains with the provider. It typically does not allow any conclusion as to whether person A is actually the subscriber. Authentication occurs solely via the connection port used. Any subscriber with access to this connection port cannot be distinguished. • Authentication via SIM card: The authentication of the subscriber is for billing purposes only. The authentication information remains with the provider. It usually does not allow for any determination as to whether Person A is actually the subscriber. If the device falls into the possession of another person, this cannot be determined. • Authentication via SIP password: Authentication via SIP password is not two-factor authentication. It typically does not allow for any determination as to whether person A is actually the subscriber. If another person gains access to the SIP client, this cannot be determined. • Authentication using certificates: Authentication using certificates only works with SIP clients and specially adapted telephone exchanges. Typically, authentication occurs only through possession, as the password for using the private key is stored in the software. All participants must be registered with the same telephone exchange.

[0004] The authentication of any participant (both via SIP and PSTN) using two-factor authentication is unknown. To the best of our knowledge, there is currently no solution for authenticating the participant(s) using two-factor authentication when establishing a telephone call via any access method (SIP, PBX, PSTN, etc.) and any provider.

[0005] Previous attempts to address these deficiencies have involved using certificates to authenticate the SIP client. However, authentication requires the use of SIP. Furthermore, the subscriber must be registered on the PBX being operated. Subscribers registered via SIP on another PBX not operated under the company's own control cannot be authenticated using this method.

[0006] System structure and process description up to 2-factor authentication • Operation of a telephone system for providing audio conferences and direct calls. When establishing a direct call, at least one participant must be registered with this telephone system. • Extension of the telephone system with an authentication module • Registration of participants via a provided registration page with identification. • Registration (optionally with creation) of a token for later authentication of the participant. • Linking subscriber details (e.g. telephone number, SIP client name, others) with the token to identify the subscriber. • Call setup by the subscriber: • Case A: Participation in an audio conference • Case B: Call from a subscriber Process description 2-factor authentication audio conference (case A):

[0007] The subscriber is identified based on the subscriber details provided when the call is established (e.g. subscriber number). Subscriber authentication is then initiated. For this purpose, the previously registered user is identified based on the subscriber details and an authentication request is sent to them by the authentication module via a separate channel (e.g. SMS, push message, email). The request can contain information about the desired call setup (e.g. telephone number of the called party, time of day, name of the called party). The user complies with the request and authenticates themselves using two factors (e.g. possession of a smartphone and fingerprint). From a technical perspective, this can be done, for example, by signing a challenge contained in the request (see challenge-response procedure), which is sent to the extended telephone system and checked there.If the participant can be correctly authenticated, their call details can be optionally adjusted (e.g., displaying correct names in the conference or signaling successful authentication). If authentication fails, the call is not connected. Please note that the participant does not necessarily have to be registered with the PBX. Any telephone (e.g., landline, mobile, SIP client), telephone connection (ISDN, LTE, landline, Voice over IP), and provider (e.g., Telekom, O2, Sipgate) can be used to establish and conduct the call. Telephone call between two participants (Case B):

[0008] In the first step, the subscriber establishing the call is identified and authenticated. Authentication is identical to case A. In the second step, the called subscriber is optionally also identified and authenticated. Only then is the call connected. If the subscriber(s) can be correctly authenticated, their call details can optionally be adjusted (e.g. displaying correct names in the conference or signaling successful authentication). If authentication fails, the call is not connected. It should be noted that one subscriber must be registered on the extended telephone system. The other subscriber does not necessarily have to be registered on the telephone system. They can use any telephone (e.g. landline, mobile phone, SIP client), telephone connections (ISDN, LTE, landline, Voice over IP) and provider (e.g. Telekom, O2, Sipgate) to establish and make the call.

[0009] For a sketch of a possible system structure, see drawing 1.

Claims

[1] Procedure for authenticating the subscriber(s) by means of a 2-factor authentication when establishing a telephone call via any subscriber device (e.g. landline telephone, mobile telephone, SIP client), any access path (e.g. SIP, PBX, PSTN) and any provider (e.g. Telekom, Sipgate, O2) [2] Regarding claim 1: The subscriber device and authenticator can be separate systems (e.g. landline telephone and authentication app on the smartphone) or integrated (SIP app with authentication module). [3] Regarding claim 1: The extended telephone system acts as a so-called application level gateway and, after authentication, forwards the call to the actual non-extended telephone system. [4] Regarding claim 1: The authentication module is an independent service which is not part of the telephone system but is accessed via an interface. [5] An upstream application level gateway obtains the subscriber details using technical means (e.g. deep package inspection), initiates the authentication and, after authentication, forwards the call to the actual non-extended telephone system. [6] When the call is established, the subscriber is given a random number via an automated voice. The subscriber enters this number into their authenticator. The authenticator authenticates the subscriber using this random number via an out-of-band procedure with the extended telephone system. [7] When the call is established, the subscriber is given a random number via an automated voice. The subscriber enters this number into their authenticator. The authenticator generates another number based on this random number, which the subscriber transmits to the extended telephone system via the numeric keypad of their device. [8] In addition to authentication, the connection is also encrypted. Encryption is directly linked to authentication, meaning that parts of the connection data are included in the authentication. However, this only works reliably if both participants are connected to the telephone system controlled by the operator.

Images