B2BUA Modem Authentication for IMS Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Communication devices face challenges in protecting against malicious applications that attempt to access IMS services without authorization, leading to potential data misuse and denial-of-service attacks, as existing authentication methods are inadequate in distinguishing between legitimate and malicious applications.
Innovation Solution
A Back-to-Back User Agent (B2BUA) is integrated into the modem subsystem of User Equipment (UE), which authenticates IMS applications using standard Session Initiation Protocol (SIP) authentication, sharing a common secret with trusted applications, thereby authenticating and authorizing only legitimate applications without requiring a new API between the Application Processing Engine and the modem.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard SIP authentication is used for IMS applications, then authentication capability is provided, but malicious applications can still perform denial-of-service attacks and unauthorized access
Solution Approach 1:
The patent segments the authentication process into two distinct stages: first, the B2BUA authenticates the application itself using application ID and shared secret credentials; second, the authenticated application then performs SIP authentication with the network. This segmentation allows the system to verify application identity before allowing network access, preventing malicious applications from performing denial-of-service attacks while maintaining standard SIP authentication for legitimate communications
Solution Approach 2:
The B2BUA acts as an intermediary authentication entity between the application and the SIP network. It intercepts SIP messages, verifies application credentials against stored shared secrets, and only forwards authenticated application traffic to the network. This intermediary role enables the system to distinguish between legitimate and malicious applications, blocking unauthorized access while allowing standard SIP authentication to proceed for authorized applications
2Adaptability or versatility
If multiple IMS applications attempt to obtain access authorization simultaneously, then service functionality is enhanced, but large amounts of traffic are generated
Solution Approach 1:
The system performs preliminary authentication of applications before they can access the SIP network. The B2BUA pre-verifies application credentials using shared secrets during application registration or initial connection attempts. This preliminary action filters out unauthorized applications early, preventing them from generating excessive traffic, while allowing multiple legitimate applications to coexist and access services simultaneously
3Reliability
If authentication mechanisms are added to protect against malicious applications, then security is improved, but system complexity increases
Solution Approach 1:
The B2BUA is designed to perform multiple functions: it acts as a SIP proxy, an authentication server, and a message relay simultaneously. By consolidating these functions into a single component, the system achieves enhanced security through application authentication without proportionally increasing overall system complexity. The same B2BUA infrastructure that routes SIP messages also performs credential verification, eliminating the need for separate dedicated authentication hardware or software
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are provided for authenticating Internet Protocol (IP) Multimedia Subsystem (IMS) applications in a User Equipment (UE). A method includes: receiving a first Session Initiation Protocol (SIP) REGISTER message from an IMS application operating on the UE; transmitting a response message to the IMS application based on the received first SIP REGISTER message; receiving a second SIP REGISTER message from the IMS application operating on the UE; determining authentication for the IMS application based on the received second SIP REGISTER message from the IMS application operating on the UE; and based on the step of determining authentication for the IMS application, if the IMS application is authorized, then transmitting information associated with the first and second SIP REGISTER messages toward a SIP node or if the IMS application is unauthorized, then discarding data associated with the first and second SIP REGISTER messages.