Early DTLS Handshake for IMS Session Setup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DTLS negotiation in IMS systems takes several seconds to complete, prolonging the overall session set-up time and resulting in a poor user experience.
Innovation Solution
Implementing an early security handshake procedure by determining and recording the capabilities of the Media Gateway and User Equipment to initiate the DTLS handshake immediately upon receiving a communication session setup request, using pre-provided connection parameters to commence the security handshake without waiting for SDP messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DTLS negotiation is performed after receiving session setup request and SDP messages, then security is ensured through proper certificate validation, but session set-up time is prolonged to several seconds
Solution Approach 1:
The patent applies preliminary action by performing the DTLS security handshake before the SDP negotiation and media connection establishment. Specifically, the UE and MGw exchange certificates and complete DTLS key derivation in advance (steps S1-S4), allowing the security context to be established prior to media path setup. This reordering enables the security-critical DTLS negotiation to occur independently and earlier, reducing the overall session setup time while maintaining security integrity through proper certificate validation.
2Loss of time
If DTLS handshake is initiated early before SDP messages are exchanged, then session set-up time is reduced, but coordination complexity between control server and media gateway increases
Solution Approach 1:
The patent applies segmentation by separating the DTLS security handshake from the SDP media negotiation process. The DTLS handshake is executed as an independent sequence of steps (S1-S4) involving certificate exchange and key derivation, while SDP negotiation proceeds separately (S5-S7). This segmentation allows the control server to trigger early DTLS initiation without requiring complex inter-dependencies between security and media setup, reducing coordination overhead while enabling parallel processing.
Solution Approach 2:
The control server acts as an intermediary that coordinates the early DTLS initiation by sending appropriate trigger messages to the MGw based on UE capabilities. The control server receives capability indications from the UE during registration, determines whether early DTLS is supported, and accordingly triggers the DTLS handshake at the appropriate time. This intermediary coordination simplifies the overall system complexity by centralizing the decision-making logic while enabling efficient early security setup.
3Ease of operation
If early security handshake is implemented, then user experience is improved through faster connection, but compatibility with legacy systems that do not support early handshake must be maintained
Solution Approach 1:
The patent applies dynamics by making the DTLS initiation timing adaptive based on UE capability indications. During the registration phase, the UE provides capability information to the control server indicating whether it supports early DTLS handshake. The control server then dynamically adjusts the session setup procedure: for capable UEs, early DTLS is triggered; for legacy UEs, the traditional post-SDP DTLS negotiation is performed. This dynamic adaptation ensures optimal user experience for advanced devices while maintaining full compatibility with legacy systems.
Data Source
AI summary
A method of establishing a secure connection between a user equipment, UE, and a media gateway, MGw, at setup of a communication session between the UE and another party. The MGw is controlled by a control server and the setup of the communication session comprises a security handshake procedure. The method comprising, prior to receiving a communication session set-up request, determining by the control server whether the MGw supports a procedure for early commencement of the security handshake and providing by the UE to the control server an indication that the UE supports the procedure for early commencement of the security handshake procedure and connection parameters for use in the security handshake. On receiving, by the control server, a communication session setup request from the other party, if both the UE and the MGw support the procedure for early commencement of the security handshake procedure, an instruction is sent to the Media gateway to commence the security handshake procedure. The instruction comprises an indication to commence an early security handshake and the connection parameters for the UE. On receipt of the instruction, the MGw commences the security handshake (25) with the UE and establishes a secure communications session.