Edge Proxy Server Federation Modes for Secure SIP Routing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data communications networks face challenges in securely federating SIP servers and networks, as current methods lack efficient mechanisms for authenticating and authorizing entities across different networks, leading to potential security vulnerabilities and complexities in managing message exchanges.

Innovation Solution

The implementation of an edge proxy server that routes messages based on federation modes (Direct, Automatic, and Clearinghouse) to securely manage interactions between networks, using authentication models like certificates and DNS-SRV to authenticate and authorize entities, and optionally forwarding messages through a trusted clearinghouse server.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If SIP servers from multiple organizations federate their servers to enable communication, then connectivity and functionality across networks is improved, but security vulnerabilities and management complexity increase

Engineering Contradiction:

Improveconnectivity across networksVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a federation server as an intermediary component that mediates between SIP servers from different organizations. This federation server handles authentication, authorization, and message routing between federated networks, thereby enabling connectivity while maintaining security through centralized control and validation mechanisms.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If SIP servers federate to enable cross-network communication, then network connectivity is improved, but administrative burden and management complexity increase

Engineering Contradiction:

Improvecross-network communicationVSAvoidmanagement complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The federation server is designed with multi-functionality, handling multiple tasks including authentication, authorization, message routing, and protocol translation. By consolidating these functions into a single universal component, the system reduces management complexity while enabling broad cross-network communication capabilities.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If authentication mechanisms are implemented for federated SIP servers, then security is improved, but processing time and operational overhead increase

Engineering Contradiction:

Improveauthentication securityVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs authentication and authorization actions in advance before message processing begins. By validating credentials and establishing security contexts preliminarily, the system reduces processing time during actual message exchange while maintaining strong authentication security.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS7506369B2Secure federation of data communications networks

Publication Date: 2009.03.17 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Techniques for secure federation of data communications networks are provided. The techniques employ an edge proxy server to route messages depending on a federation mode. In Direct federation mode, an edge proxy server of a network is configured to exchange messages with a specified set of entities, such as other networks, servers, other devices, or users. In Automatic federation mode, an edge proxy server may accept all incoming messages from entities that have a valid certificate. In Clearinghouse federation mode, the edge proxy server forwards all outgoing messages to a specified, trusted clearinghouse server.