Intermediate Unit Certificate Exchange for Secure Media Data

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing communication networks lack a solution for exchanging credentials between sender and receiver units to enable end-to-end protection of media data when it is sent via an intermediate unit, particularly in scenarios where the intermediate unit does not have access to the keying material for end-to-end integrity protection.

Innovation Solution

The solution involves an intermediate unit storing information associated with a certificate belonging to the receiver unit, which has been signed by the receiver unit, allowing the sender unit to verify the intermediate unit's authority and send protected data using this information for hop-by-hop protection, while maintaining end-to-end protection between the sender and receiver units.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If end-to-end protection is implemented between sender and receiver, then confidentiality and integrity of media data are improved, but the intermediate unit cannot authenticate the sender or verify media data authenticity

Engineering Contradiction:
Improveconfidentiality and integrity protectionVSAvoidinability to authenticate sender and verify media data
Core Design Contradiction:
ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The patent divides the security protection into two separate segments: end-to-end protection (confidentiality and integrity) and hop-by-hop protection (authentication and verification). This segmentation allows each security mechanism to operate independently with its own keying material, resolving the contradiction by enabling both functions simultaneously without interference.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary security context at the intermediate unit that mediates between the end-to-end protected data flow and the authentication requirements. This intermediary hop-by-hop security context allows the intermediate unit to perform authentication and verification functions without compromising the end-to-end protection, as it operates with separate keying material.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If hop-by-hop security context is established for authentication, then sender authentication and media data verification are improved, but end-to-end protection keying material may be exposed to intermediate units

Engineering Contradiction:
Improvesender authentication and media data verificationVSAvoidexposure of end-to-end keying material
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the security keying material into two distinct sets: one for end-to-end protection and another for hop-by-hop protection. This segmentation ensures that the intermediate unit only has access to hop-by-hop keying material for authentication purposes, while the end-to-end keying material remains securely held by the sender and receiver only, preventing exposure.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by assigning different security properties to different parts of the communication path. The hop-by-hop security context has authentication-focused properties at intermediate units, while the end-to-end security context maintains confidentiality and integrity properties exclusively between sender and receiver, with no keying material exposure at intermediate points.

Inventive Principle:
Principle #3Local quality

3Reliability

If SRTP is used for media protection, then encrypted transport is achieved, but file transfer format forwarding is not supported and intermediate units cannot verify data authenticity

Engineering Contradiction:
Improveencrypted transport protectionVSAvoidforwarding capability and authentication support
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments the security functionality into separate layers: SRTP provides encrypted transport protection at the media layer, while the additional hop-by-hop security context provides authentication and verification capabilities at the network layer. This segmentation allows SRTP to maintain its encrypted transport function while the intermediate unit can independently perform authentication and forwarding operations using the hop-by-hop context.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent makes the intermediate unit multi-functional by equipping it with both hop-by-hop security context for authentication/verification and the capability to forward SRTP-protected media data. This universality allows the same intermediate unit to perform multiple functions (authentication, verification, and forwarding) simultaneously without conflict, resolving the adaptability issue.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2484048B1Sending protected data in a communication network
Publication Date: 2015.12.23 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)
  • EP2484048B1 patent drawingFigure 1~2
  • EP2484048B1 patent drawingFigure 3
  • EP2484048B1 patent drawingFigure 4~5

AI summary

A method of sending protected data from a sender unit to a receiver unit via an intermediate unit. The intermediate unit stores information associated with a certificate belonging to the receiver unit, and information associated with a certificate belonging to the intermediate unit, which has previously been signed by the receiver unit. The intermediate unit receives a request from the sender unit to send protected data to the receiver unit, and so it sends a response to the sender unit. The response includes the information associated with the certificate belonging to the receiver unit, which allows the sender unit to verify that the intermediate unit is authorised to receive data on behalf of the receiver unit. The intermediate unit then receives data from the sender unit that is protected using the information associated with the certificate belonging to the receiver unit for subsequent forwarding to the receiver unit. Having the receiver unit sign the intermediate unit's certificate allows the exchange of credentials to allow a sender unit to send protected data to a receiver unit via an intermediate unit.