PTT Application Security via Hidden API Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 4G push-to-talk (PTT) applications experience poor user experience due to lack of quality of service (QoS), resulting in significant push-to-hear delays of approximately 1.5 to 2 seconds, as they rely on public Internet connections and are not prioritized over other network traffic.
Innovation Solution
Exposing hidden APIs such as the IMS PDN API and DRX cycle API, while implementing a security application to authenticate and grant access only to the PTT application, allowing for prioritization of PTT traffic and modification of the DRX cycle timer to improve call setup times and latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If hidden APIs are exposed to enable PTT traffic prioritization and DRX cycle modification, then push-to-hear delay is reduced to less than one second, but security risks increase due to potential unauthorized access to these powerful interfaces
Solution Approach 1:
A security application acts as an intermediary between the PTT application and the exposed hidden APIs (IMS PDN API and DRX cycle API). The security application receives credentials from the PTT application, determines whether they match stored credentials, and only then grants access to the APIs. This mediator approach enables the PTT application to access hidden APIs for reducing push-to-hear delay while preventing unauthorized applications from exploiting these interfaces.
2Speed
If the DRX cycle timer is modified to improve call setup times, then latency is reduced, but device complexity increases due to the need for credential verification and access control mechanisms
Solution Approach 1:
The security application performs self-service by automatically receiving credentials from the PTT application, comparing them against stored credentials, and making access decisions without requiring manual intervention. This automation reduces the operational complexity of the access control mechanism while enabling fast DRX cycle timer modifications that improve call setup time.
Solution Approach 2:
The system performs preliminary credential verification before allowing access to the DRX cycle API. By pre-storing credentials and verifying them in advance, the system establishes a streamlined access control process that minimizes overhead during actual API access, thus maintaining fast call setup times while implementing necessary security checks.
3Reliability
If the IMS PDN API is exposed to establish data routes over IMS network, then quality of service is improved, but the system becomes more vulnerable to network attacks and unauthorized modifications
Solution Approach 1:
The security application serves as an intermediary that controls access to the IMS PDN API. It verifies credentials from the PTT application and only then allows the establishment of data routes over the IMS network. This ensures that QoS improvements through IMS network routing are achieved while preventing unauthorized applications from exploiting the exposed API for malicious purposes.
Data Source
AI summary
A device determines whether a PTT application is authenticated to access a first API and a second API, and prevents the PTT application from accessing the first and second APIs when the PTT application is not authenticated. The device permits the PTT application to access the first and second APIs when the PTT application is authenticated, and modifies, via the first API, a timer that dictates when the device checks for traffic received from a network. The device establishes, via the second API, a data connection with the network, and determines, based on the data connection, a QoS framework for the network. The device utilizes the PTT application and the timer to establish a PTT session with another device via the network, and prioritizes, based on the QoS framework, PTT traffic provided in the PTT session with the other device.