Conferencing Roster Hash Validation for Unauthorized Participant Detection

Solution Overview

Problem

Cloud-based conferencing solutions introduce security risks due to the presence of untrusted network entities in public networks, which can lead to unauthorized participants and eavesdropping in multiparty conferencing sessions.

Innovation Solution

Implementing a system where endpoints compare a roster list provided via a Session Initiation Protocol (SIP) communication with a participant list from a key management server using hash values to validate conference participants, ensuring that only authorized participants can access the conferencing data by using end-to-end and hop-to-hop encryption keys, and restricting access to sensitive information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If cloud-based conferencing solutions are deployed using public networks, then cost-effectiveness and scalability are improved, but security risks increase due to untrusted network entities

Engineering Contradiction:

Improvecost-effectivenessVSAvoidsecurity

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The system performs preliminary validation by comparing the roster list received via SIP with the participant list from the key management server before allowing conference participation. This advance verification prevents unauthorized participants from joining, addressing security concerns before they manifest during the conference.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary validation mechanism that acts as a mediator between the SIP signaling path and the key management server. This intermediary compares participant lists and validates authenticity, enabling secure cloud-based conferencing without requiring private network infrastructure.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If cloud-based conferencing solutions are deployed using public networks, then scalability is improved, but security risks increase due to untrusted network entities

Engineering Contradiction:

ImprovescalabilityVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary validation by comparing the roster list received via SIP with the participant list from the key management server before allowing conference participation. This advance verification prevents unauthorized participants from joining, addressing security concerns before they manifest during the conference.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary validation mechanism that acts as a mediator between the SIP signaling path and the key management server. This intermediary compares participant lists and validates authenticity, enabling secure cloud-based conferencing without requiring private network infrastructure.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Measurement precision

If participant lists are compared directly to detect unauthorized participants, then detection accuracy is improved, but information security deteriorates due to exposure of sensitive participant data

Engineering Contradiction:

Improvedetection accuracyVSAvoidinformation security

Core Design Contradiction:

Measurement precisionVSLoss of information

Solution Approach 1:

The patent extracts only the essential validation information (participant identifiers) from the complete participant lists, comparing these extracted elements to detect unauthorized participants. This extraction approach maintains detection accuracy while minimizing exposure of sensitive participant data.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The validation process applies local quality by treating different parts of the participant data differently - only the identifier fields are compared for validation, while other sensitive information remains protected and is not transmitted or exposed during the validation process.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS10404481B2Unauthorized participant detection in multiparty conferencing by comparing a reference hash value received from a key management server with a generated roster hash value

Publication Date: 2019.09.03 CISCO TECHNOLOGY INC

AI summary

The disclosed technology addresses the need in the art for a detecting an unauthorized participant in a multiparty conferencing session. A system is configured to join a conferencing session, obtain a roster for the conferencing session via a Session Initiation Protocol (SIP) channel, and generate a roster hash value based on the roster. The system may further receive a reference hash value from a key management server and compare the reference hash value with the roster hash value. The system may determine that the roster is invalid when the reference hash value does not match the roster hash value.