RTP Encryption Key Distribution in VoIP Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing client-server distributed systems for VoIP communications face challenges in securing real-time data transmission due to high maintenance costs, reliance on certificate management, and the need for authentication servers, which hinder efficient encryption and compromise real-time properties.
Innovation Solution
A client-server distributed system that manages and updates RTP encrypting information dynamically, eliminating the need for authentication servers and certificate management by setting and notifying RTP encrypting information between client apparatuses, enabling peer-to-peer encryption and decryption without pre-shared keys or public key authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL/TLS system is used for inter-client RTP encryption, then security is improved, but authentication server and certificate management are required increasing maintenance cost
Solution Approach 1:
The patent extracts the authentication function from the encryption system by having the server separate RTP encryption key management from SSL/TLS authentication. The server directly notifies clients of RTP encryption keys without requiring certificate-based authentication, eliminating the need for authentication servers and certificate management while maintaining security.
Solution Approach 2:
The server acts as an intermediary that directly distributes RTP encryption keys to clients without requiring mutual authentication between clients. The server generates and notifies encryption keys to communicating clients, eliminating the need for certificate-based authentication while ensuring secure peer-to-peer encryption.
2Reliability
If public key authentication is used for key delivery, then security is improved, but processing time increases compromising real-time property
Solution Approach 1:
The server performs preliminary key generation and stores encryption keys in advance before actual RTP communication occurs. When clients need to communicate, the server quickly notifies them of pre-generated encryption keys without requiring time-consuming public key authentication processing, thus maintaining real-time properties.
Solution Approach 2:
The patent uses short-lived session-specific RTP encryption keys that are generated and distributed only when needed for specific communication sessions. These keys are discarded after use and replaced for each new session, avoiding the need for long-term public key infrastructure while maintaining security for each individual session.
3Reliability
If certificate authentication is performed each time a call is issued, then security is improved, but maintenance workload increases
Solution Approach 1:
The patent segments the authentication and encryption functions into separate processes. Certificate-based authentication is performed once during server setup, while RTP encryption keys are independently generated and distributed for each communication session without requiring re-authentication, significantly reducing maintenance workload.
Solution Approach 2:
The server autonomously generates and manages RTP encryption keys without requiring external authentication servers or manual certificate management. The system serves itself by automatically distributing encryption keys to clients based on communication requests, eliminating the need for ongoing certificate maintenance.
Data Source
AI summary
When an SIP interface unit of a server apparatus receives an SIP message for call connection from a client apparatus and an SIP message analyzing unit can confirm that the SIP message is normal, a call controller recognizes that an RTP communication is carried out between the client apparatus and another client apparatus and instructs an encrypting capability management unit to determine RTP encrypting information which is used between the client apparatuses. The encrypting capability management unit determines the RTP encrypting information between these client apparatuses based on the instruction. With this arrangement, there can be provided a client-server distributed system that can realize an encrypting security function without requiring a certificate authentification function at a low cost in order to deliver an encrypting key as well as without necessity of holding or managing a certificate and preparing an authenticating server in a system.