Session Border Controller Authentication via Stored Challenge Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In communication networks using Session Initiation Protocol (SIP), there is a need to authenticate devices and users attempting to access services over new TCP connections, especially when the Registrar does not challenge INVITE requests, and session border controllers lack access to authentication secrets or keys.
Innovation Solution
A session border controller stores authentication-related information exchanged during registration and uses it to authenticate subsequent requests, employing Transport Layer Security (TLS) to prevent attackers from intercepting messages, and monitors the challenge and response process to verify the legitimacy of users attempting to access services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the Registrar does not challenge INVITE requests, then the authentication process is simplified and faster, but network security is compromised as unauthorized users can place calls without verification
Solution Approach 1:
The SBC performs authentication verification in advance by monitoring the challenge-response exchange during the REGISTER phase. It stores the challenge and response information before the INVITE request arrives, enabling it to autonomously verify the caller's identity later without requiring the Registrar to challenge INVITE requests.
Solution Approach 2:
The SBC acts as an intermediary between the UE and the network, taking over the authentication verification function. Instead of relying on the Registrar to challenge INVITE requests, the SBC uses stored challenge-response data to independently verify the caller's identity, thus maintaining security without compromising call establishment speed.
2Adaptability or versatility
If the SBC does not have access to authentication secrets or keys, then the system architecture is more distributed and flexible, but the SBC cannot perform authentication operations that normally require these secrets
Solution Approach 1:
The invention extracts the authentication verification function from the Registrar and transfers it to the SBC. The SBC stores the challenge and response information exchanged during registration, enabling it to perform authentication operations independently without needing access to the authentication secrets or keys held by the Registrar.
Solution Approach 2:
The SBC creates a copy of the authentication credentials by storing the challenge and response information exchanged during the REGISTER phase. This copied information enables the SBC to verify the caller's identity in subsequent INVITE requests without requiring access to the original authentication secrets held by the Registrar.
3Ease of operation
If a new TCP connection is established for each call, then connection management is simpler and state preservation is not required, but there is no guarantee that the new connection is initiated by a legitimate previously authenticated device
Solution Approach 1:
The SBC implements a feedback mechanism by monitoring the challenge-response exchange during registration and storing this information for later verification. When a new TCP connection initiates a call, the SBC uses the stored challenge-response data to verify whether the caller is a legitimate previously authenticated device, thus maintaining connection management simplicity while ensuring device legitimacy.
Data Source
AI summary
Methods and apparatus for authenticating a user equipment device (UE) requesting services through a session border controller (SBC) are described. In some embodiments the SBC stores the challenge and response for a successfully authenticated UE and uses this information to authenticate the UE when the UE seeks access to a service, e.g., establishing a new TCP connection. In some other embodiments, in response to receiving an Invite request from a UE requesting service the SBC generates and sends a Registration request to an authentication entity on behalf of the UE to trigger an authentication process. If the UE is authenticated the SBC allows service access, e.g., allows a call to proceed, otherwise denies service to the UE.