Secure Call Forwarding via Key Management Server Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the IMS system, existing call forwarding mechanisms fail to authenticate the identity of the call-forwarded party, leading to insecure call forwarding scenarios, especially in cases where the call-forwarded party has a different public user identifier than the original called party.
Innovation Solution
A method and system that utilize a key management server to authenticate the call-forwarded party by obtaining and verifying encrypted binding relation information through an application server, ensuring that the call-forwarded party is a legal party by comparing identifiers and maintaining secure key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If call forwarding is implemented without identity authentication, then call flexibility and configurability are improved, but security and reliability deteriorate
Solution Approach 1:
The key management server acts as an intermediary between the call server and the call-forwarded party. It receives the call request message from the call server, authenticates the call-forwarded party's identity by verifying the binding relation between the called party and call-forwarded party, and only then distributes the media key. This intermediary authentication mechanism allows call forwarding to proceed while maintaining security, resolving the contradiction between flexibility and reliability.
2Speed
If call forwarding is implemented without key authentication, then call setup speed is improved, but media key distribution security deteriorates
Solution Approach 1:
The key management server performs preliminary authentication of the call-forwarded party's identity before distributing the media key. By verifying the binding relation in advance, the system ensures that only authorized parties receive the media key, maintaining security without significantly delaying the overall call setup process. The authentication is performed efficiently as a preliminary check rather than a bottleneck.
3Adaptability or versatility
If the call-forwarded party uses a different public user identifier, then call forwarding flexibility is improved, but identity authentication difficulty increases
Solution Approach 1:
The key management server serves as an intermediary that handles the authentication challenge. Instead of relying on the call server to verify the call-forwarded party's identity, the KMS receives the call request message, extracts the binding relation information, and performs the authentication independently. This intermediary approach simplifies the authentication process and maintains flexibility in using different public user identifiers.
Solution Approach 2:
The system uses feedback mechanisms where the key management server verifies the binding relation between the called party and call-forwarded party, and only after successful verification does it proceed to distribute the media key. This feedback loop ensures that the call-forwarded party's identity is authenticated while allowing flexible identifier usage, as the authentication is based on the binding relation rather than strict identifier matching.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method, system and apparatus for implementing secure call forwarding are provided in the present invention. The method includes: a calling party calling a called party, the called party triggering the subscribed call forwarding service; a key management server (KMS) obtaining information of a legal call-forwarded party of the called party through an application server; the call-forwarded party obtaining a media key from the KMS; and the calling party establishing a call connection with the call-forwarded party.