Secure Forking Call Session in IMS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for secure forking call sessions in IMS systems, such as the TBS and Otway-Rees key agreement protocols, face challenges in managing key agreements efficiently, leading to increased processing and storage loads on the Key Management Server (KMS) and high requirements on the calling terminal's calculation capacity, with no practical solution available using the Otway-Rees protocol for forking call scenarios.
Innovation Solution
A method and system that utilize an INVITE message to call all called parties, with each party generating a random number and requesting a media root key from the KMS, where the KMS decrypts and authenticates user IDs, generating and encrypting a media root key shared between the calling and called parties, and the IMS network refuses responses from non-responding parties to ensure secure media sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the TBS scheme is used to establish secure media channels in forking call sessions, then media security is achieved, but additional signaling interaction is required and the KMS experiences increased storage and calculation loads
Solution Approach 1:
The patent extracts the ticket request and verification steps from the key establishment process. Instead of requiring the calling party to request tickets from the KMS and verify them with called parties, the system directly establishes media keys through the KMS using the Otway-Rees protocol, removing the intermediate ticket management complexity while maintaining security.
Solution Approach 2:
The KMS performs preliminary key generation and distribution before the actual media session begins. The calling and called parties receive their respective keys and verification data in advance through the INVITE message exchange, allowing the media session to start immediately without additional signaling delays.
2Reliability
If the TBS scheme is used to establish secure media channels in forking call sessions, then media security is achieved, but the KMS experiences greatly increased storage and calculation loads
Solution Approach 1:
The patent implements local key derivation at each party's endpoint rather than requiring the KMS to generate and manage all media keys centrally. The KMS only generates master keys and verification data, while the actual media keys are locally derived by the calling and called parties using the Otway-Rees protocol, significantly reducing the KMS's calculation and storage burden.
3Reliability
If traditional SIP forking call session technology is used, then the calling terminal can come to an agreement on media keys with all forked called terminals, but the processing capacity and calculation capacity requirements are quite high
Solution Approach 1:
The patent introduces the KMS as an intermediary that facilitates key agreement between the calling terminal and called terminals. Instead of requiring the calling terminal to independently negotiate keys with multiple called terminals (which is computationally intensive), the KMS mediates the key exchange using the Otway-Rees protocol, allowing the calling terminal to establish secure sessions with multiple parties simultaneously with minimal calculation overhead.
4Ease of operation
If a delay mechanism is added to reduce processing load in traditional SIP forking, then the calling terminal's processing load is reduced, but the media stream is not protected by encryption during the delay period resulting in a new delay problem
Solution Approach 1:
The patent performs preliminary key establishment and verification during the INVITE message exchange phase, before the actual media stream is established. The calling and called parties exchange encrypted verification data through the KMS in advance, so that when the media session begins, encryption is already in place and no additional delay is required for key negotiation.
Data Source
AI summary
The present invention relates to a method for realizing a secure forking call session, which comprises: performing authentication between a calling party and a KMS or between each called party and the KMS, and acquiring a shared key between the calling party and the KMS or a shared key between each called party and the KMS; generating a random number by the calling party and calling each called party through an IMS; generating a random number by each called party and acquiring a media root key from the KMS; generating a media key, which is shared with the calling party, by each called party according to the media root key and the random number generated by the called party; sending the media root key and the generated random number by a called response party in the called parties, who responds the call, to the calling party through the IMS network; generating a media key identical to that of the called response party by the calling party according to the media root key and the random number generated by the called response party; and performing a secure media session between the calling party and the called response party with the identical media key.