Secure Forking Call Session in IMS

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing solutions for secure forking call sessions in IMS systems, such as the TBS and Otway-Rees key agreement protocols, face challenges in managing key agreements efficiently, leading to increased processing and storage loads on the Key Management Server (KMS) and high requirements on the calling terminal's calculation capacity, with no practical solution available using the Otway-Rees protocol for forking call scenarios.

Innovation Solution

A method and system that utilize an INVITE message to call all called parties, with each party generating a random number and requesting a media root key from the KMS, where the KMS decrypts and authenticates user IDs, generating and encrypting a media root key shared between the calling and called parties, and the IMS network refuses responses from non-responding parties to ensure secure media sessions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the TBS scheme is used to establish secure media channels in forking call sessions, then media security is achieved, but additional signaling interaction is required and the KMS experiences increased storage and calculation loads

Engineering Contradiction:
Improvemedia securityVSAvoidsignaling interaction process
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the ticket request and verification steps from the key establishment process. Instead of requiring the calling party to request tickets from the KMS and verify them with called parties, the system directly establishes media keys through the KMS using the Otway-Rees protocol, removing the intermediate ticket management complexity while maintaining security.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The KMS performs preliminary key generation and distribution before the actual media session begins. The calling and called parties receive their respective keys and verification data in advance through the INVITE message exchange, allowing the media session to start immediately without additional signaling delays.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If the TBS scheme is used to establish secure media channels in forking call sessions, then media security is achieved, but the KMS experiences greatly increased storage and calculation loads

Engineering Contradiction:
Improvemedia securityVSAvoidKMS calculation load
Core Design Contradiction:
ReliabilityVSPower

Solution Approach 1:

The patent implements local key derivation at each party's endpoint rather than requiring the KMS to generate and manage all media keys centrally. The KMS only generates master keys and verification data, while the actual media keys are locally derived by the calling and called parties using the Otway-Rees protocol, significantly reducing the KMS's calculation and storage burden.

Inventive Principle:
Principle #3Local quality

3Reliability

If traditional SIP forking call session technology is used, then the calling terminal can come to an agreement on media keys with all forked called terminals, but the processing capacity and calculation capacity requirements are quite high

Engineering Contradiction:
Improvekey agreementVSAvoidcalling terminal calculation capacity
Core Design Contradiction:
ReliabilityVSPower

Solution Approach 1:

The patent introduces the KMS as an intermediary that facilitates key agreement between the calling terminal and called terminals. Instead of requiring the calling terminal to independently negotiate keys with multiple called terminals (which is computationally intensive), the KMS mediates the key exchange using the Otway-Rees protocol, allowing the calling terminal to establish secure sessions with multiple parties simultaneously with minimal calculation overhead.

Inventive Principle:
Principle #24Intermediary (Mediator)

4Ease of operation

If a delay mechanism is added to reduce processing load in traditional SIP forking, then the calling terminal's processing load is reduced, but the media stream is not protected by encryption during the delay period resulting in a new delay problem

Engineering Contradiction:
Improveprocessing load reductionVSAvoidmedia session establishment time
Core Design Contradiction:
Ease of operationVSLoss of time

Solution Approach 1:

The patent performs preliminary key establishment and verification during the INVITE message exchange phase, before the actual media stream is established. The calling and called parties exchange encrypted verification data through the KMS in advance, so that when the media session begins, encryption is already in place and no additional delay is required for key negotiation.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2426852B8Method and system for realizing secure forking call session in IP multi-media subsystem
Publication Date: 2015.12.16 ZTE CORP

AI summary

The present invention relates to a method for realizing a secure forking call session, which comprises: performing authentication between a calling party and a KMS or between each called party and the KMS, and acquiring a shared key between the calling party and the KMS or a shared key between each called party and the KMS; generating a random number by the calling party and calling each called party through an IMS; generating a random number by each called party and acquiring a media root key from the KMS; generating a media key, which is shared with the calling party, by each called party according to the media root key and the random number generated by the called party; sending the media root key and the generated random number by a called response party in the called parties, who responds the call, to the calling party through the IMS network; generating a media key identical to that of the called response party by the calling party according to the media root key and the random number generated by the called response party; and performing a secure media session between the calling party and the called response party with the identical media key.