SIP Invite Endpoint Security via Encrypted Identifier Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing phone call systems are vulnerable to deceptive calls where a calling device intentionally spoofs a phone number not associated with it, leading to identity deception, and current security measures like STIR/SHAKEN primarily label such calls rather than preventing them.
Innovation Solution
The system generates or modifies a Session Initiation Protocol (SIP) invite message to include an encrypted identifier for the calling device, which is decrypted and queried against a database correlating phone numbers and identifiers, determining whether to forward or reject the call based on correlation, thereby securing the endpoint computing device and preventing spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If phone spoofing is allowed for free communication, then ease of operation is improved, but reliability deteriorates due to identity deception
Solution Approach 1:
The system performs preliminary verification by embedding the calling device's identifier in the SIP invite message before the call is established. The network computing device decrypts and verifies this identifier against the phone number in the message header, preventing spoofing before the call connects rather than detecting it afterward.
Solution Approach 2:
The network computing device acts as an intermediary between the calling device and the called device. It intercepts the SIP invite message, verifies the correlation between the encrypted identifier and phone number through database lookup, and either forwards or rejects the message based on verification results, thereby securing the communication without requiring changes to endpoint devices.
2Reliability
If encryption is applied to protect identifier, then reliability is improved, but device complexity increases
Solution Approach 1:
The system extracts the verification function from the endpoint devices and concentrates it in the network computing device. The calling device simply embeds its identifier without needing to perform encryption or verification operations. The network computing device handles the decryption and database lookup, reducing complexity at the endpoints while maintaining security.
Solution Approach 2:
The system uses the existing SIP invite message structure as a carrier for the encrypted identifier verification. Rather than creating a new complex protocol, the solution copies and extends the existing message format to include the encrypted identifier field, leveraging the familiar SIP framework to reduce implementation complexity.
Data Source
AI summary
Disclosed herein is phone call endpoint security. In particular, the embodiments provide a mechanism to generate or modify a Session Initiation Protocol (SIP) invite message to include a phone number and an encrypted identifier that identifies a calling device. A network computing device decrypts the encrypted identifier and queries a database that correlates phone numbers to identifiers. The network computing device determines to forward or reject the SIP invite message based on whether the identifier and the phone number in the SIP invite message are correlated to one another in the database. Accordingly, the endpoint is secured, and calling devices are blocked from attempting to make deceptive phone calls from phone numbers not known to be associated with the calling device.