SIP Key Management via Media Layer Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key management systems for Session Initiation Protocol (SIP) face challenges in providing cost-effective and secure key exchange while preserving SIP features, as existing protocols like ZRTP and DTLS-SRTP are costly and complex, and struggle with security issues such as voice clipping and unintended key exchanges.
Innovation Solution
A key management system that employs a signaling layer and a media layer to derive a session key using a pseudorandom function, where a random key is sent over the signaling layer and a random nonce is sent over the media layer, eliminating the need for public-key infrastructure and reducing costs, while ensuring high security and preventing forking issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public-key infrastructure (PKI) is used for key exchange, then security is improved, but cost and computational complexity increase
Solution Approach 1:
The patent extracts the key exchange process from the signaling layer and moves it to the media layer, where it can be performed using simpler symmetric key mechanisms rather than complex public-key infrastructure. This separation allows security to be maintained while reducing computational complexity in the signaling path.
Solution Approach 2:
The patent uses ephemeral symmetric keys for key exchange instead of expensive public-key operations. These temporary keys are generated, used for the exchange, and discarded, providing security at a fraction of the computational cost of PKI while maintaining forward secrecy.
2Reliability
If complex key distribution protocols like ZRTP are implemented, then security is improved, but implementation cost and complexity increase
Solution Approach 1:
The patent segments the key management system into two distinct layers: signaling layer for session establishment and media layer for key exchange. This segmentation allows each layer to use optimized protocols appropriate to its function, reducing overall implementation complexity while maintaining security.
Solution Approach 2:
The patent introduces an intermediary key derivation mechanism that uses the media stream itself as a carrier for key material exchange. This intermediary approach simplifies the key distribution process by leveraging existing media infrastructure rather than requiring complex dedicated key management protocols.
3Adaptability or versatility
If keys are exchanged over the signaling layer, then protocol integration is improved, but security against unintended key exchange deteriorates
Solution Approach 1:
The patent moves the key exchange operation from the traditional signaling dimension to the media dimension. By embedding key exchange within the media stream rather than the signaling protocol, it achieves both goals: maintains protocol integration benefits while adding a new dimension for secure key transfer that is isolated from signaling-layer attacks.
4Adaptability or versatility
If SIP forking is allowed, then user reachability is improved, but key exchange security deteriorates due to unintended parties
Solution Approach 1:
The patent performs preliminary authentication and key agreement before the forking process begins. By establishing secure keys upfront in the media layer before SIP forking distributes the request to multiple destinations, it ensures that only the intended recipient can successfully complete the key exchange, preventing unintended parties from obtaining session keys.
Data Source
Figure 1~2
Figure 3~4
AI summary
A system for providing cost effective, secure key exchange from at least one first device to at least one second device through at least one proxy server is provided. The system includes a first key exchange message from the at least one first device to the at least one second device via the at least one proxy server. A second key exchange message from the at least one second device to the at least one first device via a media stream of the Internet is required to complete the computation of the session key. A method of securing a communication system is also set forth. The method includes the steps of providing a routing device for identifying a subscriber, and providing a master key exchange session, the master key exchange session including a key k to find a subscriber and a nonce r to answer a query to the subscriber, wherein the master key exchange session includes both the key k and the nonce r.