TURN Server Authentication via SIP Channel Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional TURN authentication methods rely on shared static credentials, which are vulnerable to leakage and require two round trips for each allocate operation, and integrating individual credentials per device with backend authentication services is resource-intensive.
Innovation Solution
The proposed solution uses Session Initiation Protocol (SIP) channel discovery to generate and verify cryptographic keys based on shared secret information between endpoints and TURN servers, eliminating the need for shared credentials and reducing resource allocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shared static credentials are used for TURN authentication, then authentication is achieved, but security is compromised due to credential leakage risks
Solution Approach 1:
The patent changes the authentication parameter from shared static credentials to device-specific dynamic credentials. Each device receives unique credentials (username/password or certificate) from the TURN server, eliminating the security risk of shared credential leakage while maintaining authentication functionality.
2Reliability
If digest authentication is used for TURN allocate operations, then authentication is achieved, but communication latency increases due to two round trips
Solution Approach 1:
The patent performs authentication credentials distribution in advance during device onboarding. Devices receive their unique credentials before needing to perform allocate operations, eliminating the need for time-consuming digest authentication round trips during actual TURN operations.
Solution Approach 2:
The patent extracts the authentication process from the allocate operation flow. Authentication credentials are obtained separately during onboarding, allowing allocate operations to proceed without additional authentication round trips, thus reducing communication latency.
3Reliability
If individual credentials per device are implemented, then authentication security is improved, but system complexity increases due to backend integration requirements
Solution Approach 1:
The TURN server autonomously generates and distributes unique credentials to devices during onboarding without requiring integration with external backend authentication services. This self-service approach maintains high authentication security while eliminating the complexity of backend integrations.
Data Source
AI summary
In one embodiment, an endpoint in a network sends a Session Initiation Protocol (SIP) registration request to a device. The device generates a first key using information included in the SIP registration request. The device also writes the first key to a storage location accessible by a Traversal Using Relays around Network address translators (TURN) server. The endpoint generates a second key based on the information included in the SIP registration request. The endpoint sends an allocate request to the TURN server that includes the second key. The TURN server authenticates the endpoint based in part by comparing the second key to the first key. The endpoint receives an allocate response from the TURN server, after the TURN server authenticates the endpoint.