Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
  • H04L63/0281—Proxies

Definitions

• the present invention relates to a method for safe telephony with mobility in a tele and data communications system which includes an IP-network.
• Kerberos ⁇ A known solution of the managing of keys is called Kerberos ⁇ .
• This known solution provides a central distribution of keys and is intended for users of services in networks. Kerberos ® attends to that the user can confirm his/her identity to a given service without risk that anybody is tapping the transmission in order to in a later stage unduly borrow the user's identity.
• an authentication is performed in two steps. In the first step one issues an authentication service (AS) , a so called TGS-ticket in exchange for a person proving that he/she is the person he/she gives himself/herself out to be.
• AS authentication service
• the user identification is made by the user initially once and for all registers himself/herself manually and receives a password from Kerberos ® .
• the password is stored centrally.
• the TGS-ticket includes i.a. a TGS-session key, the name of the service (i.e. TGS), a time stamp and period of validity.
• TGS-session key the name of the service (i.e. TGS)
• TGS-session key the name of the service
• TGS-session key the name of the service
• period of validity i.e.
• the user receives the TGS-ticket encrypted by TGS password and a copy of the TGS-session key encrypted by the user's password.
• the TGS-ticket is valid as access to a ticket issuing service (TGS) .
• TGS ticket issuing service
• the user for that reason turns to TGS to get service tickets to other services.
• the user transmits the TGS-ticket encrypted by TGS password and the name of the service which is asked for to TGS.
• TGS returns a ticket to the service encrypted by the password of the service and a copy of a service session key encrypted by the TGS-session key.
• For each new service the user wants to utilise he/she in the same way turns to said TGS and encloses his/her TGS-ticket in the transmission .
• This known method has several advantages. The user need only give his/her password once per working period.
• Kerberos ® is not directly applicable on IP-telephony with mobility, such as a system with DECT-telephones which have access to an IP- network. For that reason there exists a need for a security solution for such telephony.
• the aim of the present invention consequently is to create a security solution for IP-telephony with mobility.
• Figure 1 diagrammatically shows a tele and data communications system in which an embodiment of the method is implemented
• Figure 2 diagrammatically shows a part of the system in Figure 1 in detail .
• each DECT-telephone 3 an identity code (ID-code) is stored which is created in such a way that it is unique, preferably globally unique.
• ID-code is transmitted to the base station 5 of the domain. From there the ID-code is forwarded to a mobility manager, here a so called proxy manager 9, see Figure 2, which is arranged in an IP-managing unit (IMU) 7.
• the proxy manager 9 starts for each DECT-telephone 3 a proxy 11, i.e. en proxy which represents the DECT-telephone 3 towards the Internet, or any other IP-network.
• the information is collected from a specific initiating database 13, which here is called telephone directory.
• the telephone directory is reached via the IP-network 15.
• Kerberos ® is utilised, and which i.a. is implemented on a server 17, which handles the central distribution of keys.
• the information includes IP-address, the subscriber's user name, and a key for mobile IP.
• the proxy manager 9 is user and the telephone directory 13 the service which shall be used.
• the proxy manager 9 For the proxy manager 9 to receive the information, it consequently must authenticate itself to the AS-part of the server 17 to get a TGS-ticket, and then utilises the identity code as user identity, and then by transmitting the TGS-ticket to the TGS-part of the server 17 receive a service ticket to the telephone directory.
• the information is transmitted well encrypted from the telephone directory 13 to the proxy manager 9, as has been described above.
• the proxy manager 9 then starts a proxy 11 with the information as input data.
• the proxy 11 now has the function of a mobile node. If it should be in a foreign network it will make use of a mobile IP to attend to that traffic which is intended for it is routed to right address.
• This authentication is made by means of an encryption algorithm and a secret key which is shared by the mobile node, i.e. the proxy 11, and the mobility manager in its home network.
• the secret key is the above mentioned key for mobile IP which the proxy manager 9 receivers from the database 13.
• the proxy 11 is preferably compatible with the ITU- standard H.323, which can be utilised according to the following.
• the receiver collects a session key from Kerberos ® and establishes a safe and authenticated channel. After that H.323 follows on.
• the speech is accordingly transmitted encrypted in order that it shall not be possible to tap.
• participants, which are not authorised subscribers in the system are prevented, by the authentication, from making free calls.
• Kerberos ® can be exchanged for another equivalent method which implies equivalent good authentication and encryption.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Mobile Radio Communication Systems (AREA)
• Telephonic Communication Services (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=20411477

Family Applications (1)

Country Status (5)

Families Citing this family (6)

Family Cites Families (4)

• 1998
  • 1998-05-27 SE SE9801871A patent/SE512440C2/sv not_active IP Right Cessation
• 1999
  • 1999-05-12 EP EP99929982A patent/EP1082837A2/de not_active Withdrawn
  • 1999-05-12 WO PCT/SE1999/000814 patent/WO1999062222A2/en not_active Ceased
  • 1999-05-12 EE EEP200000701A patent/EE03893B1/xx not_active IP Right Cessation
• 2000
  • 2000-11-21 NO NO20005868A patent/NO20005868L/no not_active Application Discontinuation

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events