Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
  • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
  • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/12—Applying verification of the received information
  • H04L63/126—Applying verification of the received information the source of the received data

Definitions

• the invention relates to the field of Internet telephony.
• NoIP voice over Internet protocols such as the protocol originating from the International Telecommunications Union (ITU), known as H.323, the SIP protocol (Session Initiation Protocol) from the IETF, ..., as well as all types of residential or corporate telephone network architectures.
• ITU International Telecommunications Union
• SIP protocol Session Initiation Protocol
• Internet telephony services use a certain number of authentication mechanisms for the calling subscriber in order to prevent, in particular, being charged for calls made by unauthorized third parties.
• These authentication techniques can consist of encryption mechanisms by asymmetric cryptography, which use a certificate exchange by public keys and private keys. This technique is based on one-way mathematical functions, that is, functions that are easy to calculate but extremely difficult to reverse.
• the subscriber has a private key. He discloses a public key to his interlocutor. Although the subscriber's private key and public key are closely related, the public key disclosure does not provide any information about the private key. Knowing the subscriber's public key notably allows a remote party to encrypt a message intended for the subscriber.
• Another subscriber authentication mechanism is based on the use of a username and password. Thus, to establish communication, it is necessary to provide a username and password. If these are recognized by an operator's call server, then the establishment of a communication becomes possible.
• These authentication mechanisms are relatively easy to implement with softphones. However, this is not the case. even for telephone terminals used in internet networks. Indeed, not all of these terminals have the possibility of entering a password or of implementing encryption by asymmetric cryptography.
• asymmetric cryptography requires, to be truly effective, to obtain a certificate from a certified body, which is hardly compatible with a deployment of a voice service on the Internet on a large scale, i.e. - say for several million subscribers.
• the object of the invention is therefore to overcome these drawbacks and to provide a method and an installation for checking the identity of a sender of a telephone call on an Internet network, making it possible to control the identity of a sender using a VoIP type telephone terminal, that is to say an Internet telephony terminal, and which is compatible with a development of Internet telephony on a very large scale.
• this method further comprises a step of comparing parameters extracted from the decrypted control code with corresponding information extracted from the call establishment request frame.
• This information which is stored in the database, includes, according to yet another characteristic of this method, a terminal identification address.
• the information is transferred from the terminal to the database during a first call made by the terminal.
• This first call can consist of a call made immediately after the installation of the subscriber's telephone terminal.
• the parameters extracted from the call establishment request frame include the terminal's IP address and the terminal's call number.
• the control code can be produced from an encrypted function of the ⁇ terminal identification address and the IP address of the latter.
• the parameters extracted from the call establishment request frame include the IP address of a gateway connecting a private network to a telecommunications network and the terminal call number.
• the control code is then produced from an encrypted function of the terminal identification address and the gateway IP address.
• the terminal's IP address is transmitted by an Internet service provider to a control module associated with the gateway.
• an installation for controlling the identity of the sender of a telephone call on an Internet network comprising a call management server adapted to cause the establishment of a communication between terminals respectively calling and called telecommunication, according to parameters contained in a communication establishment request frame sent by the calling terminal.
• the management server includes means for decrypting an encrypted control code inserted in the communication establishment request frame, the code containing parameters relating to the identity of the calling telecommunications terminal, and means for comparing the 'at least one parameter extracted from the control code decrypted by the decryption means with a corresponding code stored in- a database hosted in the server to authorize the establishment of the communication according to the result of the comparison.
• the installation further comprises means for comparing parameters extracted from the decrypted control code with corresponding information.
• a telecommunication terminal for control installation as defined above, characterized in that it comprises a control module suitable for the insertion of an encrypted control code in a communication establishment request frame.
• This control module includes means for developing an encrypted function of the terminal identification address and the terminal IP address.
• the control module comprises means for developing an encrypted function of the identification address of the terminal and the IP address of a gateway for connecting a local network to a telecommunications network. public.
• FIG. 1 schematically illustrates the structure of a telecommunications network providing access to a telephony service Internet, provided with an installation for controlling a transmitter of a telephone call and making it possible to implement a control method in accordance with the invention
• FIG. 2 is a detail view of a portion of the network of Figure 1, illustrating a call establishment request sequence
• FIG. 3 is a flowchart illustrating the main phases of the control method according to the invention.
• FIG. 1 there is shown the general architecture of a telecommunications network 10 allowing access to a telephone service on the Internet.
• the network comprises, on the subscriber side, a set of equipment usable by subscribers for establishing telephone communications with remote subscribers.
• FIG. 1 two distinct configurations have been shown, namely a configuration C1 and a configuration C2.
• the first configuration C1 is arranged around a private local network, or LAN network. It includes a set of telecommunication terminals 12, for example constituted by telephones
• NoIP connected to the LAN 14.
• Computer terminals such as 16, constituted for example by microcomputers, can also be connected to the network 14, as is conventional in a private computer network.
• a gateway 24 interconnects the private network, and in particular the LAN network 14 to a public network 20 of a telecommunications operator providing a NoIP telephony service, by means of a modem 22.
• the gateway comprises a control module ensuring, as will be described in detail below, a control of the identity of the sender of a telephone call, that is to say a module capable of controlling that no attempt to spoof the LAN local telephone number has been made by third parties.
• the telephony equipment is constituted by telecommunication terminals, such as 26, in which is integrated the control module. Each terminal 26 communicates with the operator's public network 20 via a modem 28.
• the network comprises, on the one hand, a server 30 providing access to the Internet network and, on the other hand, a call server 32 which exercises, jointly with the control modules, control the identity of the originator of a call and which establishes telephone communications for a subscriber calling according to the result of the control of the transmitter and according to a configuration of services offered by the operator.
• the call server 32 as well as the gateway control module (configuration; C1) or of the terminals (configuration C2) . include all the hardware and software means to control the identity of the originator of a call to verify that a subscriber number has not been usurped by a third party, as will be described in detail by the ' after.
• the call server 32 is associated with a database 34 in which are loaded information relating to the subscribers, such as the identification address of the terminal, also known by the name "MAC address".
• information relating to the subscribers such as the identification address of the terminal, also known by the name "MAC address”.
• such information is loaded into memory in each terminal 12, during its manufacture. They are transferred to the database 34, under the control of the "call server 32, during the first call made from each terminal, that is to say immediately after the installation of the terminal of a subscriber
• the Internet service provider server 30 transmits to the control module of the gateway 24 or to the terminal 26, in the case where the module is integrated into the latter, a public IP address, and this, whenever this address is changed.
• this terminal For the establishment of a NoIP communication on the Internet network 20 from a terminal such as 12, this terminal prepares and then transmits to the call server 32 a frame for requesting establishment of 'call.
• This frame includes a set of fields each conveying information necessary for the establishment of the communication, such as the IP address of the calling terminal or the IP address of the gateway, and the number of the caller and the called party. .
• control module 24 inserts into the call establishment request frame an encrypted message prepared from the address
• the call server 32 proceeds to a decryption of the control code inserted in the frame, to a recovery of the MAC code of identification and the IP address of the calling gateway or terminal, then, on the one hand, a comparison of the MAC address retrieved from the frame sent by the calling terminal with the corresponding MAC address stored in the database data 34 and, on the other hand, the IP address resulting from the decryption of the control code with the IP address conveyed in clear by the frame. In case of correspondence between these data, the call is authorized.
• the call request begins with a first phase 36 during which the terminal 12 transmits the call establishment request frame to the control module.
• This performs a configuration of a specific field in the frame of the control code.
• the control module 24 inserts into the "h323id" field an encrypted function of the MAC address of the IP telephone and of the IP address of the control module.
• the frame is then transmitted to the call server 32 (step 3. 8).
• This comprises a gatekeeper 40, which shares with the control module a dynamic link library or DLL so as to decrypt the control code.
• control module can be carried out by any type of encryption of the conventional type.
• encryption techniques that can be used within the framework of the present description are within the reach of a person skilled in the art and will therefore not be described in detail below. . - •
• the call management server 32 implements service software 44 (step 41), which carries out the actual control, called the call originator so as to authorize the establishment of the call in case of correspondence between the data conveyed by the control code and the data stored in the database 34, on the one hand, and the data conveyed in clear by the communication establishment request frame,
• the service software then transmits the result of the processing to the gatekeeper (step 42). Instructions suitable for authorizing a call can then be transmitted to the control module (step 43) and to the terminal (step 45) in the absence of an attempted fraud.
• a check of the checking function is carried out. If this function is deactivated, communication is authorized (step 47).
• the call server performs a decryption of the control code, that is to say, when the H.323 standard is used, to a decryption of the h323id field so as to extract the identification address of the terminal and the IP address of this terminal or the gateway IP address.
• the call server and in particular the service software performs a comparison of the IP address extracted from the control code with the IP address conveyed in clear by the establishment request frame call. In the event that these addresses do not match, the call request is rejected (step 50). In case of correspondence between these IP addresses, during the step
• the call server 32 checks if a MAC address is present in the database.
• the MAC address obtained after decryption is stored in the database (step 54) and the appeal is allowed.
• the call server 32 performs a comparison of this MAC address with the MAC address resulting from the decryption. If there is a match between these addresses, the call is authorized (step 47). Otherwise, the appeal is dismissed.
• the service software verifies that the IP address of the control module is correct.
• a user subscribed or not, retrieving an IP address from a subscriber to make communications, will not be able to establish a communication. Indeed, after decryption of the control code, the IP address will not correspond to that of the line from which the call is made.
• the service software verifies that the MAC address of the terminal from which the call is made corresponds to the address

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Telephonic Communication Services (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=31985374

Family Applications (1)

Country Status (5)

Families Citing this family (7)

Family Cites Families (5)

• 2002
  • 2002-10-01 FR FR0212132A patent/FR2845226B1/fr not_active Expired - Fee Related
• 2003
  • 2003-09-24 AU AU2003299173A patent/AU2003299173A1/en not_active Abandoned
  • 2003-09-24 WO PCT/FR2003/002808 patent/WO2004032430A2/fr not_active Ceased
  • 2003-09-24 EP EP03798947A patent/EP1547346A2/de not_active Withdrawn
  • 2003-09-24 US US10/529,989 patent/US20060147038A1/en not_active Abandoned

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events