WO2009155765A1 - 基于分叉的认证方法及系统以及分叉认证装置 - Google Patents

基于分叉的认证方法及系统以及分叉认证装置 Download PDF

Info

Publication number
WO2009155765A1
WO2009155765A1 PCT/CN2008/073532 CN2008073532W WO2009155765A1 WO 2009155765 A1 WO2009155765 A1 WO 2009155765A1 CN 2008073532 W CN2008073532 W CN 2008073532W WO 2009155765 A1 WO2009155765 A1 WO 2009155765A1
Authority
WO
WIPO (PCT)
Prior art keywords
source device
call request
authentication
receiving
network element
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2008/073532
Other languages
English (en)
French (fr)
Inventor
韦银星
滕志猛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Priority to US13/120,207 priority Critical patent/US8914861B2/en
Priority to EP08874764.7A priority patent/EP2337302A4/en
Publication of WO2009155765A1 publication Critical patent/WO2009155765A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1069—Session establishment or de-establishment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1083—In-session procedures
    • H04L65/1094—Inter-user-equipment sessions transfer or sharing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1101—Session protocols
    • H04L65/1104—Session initiation protocol [SIP]

Definitions

  • the present invention relates to the field of communications, and in particular to a bifurcation-based authentication method, system, and bifurcation authentication apparatus.
  • BACKGROUND In a Session Initiation Protocol SIP
  • a call can be sent to multiple locations, but regardless of where the receiver is, the caller can always find the receiver, the ability of SIP. It is easy to implement multi-party calls, one-number service, call forwarding service, etc. in the telecommunication network.
  • SIP fork Formking
  • the SIP fork means: The proxy server sends the SIP request to multiple locations, and the response is returned to the sender.
  • SIP supports sequential forks and parallel forks.
  • the Next Generation Network (NGN) is based on the Internet 10 (Internet Protocol, IP for short) technology. Due to the insecurity of the IP network, NGN is facing security compared with the traditional telecommunication network. Threat. Among them, the authentication mechanism is used to confirm the identity of the subject and to prevent security threats such as counterfeiting.
  • the recipient of the message may want to know the identity of the sender of the message, for example, the identity of the spammer, so that the recipient of the message needs to authenticate the sender of the message.
  • the identity of the sender of the message for example, the identity of the spammer
  • no technical solution to solve the above problems has been proposed.
  • SUMMARY OF THE INVENTION The present invention has been made in view of the problem that a receiving device cannot perform fork authentication for a source device.
  • the main object of the present invention is to provide a fork-based authentication scheme to fill the gap in the prior art.
  • a fork-based authentication method is provided, the authentication method involving authentication of a source device by at least two receiving devices.
  • the bifurcation-based authentication method includes: respectively setting an authentication credential on the receiving device and the source device; after receiving the call request from the source device, the bifurcation network element bifurcates the call request and splits the fork The subsequent call request is sent to the corresponding receiving device; the forked network element receives the challenge value from the plurality of receiving devices, and forwards the plurality of challenge values to the source device; the forked network element receives the call request resent from the source device, The resent call request carries the relevant authentication credential; the forked network element bifurcates the resent call request, and sends the forked call request to the corresponding receiving device, so that the receiving device according to the authentication credential The source device is authenticated.
  • the foregoing authentication credential comprises at least one of the following: a pre-shared key, a digital certificate.
  • the foregoing split network element is a serving call session control function device, and the receiving device is a next generation network element and/or a terminal device after the forked network element.
  • the forwarding of the multiple challenge values to the source device is as follows: The forked network element aggregates multiple challenge values sent by multiple receiving devices into the fork request response, and sends the fork request response to the source device.
  • the method before the foregoing split network element receives the call request resent from the source device, the method further includes: the source device provides different authentication credentials for different challenge values; the source device aggregates different authentication credentials in the call request, And resend the call request.
  • a fork-based authentication system comprising at least two receiving devices.
  • the bifurcation-based person identification system comprises: a setting module, configured to separately set an authentication credential on the receiving device and the source device; and a forked network element, configured to: after receiving the call request from the source device, to call Requesting to perform bifurcation, sending to a corresponding receiving device, and forwarding multiple challenge values sent by multiple receiving devices to the source device; the source device, for sending a call request, and resending after receiving multiple battle values Calling the request, and carrying the relevant authentication credential in the resent call request; the receiving device, after receiving the resent call request, according to the authentication credential Certification of paired source devices.
  • a bifurcation authentication device located at a source device.
  • the bifurcation authentication device includes: a setting module, configured to set an authentication credential; a sending module, configured to send a call request; a receiving module, configured to receive a challenge value from the bifurcated network element; and a retransmission module, configured to A call request is sent, and an authentication credential corresponding to the challenge value is carried in the call request.
  • a bifurcation authentication device located at a receiving device.
  • the bifurcation authentication apparatus includes: a setting module, configured to set an authentication credential; and a sending module, configured to send a challenge value to the source device by using the bifurcated network element after receiving the call request from the source device;
  • the module is configured to: after receiving the call request resent by the source device, complete the authentication of the source device according to the authentication credential carried in the resent the call request.
  • FIG. 2 is a block diagram of a bifurcation authentication apparatus according to Embodiment 1 of the apparatus of the present invention
  • FIG. 3 is a bifurcation of Embodiment 2 of the apparatus according to the present invention
  • a block diagram of the authentication device 4 is a signaling flow chart of detailed processing of Example 1 according to an embodiment of the present invention
  • FIG. 5 is a signaling flow chart of detailed processing of Example 2 according to an embodiment of the present invention
  • FIG. 6 is a flowchart based on an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a system for a fork request according to an embodiment of the present invention
  • FIG. 8 is a schematic diagram of a system based on SIP request fork according to an embodiment of the present invention.
  • DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention provides a bifurcation-based authentication scheme, in which the receiving device and the source device are used, in view of the fact that the receiving device cannot perform the bifurcation authentication of the source device.
  • the branching network element bifurcates the call request from the source device, and sends the forked call request to the corresponding receiving device, and the forked network element receives the challenge value from the multiple receiving devices, and Forwarding the plurality of challenge values to the source device, and the forked network element receives the call request resent from the source device, where the retransmitted call request carries the relevant authentication credential; the forked network element subdivides the resent call request The fork sends the forked call request to the corresponding receiving device, so that the receiving device authenticates the source device.
  • the forked network element may be a serving call session control function device
  • the receiving device may be a next generation network element and/or terminal device located downstream of the forked network element.
  • Method Embodiment a fork-based authentication method is provided, which involves two receiving devices authenticating a source device.
  • 1 is a flowchart of a fork-based authentication method according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps S102 to S110: Step S102, respectively, setting an authentication credential on the receiving device and the source device.
  • the authentication credentials used in the embodiments of the invention include, but are not limited to, a pre-shared key, a digital certificate, etc.;
  • the verification process may be implemented.
  • Step S104 After receiving the call request from the source device, the forked network element bifurcates the call request.
  • the fork may be a sequential fork or a fork.
  • Step S106 the split network element receives the challenge value from the multiple receiving devices, and forwards the multiple challenge values to the source device, specifically
  • the branching network element may aggregate multiple challenge values sent by multiple receiving devices in the fork request response and send the fork request response to the source device; on the source device side, after receiving the fork request response, the source The device provides different authentication credentials for different challenge values, and aggregates different authentication credentials into the fork request, and then resends the fork request after the aggregation operation;
  • Step S108 the forked network element receives the resend from the source device.
  • Step S110 the forked network element requests the resent call Bifurcation, and sends the call request to the receiving apparatus corresponding to the bifurcation, so that the receiving device authenticates the source device according to the authentication credentials.
  • the receiving device may perform a decryption operation on the received authentication credential using a locally set digital certificate. If the decryption succeeds, the authentication passes, otherwise, the authentication fails.
  • a bifurcation-based authentication method is provided, and the authentication of the source device by the receiving device can be implemented.
  • Apparatus Embodiment 1 In this embodiment, a bifurcation authentication apparatus is provided, which is located in a source device.
  • the method includes: a setting module 20, a transmitting module 22, a receiving module 24, and a retransmission module 26.
  • the following structure is Describe. a setting module 20, configured to set an authentication credential; a sending module 22, configured to send a call request; a receiving module 24, configured to receive a challenge value from the forked network element; and a retransmission module 26, configured to resend the call request, and The call request carries an authentication credential corresponding to the challenge value.
  • the retransmission module can be combined with the setup module transmission module to implement the first transmission and retransmission functions.
  • the network element for example, the above-mentioned source device
  • the above-mentioned bifurcation authentication device is also within the protection scope of the present invention.
  • Device embodiment 2 In this embodiment, a bifurcation authentication device is provided, located at a receiving device.
  • 3 is a block diagram of a bifurcation authentication apparatus according to a second embodiment of the apparatus according to the present invention. As shown in FIG. 3, the method includes: a setting module 30, a transmitting module 32, and an authentication module 34. The above structure will be described below.
  • the setting module 30 is configured to set the authentication credential; the sending module 32 is configured to send a challenge value to the source device by using the forked network element after receiving the call request from the source device; and the authentication module 34 is configured to receive the source device After the resend call request, the authentication of the source device is completed according to the authentication credential carried in the resent call request.
  • the next generation network element and/or the terminal device for example, the above-mentioned receiving device
  • the forked network element including the above-mentioned bifurcation authentication device are also within the protection scope of the present invention.
  • a fork-based authentication system is provided, the system including at least two receiving devices.
  • FIG. 4 is a block diagram of a fork-based authentication system according to an embodiment of the present invention.
  • the system includes: a processor 2, a forked network element 4, a source device 6, and a receiving device 8.
  • the structure is described.
  • the processor 2 is configured to separately set an authentication credential on the receiving device and the source device, where the processor may be set independently, or may be located on the side of the forked network element, or may be located in the source device or the receiving device, even if it is located in another suitable device.
  • the invention may also be implemented in a network element.
  • the processor 2 may also store the set authentication credential through a storage medium, where the “storage medium” may represent one or more devices for storing data, including read-only. Memory (ROM), random access memory (RAM), magnetic RAM, magnetic core memory, magnetic disk storage media, optical storage media, flash memory devices, and/or other machine readable media for storing information.
  • ROM read-only. Memory
  • RAM random access memory
  • magnetic RAM magnetic core memory
  • magnetic disk storage media magnetic disk storage media
  • optical storage media optical storage media
  • flash memory devices and/or other machine readable media for storing information.
  • machine-readable medium includes, but is not limited to, portable or fixed storage devices, optical storage devices, wireless channels, or various other mediums capable of storing, containing, or carrying instructions and/or data.
  • the forked network element 4 is configured to implement a fork function to implement information or data interaction between the source device and the sink device.
  • the forked network element 4 branches the call request and sends the forked call request to the corresponding receiving device; Receiving the direction of the device to the source device, the branching network element 4 receives multiple challenge values from the plurality of receiving devices, and forwards the multiple challenge values to the source device; thereby implementing interaction between the source device and the target device.
  • the source device 6 is mainly used for sending a call request (transmission module 60), and after receiving the challenge value from the receiving device (receiving module 62), resending the call request (calling the sending module 60), and resending the call
  • the request carries the relevant authentication credential for the receiving device to perform subsequent authentication on the source device.
  • the receiving device 8 is mainly configured to receive a call request from the source device (the receiving module 80), and send a challenge value based on the call request (send module) 82), can also receive a call request source apparatus in response thereto to re-challenge values transmitted (receiving module 80), and authentication (identity module of the source device 84 according to the authentication credential) 0
  • the authentication system can realize the authentication of the source device by the receiving device.
  • Example 1 Hereinafter, a method embodiment and a system embodiment of the above technology will be described in detail with reference to the accompanying drawings.
  • FIG. 5 shows a schematic diagram of request bifurcation. As shown in FIG.
  • TE (Terminal Equipment) A 50 is a source device that initiates a request, and TE B 54 and TE C 56 register a contact address in the NE, which is received.
  • the device, NE 50 Network Element
  • the information received by the NE 30 may be sent by the terminal device or may be sent by other network element devices.
  • TE B 54 and TE C 56 authenticate TE A 50.
  • FIG. 6 the processing flow shown in FIG. 6 will be described in conjunction with the above-described bifurcation-based authentication system. As shown in FIG.
  • Step S602 TE A 60 initiates with NE 62 a request for communication by a user; step S604, the NE 62 sends a branch that branches the request to the receiving device TE B 64 according to the contact address registered by the user; step S606, the NE 62 is based on the contact address registered by the user, Sending another branch after the request is forked to the receiving device TE C 66; in step S608, the TE B 64 sends a response including the war value to the TE A 60; Step S610, the TE C 66 sends a response including the war value to the TE A 60.
  • step S612 the NE 62 combines the responses in step S608 and step S610 into one response, and returns to the TE A 60.
  • step S614 the TE A 60 receives the response.
  • the response value in the response and the supported security algorithm respectively construct a response; in step S616, the NE 62 branches the response, sends a branch to the TE B 64, and completes the TE A 60 authentication at the TE B 64; S618, NE 62 forks the response, sends another branch to TE C 66, and completes TE A 60 authentication at TE C 66.
  • FIG. 7 shows a schematic diagram of a forked request based on a SIP request in an NGN.
  • the Proxy Call Session Control Function Entity (Proxy CSC-FE, abbreviated as P-CSC-FE) 71, 76 is responsible for maintaining the integrity and confidentiality protection of the security association and SIP signaling.
  • the service call session control function entity (Service CSC-FE, S-CSC-FE for short) 72, 75 is responsible for processing the registration process, performing route judgment, maintaining session state, and storing service configuration.
  • Service CSC-FE Service CSC-FE, S-CSC-FE for short
  • I-CSC-FE Interrogating CSC-FE
  • Step S802 registering the contact address of the user 1, and the TE A 80 passes the P-CSC-FE 81 to
  • the S-CSC-FE 82 sends a registration request; in step S804, the S-CSC-FE 82 returns a registration success response to the TE A 80; Steps S806-S612, through the P-CSC-FE 86, simultaneously register the two contact addresses TE-B 87 and TE-C 88 of the user 2 in the S-CSC-FE 85; Step S814, the user 1 passes the TE A 80 User 2 initiates an INVITE request, and the request arrives at I-CSC-FE 83 after passing through P-CSC-FE 81 and S-CSC-FE 82; Step S816, I-CSC-FE 83 queries SUP-FE 84 to obtain user 2 corresponding S-CSC-FE
  • Step S818, the I-CSC-FE 83 sends the INVITE request to the next hop S-CSC-FE 86, and the user 2 registers in the S-CSC-FE 85; Step S820, after the fork, will The INVITE request on one branch is sent to the TE B 87 through the P-CSC-FE 86; in step S822, after the fork, the INVITE request on the other branch is sent to the TE B 88 through the P-CSC-FE 86; Step S824- Step S826, TE B 87 and TE C 88 respectively initiate a non-Manit rights (401 UNAUTHORIZED) response to authenticate the initiator of the INVITE, the response includes the supported security algorithm and the challenge value, and the response is sent to the P-CSC-FE 86.
  • 401 UNAUTHORIZED non-Manit rights
  • S-CSC-FE 85 S-CSC-FE 85; Step S828, S-CSC-FE 85 aggregates the responses of the two non-Mann rights into one response, and then sends them to the I-CSC-FE 83; Step S830, I-CSC-FE 83 queries SUP-FE34, the address of the S-CSC-FE 82 corresponding to the user 1 is obtained; in step S832, the S-CSC-FE 82 sends a 401 UNAUTHORIZED response to the TE A 80; in step S834, the TE A 80 is connected to the 401 UNAUTHORIZED response. According to the security algorithms and challenge values provided in TE B 87 and TE C 88, the voucher is used to calculate the response value.
  • Step S836-Step S8308 the INVITE request is sent to the S-CSC-FE 85, and then forwarded to the TE B 87 and the TE C 88 respectively, and in the terminal device
  • the TEA 80 authentication is completed; at this point, the authentication process based on the SIP request bifurcation in the NGN is completed.
  • Steps S840 to S856 shown in FIG. 8 are similar to the normal SIP session establishment process, and are not repeated here.
  • the message involved in step S844 and step S846 is an acknowledgement (ACK) message
  • the message involved in step S850 and step S854 is an end (BYE) message
  • BYE end
  • the 180 Ringing step in the process of establishing Through the above process, the receiving device authenticates the upstream device when the SIP request is forked.
  • the receiving device can authenticate the source device in the case of SIP signaling.
  • the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices.
  • the invention is not limited to any specific combination of hardware and software.
  • the above is only the preferred embodiment of the present invention, and is not intended to limit the present invention.
  • the present invention can be variously modified and modified. Any modifications, equivalent substitutions, improvements, etc. made therein are intended to be included within the scope of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Multimedia (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)

Description

基于分叉的认证方法及系统
以及分叉认证装置
技术领域 本发明涉及通信领域， 具体而言， 涉及一种基于分叉的认证方法、 系统 以及分叉认证装置。 背景技术 在会话初始十办议 （Session Initiation Protocol , 简称为 SIP ) 中， 一个呼 叫可以被发送到多个地点， 但是无论接收方在哪里， 呼叫者总是能够找到接 收方， SIP 的这种能力易于实现电信网络中的多方通话、 一号通业务、 呼叫 前转业务等。 SIP分叉 （Forking ) 可以实现无论接收方在哪里， 呼叫者总是 能够找到接收方的这个功能， SIP分叉是指： 代理服务器把 SIP请求发送给 多个位置， 并 响应返回给发送方。一^:地， 分叉分为顺序分叉和并行分叉， 前者是指代理服务器逐个联系不同的接收方， 后者是指代理服务器同时联系 不同的接》 方， 与顺序分叉相比， 并行分叉可以减少会话建立的时间。 SIP 支持顺序分叉和并行分叉。 下一 4弋网络 ( Next Generation Network, 简称为 NGN ) 基于互联网十办 iSL ( Internet Protocol , 简称为 IP ) 的技术， 由于 IP网络的不安全性， 与传统 的电信网络相比， NGN面临着安全威胁。 其中， 认证机制用以确认主体的身 份， 可以防止假冒之类的安全威胁。 在某些情况下， 消息的接收方可能想知 道消息发送方的身份， 例如， 垃圾信息制造者的身份， 这样， 消息的接收方 就需要对消息的发送方进行认证。 但是， 在下一代网络中， 对于 SIP信令分叉的情况， 不能支持电信网络 中某些业务 （例如， 多方通话、 一号通、 呼叫前转） 的认证， 也不能识别发 送方的身份。 目前尚未提出解决上述问题的技术方案。 发明内容 考虑到接收设备无法对源设备进行分叉认证的问题而提出本发明， 为 此， 本发明的主要目的在于提供一种基于分叉的认证方案， 以填补目前技术 中的该项空缺。 为了实现上述目的， 才艮据本发明的一个方面， 提供了一种基于分叉的认 证方法， 该认证方法涉及至少两个接收设备对源设备进行的认证。 根据本发明的基于分叉的认证方法包括：在接收设备和源设备上分别设 置认证凭证； 分叉网元在接收到来自源设备的呼叫请求后， 将呼叫请求进行 分叉， 并把分叉后的呼叫请求发送到对应的接收设备； 分叉网元接收来自多 个接收设备的挑战值， 并将多个挑战值转发到源设备； 分叉网元接收来自源 设备重新发送的呼叫请求， 其中， 重新发送的呼叫请求中携带相关认证凭证； 分叉网元将重新发送的呼叫请求进行分叉， 并将分叉后的呼叫请求发送到对 应的接收设备， 以使接收设备根据认证凭证对源设备进行认证。 优选地， 上述认证凭证包括以下至少之一： 预共享密钥、 数字证书。 优选地， 上述分叉网元为服务呼叫会话控制功能设备， 上述接收设备为 在分叉网元之后的下一代网络网元和 /或终端设备。 其中， 将多个挑战值转发到源设备具体为： 分叉网元将多个接收设备发 送的多个挑战值聚合在分叉请求响应中， 并将分叉请求响应发送到源设备。 此外， 在上述分叉网元接收来自源设备重新发送的呼叫请求之前， 上述 方法还包括： 源设备对不同的挑战值提供不同的认证凭证； 源设备将不同的 认证凭证聚合在呼叫请求中， 并重新发送呼叫请求。 根据本发明的另一方面， 提供了一种基于分叉的认证系统， 该认证系统 包括至少两个接收设备。 根据本发明的基于分叉的人证系统包括： 设置模块， 用于在接收设备和 源设备上分别设置认证凭证； 分叉网元， 用于在接收到来自源设备的呼叫请 求后， 将呼叫请求进行分叉， 发送到对应的接收设备， 并将多个接收设备发 送的多个挑战值转发到源设备； 源设备， 用于发送呼叫请求， 以及在接收到 多个 战值后， 重新发送呼叫请求， 并在重新发送的呼叫请求中携带相关认 证凭证； 接收设备， 用于在接收到重新发送的呼叫请求后， 根据认证凭证完 成对源设备的认证。 此夕卜， 上述分叉网元还用于接收来自源设备重新发送的呼叫请求。 根据本发明的再一方面， 提供了一种分叉认证装置， 该分叉认证装置位 于源设备。 根据本发明的分叉认证装置包括： 设置模块， 用于设置认证凭证； 发送 模块， 用于发送呼叫请求； 接收模块， 用于接收来自分叉网元的挑战值； 重 发模块， 用于重发呼叫请求， 并在呼叫请求中携带与挑战值对应的认证凭证。 根据本发明的再一方面， 还提供了一种分叉认证装置， 该分叉认证装置 位于接收设备。 根据本发明实施例的分叉认证装置包括：设置模块，用于设置认证凭证； 发送模块， 用于在接收到来自源设备的呼叫请求后， 通过分叉网元向源设备 发送挑战值； 认证模块， 用于在接收到源设备重新发送的呼叫请求后， 根据 重新发送的呼叫请求中携带的认证凭证完成对源设备的认证。 借助于本发明的技术方案，釆用在接收设备和源设备上分别设置认证凭 证的方法， 解决了目前接收设备无法对源设备进行分叉认证的问题， 能够实 现基于 SIP信令分叉的情况下， 接收设备对源设备的认证。 本发明的其它特征和优点将在随后的说明书中阐述， 并且， 部分地从说 明书中变得显而易见， 或者通过实施本发明而了解。 本发明的目的和其他优 点可通过在所写的说明书、 权利要求书、 以及附图中所特别指出的结构来实 现和获得。 附图说明 附图用来提供对本发明的进一步理解， 并且构成说明书的一部分， 与本 发明的实施例一起用于解释本发明， 并不构成对本发明的限制， 在附图中： 图 1是根据本发明实施例的基于分叉的认证方法的流程图； 图 2是才艮据本发明装置实施例一的分叉认证装置的框图； 图 3是才艮据本发明装置实施例二的分叉认证装置的框图； 图 4是根据本发明实施例的实例 1的详细处理的信令流程图； 图 5是根据本发明实施例的实例 2的详细处理的信令流程图； 图 6是根据本发明实施例的基于分叉的认证系统的框图； 图 7是才艮据本发明实施例的分叉请求的系统示意图； 图 8是根据本发明实施例的基于 SIP请求分叉的系统示意图。 具体实施方式 功能相无述 考虑到目前接收设备无法对源设备进行分叉认证的问题，本发明实施例 提供了一种基于分叉的认证方案， 在该方案中， 在接收设备和源设备上分别 设置认证凭证， 分叉网元将来自源设备的呼叫请求进行分叉， 并将分叉后的 呼叫请求发送到对应的接收设备，分叉网元接收来自多个接收设备的挑战值， 并将多个挑战值转发到源设备， 分叉网元接收来自源设备重新发送的呼叫请 求， 其中， 重新发送的呼叫请求中携带有相关认证凭证； 分叉网元将重新发 送的呼叫请求进行分叉， 并将分叉后的呼叫请求发送到对应的接收设备， 以 使接收设备 #居认证凭证对源设备进行认证。 需要说明的是， 在不冲突的情况下， 本申请中的实施例及实施例中的特 征可以相互组合。 以下结合附图对本发明的优选实施例进行说明，应当理解， 此处所描述的优选实施例仅用于说明和解释本发明， 并不用于限定本发明。 在本发明中， 如果没有特别说明， 则分叉网元可以是服务呼叫会话控制 功能设备，接收设备可以是位于分叉网元下游的下一代网络网元和 /或终端设 备。 方法实施例 在本实施例中， 提供了一种基于分叉的认证方法， 涉及两个接收设备对 源设备进行认证。图 1是根据本发明实施例的基于分叉的认证方法的流程图， 如图 1所示， 包括以下的步骤 S102至步骤 S110: 步骤 S102, 在接收设备和源设备上分别设置认证凭证， 本发明实施例 中使用的认证凭证包括但不限于预共享密钥、 数字证书等； 借助于该认证凭 证， 可以实现后续的认证过程； 步骤 S104, 分叉网元在接收到来自源设备的呼叫请求后， 将呼叫请求 进行分叉， 如上所述， 这里的分叉可以是顺序分叉， 也可以是并行分叉， 并 将分叉后的呼叫请求发送到对应的接收设备； 步骤 S106, 分叉网元接收来自多个接收设备的挑战值， 并将多个挑战 值转发到源设备， 具体地， 分叉网元可以将多个接收设备发送的多个挑战值 聚合在分叉请求响应中， 并将分叉请求响应发送到源设备； 在源设备侧， 接 收到分叉请求响应后， 源设备对不同的挑战值提供不同的认证凭证， 并将不 同的认证凭证聚合在分叉请求中， 之后， 重新发送聚合操作后的分叉请求； 步骤 S108 , 分叉网元接收来自源设备重新发送的呼叫请求， 其中， 该 重新发送的呼叫请求中携带有相关认证凭证； 步骤 S110, 分叉网元对重新发送的呼叫请求进行分叉， 并将分叉后的 呼叫请求发送到对应的接收设备， 以使接收设备根据认证凭证对源设备进行 认证。 例如， 接收设备可以使用本地设置的数字证书对接收到的认证凭证进 行解密操作， 如果解密成功， 则认证通过， 否则， 认证失败。 通过该实施例， 提供了基于分叉的认证方法， 可以实现接收设备对源设 备的认证。 装置实施例一 在本实施例中， 提供了一种分叉认证装置， 位于源设备。 图 2是才艮据本 发明装置实施例一的分叉认证装置的框图，如图 2所示， 包括：设置模块 20、 发送模块 22、 接收模块 24、 重发模块 26, 下面对上述结构进行描述。 设置模块 20, 用于设置认证凭证； 发送模块 22, 用于发送呼叫请求； 接收模块 24, 用于接收来自分叉网元的挑战值； 重发模块 26, 用于重发呼 叫请求， 并在呼叫请求中携带与挑战值对应的认证凭证。 该重发模块可以和 设置模块发送模块合一设置来实现首次发送和重传功能。 需要说明的是， 包括上述分叉认证装置的网元 （例如， 上述的源设备） 同样在本发明的保护范围之内。 装置实施例二 在本实施例中， 提供了一种分叉认证装置， 位于接收设备。 图 3是才艮据 本发明装置实施例二的分叉认证装置的框图， 如图 3所示， 包括： 设置模块 30、 发送模块 32、 认证模块 34, 下面对上述结构进行描述。 设置模块 30, 用于设置认证凭证； 发送模块 32, 用于在接收到来自源 设备的呼叫请求后， 通过分叉网元向源设备发送挑战值； 认证模块 34, 用于 在接收到源设备重新发送的呼叫请求后， 根据重新发送的呼叫请求中携带的 认证凭证完成对源设备的认证。 需要说明的是，包括上述的分叉认证装置的分叉网元之后的下一代网络 网元和 /或终端设备（例如， 上述的接收设备）同样在本发明的保护范围之内。 系统实施例 在本实施例中， 提供了一种基于分叉的认证系统， 该系统包括至少两个 接收设备。 图 4是根据本发明实施例的基于分叉的认证系统的框图， 如图 4 所示， 该系统包括： 处理器 2、 分叉网元 4、 源设备 6、 接收设备 8 , 下面对 上述结构进行描述。 处理器 2, 用于在接收设备和源设备上分别设置认证凭证， 该处理器可 以独立设置， 也可以位于分叉网元侧， 还可以位于源设备或接收设备中， 即 使位于其他合适的设备或网元中， 也可以实现本发明。 需要说明的是， 处理器 2在设置认证凭证过程中， 还可以通过存储介质 将设置的认证凭证存储， 这里的 "存储介质" 可以表示用于存储数据的一种 或多种装置， 包括只读存储器（ ROM )、 随机存取存储器（ RAM )、 磁 RAM, 磁心存储器、 磁盘存储介质、 光存储介质、 闪存装置和 /或用于存储信息的其 他机器可读介质。 术语 "机器可读介质" 包括但不限于便携式或固定存储装 置、 光存储装置、 无线通道或能够存储、 容纳、 或承载指令和 /或数据的各种 其他介质。 分叉网元 4, 用于实现分叉功能， 实现源设备与接收设备之间的信息或 数据的交互。 例如， 对于源设备到接收设备的方向， 分叉网元 4在接收到来 自源设备的呼叫请求后， 将呼叫请求进行分叉， 并将分叉后的呼叫请求发送 到对应的接收设备； 对于接收设备到源设备的方向， 分叉网元 4接收来自多 个接收设备多个挑战值， 并将该多个挑战值转发到源设备； 从而实现源设备 与目标设备的交互。 源设备 6 , 主要用于发送呼叫请求 （发送模块 60 ) , 以及在接收到来自 接收设备的挑战值后（接收模块 62 ),重新发送呼叫请求（调用发送模块 60 ), 并在重新发送的呼叫请求中携带相关认证凭证， 用于接收设备对源设备进行 后续的认证； 接收设备 8 , 主要用于接收来自源设备的呼叫请求 (接收模块 80 ), 并 基于该呼叫请求发送挑战值 （发送模块 82 ), 还可以接收源设备响应于其挑 战值而重新发送的呼叫请求 （接收模块 80 ), 并根据认证凭证对源设备进行 认证 (认证模块 84 )0 通过该实施例， 提供了基于分叉的认证系统， 可以实现接收设备对源设 备的认证。 实例 1 下面，结合附图，对上述技术的方法实施例和系统实施例进行详细说明。 图 5示出了请求分叉的示意图， 如图 5所示， TE ( Terminal Equipment, 终端设备 ) A 50是发起请求的源设备， TE B 54和 TE C 56在 NE中登记联 系地址， 是接收设备， NE 50 ( Network Element, 网元设备 )对来自 TE A 50 的请求进行分叉后， 发送到 TE B 54和 TE C 56。 并且， NE 30接收的信息可 以由终端设备发送， 也可以由其他网元设备发送。 TE B 54和 TE C 56接收 到请求后， 对 TE A 50进行认证。 下面， 结合上述的基于分叉的认证系统来描述图 6示出的处理流程。 如 图 6所示， 相同用户身份的两个设备 TE B 64和 TE C 66首先在 NE 62中登 记联系地址， 之后， TEA 60发起呼叫， 具体地： 步骤 S602 , TE A 60通过 NE 62发起与某个用户通讯的请求； 步骤 S604, NE 62根据该用户注册的联系地址， 将对请求进行分叉后 的一个分支发送到接收设备 TE B 64; 步骤 S606 , NE 62根据用户注册的联系地址， 将请求分叉后的另一个 分支发送到接收设备 TE C 66; 步骤 S608 , TE B 64向 TE A 60发送包含 战值的响应； 步骤 S610, TE C 66向 TE A 60发送包含 战值的响应； 步骤 S612, NE 62将步骤 S608和步骤 S610中的响应组合成一个响应， 返回到 TE A 60; 步骤 S614, TE A 60根据收到的响应中的挑战值和支持的安全算法， 分 别构造响应； 步骤 S616, NE 62将响应进行分叉， 将一个分支发送到 TE B 64, 在 TE B 64完成对 TE A 60的认证； 步骤 S618 , NE 62把响应进行分叉， 将另一个分支发送到 TE C 66, 在 TE C 66完成对 TE A 60的认证。 优选地， 在 TE B 64和 TE C 66认证成功后， 向 NE 42返回认证成功与 否消息，以使 TE A 60与通过认证的设备 ( TE B 64和 /或 TE C 66 )建立会话。 实例 2 图 7示出了 NGN中基于 SIP请求分叉时的示意图。 在图 7中， 代理呼 叫会话控制功能实体 （Proxy CSC-FE, 简称为 P-CSC-FE ) 71、 76负责维持 安全关联和 SIP 信令的完整性和机密性保护。 服务呼叫会话控制功能实体 ( Service CSC-FE, 简称为 S-CSC-FE ) 72、 75负责处理注册过程、 进行路由 判断、 维持会话状态并存储业务配置。 当在 S-CSC-FE 75上对某个用户身份 注册多个联系地址， 例如， TE B 77和 TE C 78注册地址， S-CSC-FE 75对来 自 TE A 70的 SIP请求进行分叉。 询问呼叫会话控制功能实体 ( Interrogating CSC-FE, 简称为 I-CSC-FE ) 73可以从业务用户描述功能实体 SUP-FE 74中 获取下一跳 S-CSC-FE的名称。 图 8示出了在 NGN中基于 SIP请求分叉时的注册、 会话建立和认证流 程， 以下结合图 7所示的系统来描述图 8的处理。 如图 8所示， 用户 1拥有 TE A 80, 用户 2拥有 TE B 87和 TE C 88。 步骤 S802, 登记用户 1 的联系地址， TE A 80通过 P-CSC-FE 81 向
S-CSC-FE 82发送注册请求； 步骤 S804, S-CSC-FE 82向 TE A 80返回注册成功响应; 步骤 S806-S612, 通过 P-CSC-FE 86, 在 S-CSC-FE 85中同时登记用户 2的两个联系地址 TE-B 87和 TE-C 88； 步骤 S814 , 用户 1通过 TE A 80向用户 2发起 INVITE请求， 该请求经 过 P-CSC-FE 81和 S-CSC-FE 82后到达 I-CSC-FE 83; 步骤 S816, I-CSC-FE 83查询 SUP-FE 84,得到用户 2对应的 S-CSC-FE
82的地址； 步骤 S818 , I-CSC-FE 83将 INVITE请求发送到下一跳 S-CSC-FE 86, 并且， 用户 2在 S-CSC-FE 85中登记； 步骤 S820, 分叉后， 将一个分支上的 INVITE请求通过 P-CSC-FE 86 发送到 TE B 87; 步骤 S822, 分叉后， 将另一个分支上的 INVITE请求通过 P-CSC-FE 86 发送到 TE B 88； 步骤 S824-步骤 S826, TE B 87 和 TE C 88 分别发起未 4曼权 ( 401 UNAUTHORIZED ) 响应对 INVITE的发起端进行认证， 响应中包含支持的 安全算法和挑战值， 响应通过 P-CSC-FE 86发送到 S-CSC-FE 85; 步骤 S828 , S-CSC-FE 85将两个未 4曼权的响应聚合成一个响应后， 发 送到 I-CSC-FE 83; 步骤 S830, I-CSC-FE 83查询 SUP-FE34,得到用户 1对应的 S-CSC-FE 82的地址； 步骤 S832, S-CSC-FE 82将 401 UNAUTHORIZED响应发送到 TE A 80； 步骤 S834, TE A 80接》 到 401 UNAUTHORIZED响应后， 分别才艮据 TE B 87和 TE C 88中提供的安全算法及挑战值， 釆用自己的凭证来计算响 应值。 并重新发起 INVITE请求， 该请求中包含 4曼权头信息； 步骤 S836-步骤 S838 , 上述 INVITE请求发送到 S-CSC-FE 85后， 分别 转发到 TE B 87和 TE C 88, 并在终端设备上完成对 TE A 80的认证； 至此， 完成了 NGN中基于 SIP请求分叉时的认证流程。 图 8中示出的 步骤 S840-步骤 S856, 与正常的 SIP会话建立过程类似， 这里不再重述， 其 中， 步骤 S844 和步骤 S846 中涉及的消息为确认应答 ( ACK ) 消息， 步骤 S850和步骤 S854中涉及的消息为结束（ BYE )消息， 并且， 为了简化目的， 省略了注册过程中认证流程以及会话建立过程中的 180 Ringing步骤。 通过上述处理过程， 实现了基于 SIP请求分叉时， 接收设备对上游设备 的认证。 综上所述， 借助于本发明的技术方案， 能够实现基于 SIP信令分叉的情 况下， 接收设备对源设备的认证。 显然， 本领域的技术人员应该明白， 上述的本发明的各模块或各步骤可 以用通用的计算装置来实现， 它们可以集中在单个的计算装置上， 或者分布 在多个计算装置所组成的网络上， 可选地， 它们可以用计算装置可执行的程 序代码来实现， 从而， 可以将它们存储在存储装置中由计算装置来执行， 或 者将它们分别制作成各个集成电路模块， 或者将它们中的多个模块或步骤制 作成单个集成电路模块来实现。 这样， 本发明不限制于任何特定的硬件和软 件结合。 以上所述仅为本发明的优选实施例而已， 并不用于限制本发明， 对于本 领域的技术人员来说， 本发明可以有各种更改和变^^ 凡在本发明的^^申和 原则之内， 所作的任何修改、 等同替换、 改进等， 均应包含在本发明的保护 范围之内。

Claims

权 利 要 求 书
1. 一种基于分叉的认证方法， 涉及至少两个接收设备对源设备进行认证， 其特征在于， 所述方法包括： 在所述接收设备和所述源设备上分别设置认证凭证； 分叉网元在接收到来自所述源设备的呼叫请求后，将所述呼叫请求 进行分叉， 并把分叉后的呼叫请求发送到对应的接收设备；
所述分叉网元接收来自所述接收设备的挑战值，并将所述挑战值转 发到所述源设备；
所述分叉网元接收来自所述源设备重新发送的呼叫请求， 其中， 重 新发送的所述呼叫请求中携带有相关认证凭证；
所述分叉网元将所述重新发送的呼叫请求进行分叉，并将分叉后的 呼叫请求发送到对应的接收设备， 以使所述接收设备根据所述认证凭证 对所述源设备进行认证。
2. 根据权利要求 1所述的方法， 其特征在于， 所述认证凭证包括以下至少 之一： 预共享密钥、 数字证书。
3. 根据权利要求 1所述的方法， 其特征在于， 所述分叉网元为服务呼叫会 话控制功能设备， 所述接收设备为在所述分叉网元之后的下一代网络网 元和 /或终端设备。
4. 根据权利要求 1所述的方法， 其特征在于， 所述将挑战值转发到所述源 设备具体为：
所述分叉网元将所述接收设备发送的 战值聚合在分叉请求响应 中， 并将所述分叉请求响应发送到所述源设备。
5. 才艮据权利要求 1所述的方法， 其特征在于， 在所述分叉网元接收来自所 述源设备重新发送的呼叫请求之前， 所述方法还包括：
所述源设备对不同的挑战值提供不同的认证凭证；
所述源设备将所述不同的认证凭证聚合在呼叫请求中，并重新发送 所述呼叫请求。
6. 一种基于分叉的认证系统， 包括至少两个接收设备对源设备进行认证， 其特征在于， 所述系统包括：
设置模块， 用于在所述接收设备和所述源设备上分别设置认证凭 证；
分叉网元， 用于在接收到来自所述源设备的呼叫请求后， 将所述呼 叫请求进行分叉， 发送到对应的接收设备， 并将多个所述接收设备发送 的多个挑战值转发到所述源设备；
源设备， 用于发送呼叫请求， 以及在接收到所述多个挑战值后， 重 新发送呼叫请求， 并在重新发送的所述呼叫请求中携带相关认证凭证； 接收设备， 用于在接收到重新发送的所述呼叫请求后， 根据所述认 证凭证完成对所述源设备的认证。
7. 根据权利要求 6所述的系统， 其特征在于， 所述分叉网元还用于接收来 自所述源设备重新发送的呼叫请求。
8. 一种分叉认证装置， 位于源设备， 其特征在于， 所述装置包括：
设置模块， 用于设置认证凭证；
发送模块， 用于发送呼叫请求；
接收模块， 用于接收来自分叉网元的挑战值；
重发模块， 用于重发所述呼叫请求， 并在所述呼叫请求中携带与所 述 4 战值对应的认证凭证。
9. 一种分叉认证装置， 位于接收设备， 其特征在于， 所述装置包括： 设置模块， 用于设置认证凭证；
发送模块， 用于在接收到来自源设备的呼叫请求后， 通过分叉网元 向所述源设备发送挑战值；
认证模块， 用于在接收到所述源设备重新发送的呼叫请求后， 根据 重新发送的所述呼叫请求中携带的认证凭证完成对所述源设备的认证。
PCT/CN2008/073532 2008-06-23 2008-12-16 基于分叉的认证方法及系统以及分叉认证装置 Ceased WO2009155765A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US13/120,207 US8914861B2 (en) 2008-06-23 2008-12-16 Authentication method and authentication system based on forking, and forking authentication device
EP08874764.7A EP2337302A4 (en) 2008-06-23 2008-12-16 METHOD, SYSTEM AND CONNECTION AUTHENTICATION DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200810100484.1A CN101296085B (zh) 2008-06-23 2008-06-23 基于分叉的认证方法、系统以及分叉认证装置
CN200810100484.1 2008-06-23

Publications (1)

Publication Number Publication Date
WO2009155765A1 true WO2009155765A1 (zh) 2009-12-30

Family

ID=40066121

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/073532 Ceased WO2009155765A1 (zh) 2008-06-23 2008-12-16 基于分叉的认证方法及系统以及分叉认证装置

Country Status (4)

Country Link
US (1) US8914861B2 (zh)
EP (1) EP2337302A4 (zh)
CN (1) CN101296085B (zh)
WO (1) WO2009155765A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101296085B (zh) 2008-06-23 2011-07-13 中兴通讯股份有限公司 基于分叉的认证方法、系统以及分叉认证装置
CN101478414B (zh) * 2009-02-03 2011-07-13 中兴通讯股份有限公司 一种实现会议业务的方法及系统
CN105577624B (zh) 2014-10-17 2019-09-10 阿里巴巴集团控股有限公司 客户端交互方法与客户端以及服务器

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101127603A (zh) * 2007-08-16 2008-02-20 中兴通讯股份有限公司 一种实现门户网站单点登录的方法及ims客户端
US7376232B2 (en) * 2003-03-13 2008-05-20 New Mexico Technical Research Foundation Computer system security via dynamic encryption
CN101296085A (zh) * 2008-06-23 2008-10-29 中兴通讯股份有限公司 基于分叉的认证方法、系统以及分叉认证装置

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7529359B2 (en) * 2001-03-20 2009-05-05 Verizon Business Global Llc Caller treatment in a SIP network
US7243370B2 (en) * 2001-06-14 2007-07-10 Microsoft Corporation Method and system for integrating security mechanisms into session initiation protocol request messages for client-proxy authentication
US7434044B2 (en) * 2003-02-26 2008-10-07 Cisco Technology, Inc. Fast re-authentication with dynamic credentials
US7366305B2 (en) * 2003-09-30 2008-04-29 Intel Corporation Platform and method for establishing trust without revealing identity
DE102004004048A1 (de) * 2004-01-27 2005-08-18 Siemens Ag Kommunikationssystem, Verfahren zum Anmelden einer Kommunikationsbeziehung und Netzwerkverbindungs-Rechner
JP4047303B2 (ja) * 2004-06-04 2008-02-13 キヤノン株式会社 提供装置、提供プログラム、及び、提供方法
CN100583759C (zh) * 2004-12-13 2010-01-20 华为技术有限公司 实现不同认证控制设备间同步认证的方法
US7739744B2 (en) * 2006-03-31 2010-06-15 Novell, Inc. Methods and systems for multifactor authentication
JP4828999B2 (ja) * 2006-04-27 2011-11-30 京セラ株式会社 移動局及びサーバ
JP5000215B2 (ja) * 2006-06-30 2012-08-15 Ｎｅｃインフロンティア株式会社 Ｓｉｐを用いたボタン電話装置およびそのグループ代表着信および着信応答方法
US8850012B2 (en) * 2006-08-21 2014-09-30 Nokia Corporation Mechanism for charging and session handling supporting forking
CN100596059C (zh) * 2006-10-27 2010-03-24 华为技术有限公司 一种组播认证方法、系统及应用
US8107948B2 (en) * 2007-05-30 2012-01-31 Kyocera Corporation Radio communication system, management server, radio communication terminal, and radio communication method
US8613058B2 (en) * 2007-05-31 2013-12-17 At&T Intellectual Property I, L.P. Systems, methods and computer program products for providing additional authentication beyond user equipment authentication in an IMS network
US8112629B2 (en) * 2007-10-26 2012-02-07 Red Hat, Inc. Stateless challenge-response protocol
US8966594B2 (en) * 2008-02-04 2015-02-24 Red Hat, Inc. Proxy authentication

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7376232B2 (en) * 2003-03-13 2008-05-20 New Mexico Technical Research Foundation Computer system security via dynamic encryption
CN101127603A (zh) * 2007-08-16 2008-02-20 中兴通讯股份有限公司 一种实现门户网站单点登录的方法及ims客户端
CN101296085A (zh) * 2008-06-23 2008-10-29 中兴通讯股份有限公司 基于分叉的认证方法、系统以及分叉认证装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2337302A4 *

Also Published As

Publication number Publication date
CN101296085A (zh) 2008-10-29
EP2337302A4 (en) 2014-03-12
US20110225639A1 (en) 2011-09-15
US8914861B2 (en) 2014-12-16
CN101296085B (zh) 2011-07-13
EP2337302A1 (en) 2011-06-22

Similar Documents

Publication Publication Date Title
CN102006294B (zh) Ims多媒体通信方法和系统、终端及ims核心网
JP5143125B2 (ja) ドメイン間情報通信のための認証方法、システム、およびその装置
US8274968B2 (en) Restriction of communication in VoIP address discovery system
TWI711293B (zh) 驗證網路通話身份的方法及相關裝置
CN101420413B (zh) 会话密钥协商方法、认证服务器及网络设备
US8923279B2 (en) Prevention of voice over IP spam
EP2335391A1 (en) Key management in a communication network
WO2010124482A1 (zh) Ip多媒体子系统中实现安全分叉呼叫会话的方法及系统
US12267895B2 (en) Security mechanism for connection establishment over multi-hop sidelinks
US8745374B2 (en) Sending protected data in a communication network
CN101527632A (zh) 响应消息认证方法、装置及系统
KR20120072210A (ko) 네트워크 시스템 및 이를 위한 사용자 기기, 호 처리 장치 및 네트워크 브리지
CN103546442B (zh) 浏览器的通讯监听方法及装置
WO2009155765A1 (zh) 基于分叉的认证方法及系统以及分叉认证装置
CN111835675A (zh) 验证网络通话身份的方法及相关装置
US9137028B1 (en) Internet sip registration/proxy service for audio conferencing
CN106559402B (zh) 用户终端及其加密语音电话业务的身份认证方法及装置
JP4715946B2 (ja) 通知番号検証システム
US9002748B2 (en) Method for securing IP connections for network operator combinatory connections
JP4433895B2 (ja) 通知番号検証システム
US20130039223A1 (en) CALL CONNECTING METHOD AND SYSTEM BASED ON MOBILE VoIP
Zimmermann et al. RFC 6189: ZRTP: Media Path Key Agreement for Unicast Secure RTP
CN114726958B (zh) 身份验证方法、装置、电子设备及可读存储介质
Callas et al. ZRTP: Media path key agreement for unicast secure RTP
JP2011217031A (ja) 通信装置及び発信者認証方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08874764

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2008874764

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 13120207

Country of ref document: US