EP1687962A1 - Security module for encrypting a telephone conversation - Google Patents
Security module for encrypting a telephone conversationInfo
- Publication number
- EP1687962A1 EP1687962A1 EP04819236A EP04819236A EP1687962A1 EP 1687962 A1 EP1687962 A1 EP 1687962A1 EP 04819236 A EP04819236 A EP 04819236A EP 04819236 A EP04819236 A EP 04819236A EP 1687962 A1 EP1687962 A1 EP 1687962A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- security module
- protocol
- network
- tdm
- telephone
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04K—SECRET COMMUNICATION; JAMMING OF COMMUNICATION
- H04K1/00—Secret communication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
- H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
- H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M7/00—Arrangements for interconnection between switching centres
- H04M7/006—Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP), including next generation networks with a packet-switched transport layer
- H04M7/0078—Security; Fraud detection; Fraud prevention
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M7/00—Arrangements for interconnection between switching centres
- H04M7/12—Arrangements for interconnection between switching centres for working between exchanges having different types of switching equipment, e.g. power-driven and step by step or decimal and non-decimal
- H04M7/1205—Arrangements for interconnection between switching centres for working between exchanges having different types of switching equipment, e.g. power-driven and step by step or decimal and non-decimal where the types of switching equipement comprises PSTN/ISDN equipment and switching equipment of networks other than PSTN/ISDN, e.g. Internet Protocol networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M1/00—Substation equipment, e.g. for use by subscribers
- H04M1/253—Telephone sets using digital voice transmission
- H04M1/2535—Telephone sets using digital voice transmission adapted for voice communication over an Internet Protocol [IP] network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2203/00—Aspects of automatic or semi-automatic exchanges
- H04M2203/60—Aspects of automatic or semi-automatic exchanges related to security aspects in telephonic communication systems
- H04M2203/609—Secret communication
Definitions
- Security module for encrypting a telephone call
- the invention relates to a security module for encrypting a telephone call between one or more first telecommunication terminals in a packet-oriented data network and one or more second telecommunication terminals in an analog and / or digital telephone network.
- Telephony in IP networks is known from the prior art.
- standards in which the signaling for telephony in IP networks is specified.
- VoIP Voice over IP
- LAN Local Area Network
- WLAN Wireless Local Area Network
- security aspects relating to the authenticity and integrity of control and signaling data have mainly been considered in VoIP telephony.
- the security of the transmitted voice data will also be taken into account.
- SRTP Secure Real Time Transport Protocol
- the object of the invention is therefore to provide a security module for encrypting a telephone call, which Encryption of the voice data in a heterogeneous network comprehensively enables a packet-oriented data network and a telephone network.
- the security module is used to encrypt a telephone call between one or more first telecommunication terminals in a packet-oriented data network and one or more second telecommunication terminals in an analog and / or digital telephone network, data packets being transported in the packet-oriented network using an encrypted transport protocol and the keys for the encrypted one Transport protocol can be exchanged using a key exchange protocol.
- PSTN Public Switched Telephone Network
- the packet-oriented network and the telephone network are connected to one another via an access computer and the security module can be interposed in a connecting line on a first or second telecommunications terminal during a telephone call.
- the term “connecting line” is to be understood generally here, it can be both a wired and a wireless connection on the corresponding telecommunication terminal.
- the security module comprises a protocol processing device which processes messages of the key exchange protocol as well as data packets transported by means of the encrypted transport protocol if the security module is interposed in a connection line on a first or second telecommunication terminal during a telephone call.
- Task of the protocol The processing device is to convert voice signals which are generated at the corresponding telecommunications terminal into data packets for transport via the encrypted transport protocol and to convert data packets arriving at the security module and which are transported via the encrypted transport protocol into voice signals.
- the security module also includes a modem connection unit, which is always used when the security module is interposed in a connection line on a second telecommunication terminal.
- the modem connection unit sets up a modem connection between the second telecommunication terminal and the access computer and / or a further second telecommunication terminal during a telephone call, data packets being transported via the modem connection using the encrypted transport protocol and messages from the key exchange protocol
- PPP Point to Point Protocol
- the modem connection unit in the security module thus implements a transfer of encryption technologies from packet-oriented networks to public telephone networks. This is possible because modem connections nowadays have sufficient bandwidth or transmission rates for the transmission of real-time media data packets.
- SRTP (see document [1]) is used as the encrypted transport protocol.
- SIP Session Initiation Protocol
- the telephone network in which the security module according to the invention is used is, for example, a digital ISDN network.
- the modem connection unit preferably establishes a modem connection via the B channel in the ISDN network.
- the packet-oriented network is preferably an IP-based data network, in particular a LAN network.
- the modem connection unit preferably establishes a modem connection according to the V90 and / or V92 standard, this standard providing sufficient bandwidths or transmission rates for the transmission of data packets from packet-oriented networks.
- the security module is used for telephones with a connecting cable between the telephone set and the telephone handset, the security module being designed in such a way that it is interposed in the connecting cable.
- FIG. 1 shows the schematic representation of a heterogeneous network in which the security module according to the invention is used to encrypt voice signals.
- the TDM network is a digital network, but a separate analog voice channel is used to transmit spoken voice.
- the LAN and the TDM network are connected to one another via a gateway G.
- the gateway is used to modify IP data packets transmitted in the LAN network for forwarding in the TDM network as well as data from the TDM network for forwarding in the LAN network.
- VoIP clients VoIP-C which enable calls to be made over packet-oriented networks.
- VoIP over IP the standards SIP or H.323, which are well known to the person skilled in the art, can be used for signaling voice messages.
- the lower VoIP client in Fig. 1 is a telephone with which the establishment of an encrypted telephone connection is intended. Therefore, between the handset of the telephone and the actual telephone connection in the corresponding ⁇ security module SM according to the invention line interposed.
- the security modules known from the prior art enable the telephone call to be encrypted only within the TDM network, with each telephone call subscriber generating a key to set up an encrypted telephone connection by pressing a button on his security module, which key is transmitted via a proprietary signaling Protocol is exchanged between the parties' telephones. Finally, combinations of numbers are shown on displays that are integrated in the security modules, which the callers announce to each other via the telephone connection. If the number combinations match, it can be assumed that the connection is not being tapped by a third party, so that the encrypted data transmission is finally carried out with the help of the exchanged keys, again using a proprietary protocol.
- the security module solves this problem in that it can process protocols known from the IP world for encrypting data in a normal public TDM network.
- the protocol processing device can process the key exchange protocol MIKEY.
- MIKEY key exchange protocol
- keys are generated and exchanged between the clients or telephones in the heterogeneous network of FIG. 1.
- the keys are used here by the transport protocol SRTP for the encrypted transmission of the data packets by means of SRTP.
- the protocol processing facility enables including encrypted telephony between VoIP clients in the LAN network. This is shown in FIG. 1 with the double arrows MIKEY-KM (KM stands for key management) and SRTP-MS (MS stands for media security).
- the security module SM has a modem connection unit. This modem connection unit provides one during a telephone call
- Participant in the TDM network with a participant in the LAN network establishes a modem connection to the gateway G via a voice channel in the TDM network.
- This is preferably a V92 modem connection with which data can be transmitted at 56 kbit / s downstream and 48 kbit / s upstream.
- the MIKEY messages are transported in the LAN network, for example using the SIP protocol.
- the contents of the MIKEY messages can then be cut out of the SIP message and inserted into the PPP tunnel.
- the gateway it would also be conceivable for the gateway to simply forward the SIP messages to the PPP tunnel without cutting out the MIKEY messages.
- the protocol processing device of the security module SM must be able to process the SIP protocol.
- the security module SM functions as a SIP end point.
- the gateway G le ⁇ takes diglich a forwarding function, and changes the data Not. This also applies to the actual key exchange data in the form of MIKEY messages. If required, however, the gateway can also be included in the connection as a trustworthy component, for example to enable "lawful interception".
- the mechanism according to the invention is illustrated again by the arrows in the lower region of FIG. 1.
- a modem connection is used between the gateway G and a TDM client TDM-C for encrypted data transport, via which the PPP protocol runs, which in turn is used to transport IP data packets.
- IP-PPP-TDM end-to-end encryption is implemented between a client in the LAN network and a client in the TDM network using the MIKEY key exchange protocol and the SRTP
- Transport protocol reached SRTP. This is emphasized by the double arrows labeled MIKEY-KM and SRTP-MS.
- the security module according to the invention thus enables the transmission of encryption protocols known from the IP world into a public telephone network in a simple manner. This is guaranteed by a modem connection, which, due to its possible bandwidths and transmission rates, enables the transport of real-time data packets and signaling messages from the IP world.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Telephonic Communication Services (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DE10355418A DE10355418B4 (en) | 2003-11-27 | 2003-11-27 | Security module for encrypting a telephone conversation |
PCT/EP2004/052885 WO2005053290A1 (en) | 2003-11-27 | 2004-11-09 | Security module for encrypting a telephone conversation |
Publications (1)
Publication Number | Publication Date |
---|---|
EP1687962A1 true EP1687962A1 (en) | 2006-08-09 |
Family
ID=34625301
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP04819236A Withdrawn EP1687962A1 (en) | 2003-11-27 | 2004-11-09 | Security module for encrypting a telephone conversation |
Country Status (5)
Country | Link |
---|---|
US (1) | US8195958B2 (en) |
EP (1) | EP1687962A1 (en) |
CN (1) | CN100459620C (en) |
DE (1) | DE10355418B4 (en) |
WO (1) | WO2005053290A1 (en) |
Families Citing this family (17)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7308101B2 (en) | 2004-01-22 | 2007-12-11 | Cisco Technology, Inc. | Method and apparatus for transporting encrypted media streams over a wide area network |
DE102005056112A1 (en) * | 2005-11-23 | 2007-05-31 | Giesecke & Devrient Gmbh | Telecommunication terminals e.g. Internet telephone, communication connection establishing method, involves establishing data connection between terminals, and declaring symmetric code by exchanging process during connection establishment |
DE102006046017B4 (en) | 2006-09-28 | 2010-01-14 | Siemens Ag | A method for providing a symmetric key for securing a key management protocol |
DE102006047648A1 (en) * | 2006-10-09 | 2008-04-10 | Giesecke & Devrient Gmbh | Voice over internet protocol connection initializing method, involves receiving signaling message with internet protocol address of terminal, and implementing connecting agents in respective security modules having microprocessor chips |
DE102006047650A1 (en) * | 2006-10-09 | 2008-04-10 | Giesecke & Devrient Gmbh | Cryptographic computation method for participants of voice over Internet protocol (VoIP) connection involves performing cryptographic computation at least partly in safety module after accomplishing part of key administrative minutes |
US8464053B2 (en) * | 2007-09-05 | 2013-06-11 | Radvision Ltd | Systems, methods, and media for retransmitting data using the secure real-time transport protocol |
KR20090036335A (en) * | 2007-10-09 | 2009-04-14 | 삼성전자주식회사 | Method for providing key efficiently in mobile broadcasting system and the system thereof |
US9178696B2 (en) | 2007-11-30 | 2015-11-03 | Telefonaktiebolaget L M Ericsson (Publ) | Key management for secure communication |
US20110054912A1 (en) * | 2009-09-01 | 2011-03-03 | Christopher Anthony Silva | System and method of storing telephone conversations |
US20110076990A1 (en) * | 2009-09-29 | 2011-03-31 | Christopher Anthony Silva | Method for recording mobile phone calls |
US8428559B2 (en) | 2009-09-29 | 2013-04-23 | Christopher Anthony Silva | Method for recording mobile phone calls |
CN102510768A (en) * | 2011-12-21 | 2012-06-20 | 华为技术有限公司 | Method and device supporting encryption communication |
JP5746774B2 (en) * | 2014-01-06 | 2015-07-08 | テレフオンアクチーボラゲット エル エム エリクソン(パブル) | Key management for secure communication |
CH709506A2 (en) * | 2014-04-14 | 2015-10-15 | Quantec Sa | Portable transceiver device encrypted audio streams and associated method. |
CN104065649B (en) * | 2014-06-05 | 2017-09-19 | 天地融科技股份有限公司 | A kind of data processing method of voice call |
US10194011B2 (en) | 2016-09-27 | 2019-01-29 | High Sec Labs Ltd. | Method and apparatus for securing voice over IP telephone device |
US11606460B2 (en) | 2021-04-07 | 2023-03-14 | High Sec Labs Ltd. | Mutual disabling unit for multiple phones |
Family Cites Families (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5778071A (en) | 1994-07-12 | 1998-07-07 | Information Resource Engineering, Inc. | Pocket encrypting and authenticating communications device |
FR2772531B1 (en) * | 1997-12-11 | 2000-03-10 | France Telecom | DEVICE FOR SECURING A TELEPHONE LINK BETWEEN TWO SUBSCRIBER STATIONS |
US6356638B1 (en) * | 1998-07-30 | 2002-03-12 | General Dynamics Decision Systems, Inc. | Radio wireline interface and method for secure communication |
US6151677A (en) * | 1998-10-06 | 2000-11-21 | L-3 Communications Corporation | Programmable telecommunications security module for key encryption adaptable for tokenless use |
US7035410B1 (en) * | 1999-03-01 | 2006-04-25 | At&T Corp. | Method and apparatus for enhanced security in a broadband telephony network |
MY123388A (en) * | 1999-03-15 | 2006-05-31 | Sony Corp | Processing method and apparatus for encrypted data transfer |
US6856687B2 (en) * | 1999-06-21 | 2005-02-15 | Copytele, Inc. | Portable telecommunication security device |
US6857072B1 (en) * | 1999-09-27 | 2005-02-15 | 3Com Corporation | System and method for enabling encryption/authentication of a telephony network |
DE19960733A1 (en) * | 1999-12-16 | 2001-09-27 | Deutsche Telekom Mobil | Method and arrangement for the improved use of technical resources between telecommunications and IP networks |
US6889321B1 (en) * | 1999-12-30 | 2005-05-03 | At&T Corp. | Protected IP telephony calls using encryption |
AU2002339313B2 (en) * | 2001-09-20 | 2006-04-06 | Nokia Solutions And Networks Gmbh & Co. Kg | Distributed transmission of information in a connection-less packet-oriented communication network |
US20030137959A1 (en) * | 2001-09-24 | 2003-07-24 | Nebiker Robert M. | Flexible-link multi-media communication |
US7382881B2 (en) * | 2001-12-07 | 2008-06-03 | Telefonaktiebolaget L M Ericsson (Publ) | Lawful interception of end-to-end encrypted data traffic |
US7213145B2 (en) * | 2002-01-10 | 2007-05-01 | Avaya Technology Corp. | Method and apparatus for secure internet protocol communication in a call processing system |
US6792534B2 (en) * | 2002-03-22 | 2004-09-14 | General Instrument Corporation | End-to end protection of media stream encryption keys for voice-over-IP systems |
US7366894B1 (en) * | 2002-06-25 | 2008-04-29 | Cisco Technology, Inc. | Method and apparatus for dynamically securing voice and other delay-sensitive network traffic |
EP1422908B1 (en) * | 2002-11-25 | 2005-11-30 | Siemens Aktiengesellschaft | Method and apparatus for transmitting encrypted data streams over a packet oriented network |
US7426636B1 (en) * | 2003-06-02 | 2008-09-16 | Cisco Technology, Inc. | Compact secure data communication method |
US7707407B2 (en) * | 2003-09-15 | 2010-04-27 | Telecommunication Systems, Inc. | Encryption of voice and data in a single data stream in a deployable, secure communication system |
US7308101B2 (en) * | 2004-01-22 | 2007-12-11 | Cisco Technology, Inc. | Method and apparatus for transporting encrypted media streams over a wide area network |
US7451921B2 (en) * | 2004-09-01 | 2008-11-18 | Eric Morgan Dowling | Methods, smart cards, and systems for providing portable computer, VoIP, and application services |
US7933413B2 (en) * | 2007-02-02 | 2011-04-26 | Microsoft Corporation | Key exchange verification |
-
2003
- 2003-11-27 DE DE10355418A patent/DE10355418B4/en not_active Expired - Fee Related
-
2004
- 2004-11-09 EP EP04819236A patent/EP1687962A1/en not_active Withdrawn
- 2004-11-09 CN CNB2004800351074A patent/CN100459620C/en not_active Expired - Fee Related
- 2004-11-09 WO PCT/EP2004/052885 patent/WO2005053290A1/en not_active Application Discontinuation
- 2004-11-09 US US10/580,954 patent/US8195958B2/en not_active Expired - Fee Related
Non-Patent Citations (1)
Title |
---|
See references of WO2005053290A1 * |
Also Published As
Publication number | Publication date |
---|---|
DE10355418B4 (en) | 2008-04-03 |
DE10355418A1 (en) | 2005-07-07 |
CN100459620C (en) | 2009-02-04 |
US20070121582A1 (en) | 2007-05-31 |
US8195958B2 (en) | 2012-06-05 |
CN1886974A (en) | 2006-12-27 |
WO2005053290A1 (en) | 2005-06-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
DE10355418B4 (en) | Security module for encrypting a telephone conversation | |
DE60011875T2 (en) | SYSTEM AND METHOD FOR ENABLING SAFE CONNECTIONS FOR H.323 VOIP CALLS | |
DE60118259T2 (en) | Maintain end-to-end synchronization of a telecommunications connection | |
EP2204039B1 (en) | Method and communication terminal device for exchanging data during or after a communication connection | |
EP1714473A1 (en) | Multimedia packet transmission link setup using an interactive voice response system | |
EP2815565A1 (en) | Method for handling a telecommunications connection, telecommunications arrangement, switching device and network coupling device | |
EP1705889B1 (en) | Method for fast setup of a bearer connection between communications terminals | |
EP1847092A1 (en) | Method for locking-on to encrypted communication connections in a packet-oriented network | |
DE60312332T2 (en) | RECEIVING SYSTEM, METHOD AND DEVICE | |
EP1665756A1 (en) | Interworking of hybrid protocol multimedia networks | |
EP1282280A1 (en) | Method, control device and program module for controlling and guiding of data streams of a communication connection between two participants of a packet data network | |
EP1841161B1 (en) | Method for secured transmission of payload data | |
EP1279272A2 (en) | Method for providing an additional service for internet users | |
EP1867186B1 (en) | Poc communication system, method for transmitting a poc signalling and/or poc data, and a server device therefor | |
EP2027670B1 (en) | Method for securing ip connections for network operator combinatory connections | |
DE102004002680A1 (en) | Adapter unit and method | |
EP2016742B1 (en) | Method and device for establishing a subject-related communication link | |
EP1152566B1 (en) | Method for setting up a secure connection and communications terminal therefore | |
DE102005056623A1 (en) | Mobile switching device for receiving and forwarding of information e.g. text data, has control device controlling forwarding of information received over mobile radio network in Internet protocol based communication network and vice versa | |
EP2101468B1 (en) | Utilising signalling information in a key management protocol for secure media transport | |
DE102004029568A1 (en) | Communications device for producing a connection links between telephone receivers, a telephone network and a data network recognizes a dialed subscriber's number to produce a link with a partner | |
Roedig et al. | 2GMD IPSI | |
EP1461932A1 (en) | Method and system for displaying data on a telecommunications terminal | |
EP1377004A1 (en) | Method for establishing a conference circuit between several subscriber terminals of a communications network | |
WO2004047470A1 (en) | Transmission of voice data in a mobile radio network consisting of a radio access network and a switching network |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20060327 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): DE FR GB IT SE |
|
DAX | Request for extension of the european patent (deleted) | ||
RBV | Designated contracting states (corrected) |
Designated state(s): DE FR GB IT SE |
|
17Q | First examination report despatched |
Effective date: 20130110 |
|
RAP1 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: SIEMENS AKTIENGESELLSCHAFT |
|
RAP1 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: SIEMENS AKTIENGESELLSCHAFT |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN |
|
18D | Application deemed to be withdrawn |
Effective date: 20140603 |