KR100353163B1 - Internet Secure Phone System - Google Patents

Abstract

Secured Internet telephony system, which adaptively selects multiple voice codecs according to network conditions, encrypts compressed coded voice signals using a secret key and distributes these secret keys among senders and receivers using a distribution algorithm. Characterized in that. Specifically, a plurality of voice codecs different in sound quality, bit rate, and processing delay characteristics for encoding and outputting the input voice signal; A selection unit for selecting one of the plurality of voice codecs in consideration of the traffic amount, loss amount and jitter amount of the received signal; An encryption unit for encrypting an output signal of the voice codec selected by the selection unit using an encryption key generated from a predetermined value distributed through a network; A first protocol converter converting the encrypted signal into a first protocol signal; A call setup and control unit for controlling the entire system and handling call setup operations; A second protocol conversion unit converting a digital signal including a call setup signal output from the call setup and control unit and a signal for distribution processing of the encryption key into a second protocol signal; A transmitter for transmitting the first protocol signal and the second protocol signal to the Internet in a mixed packet; Characterized in that it comprises a.

Description

Internet Secure Phone System

The present invention relates to a device for providing a voice communication service using a digital communication network, and more particularly, to a secured Internet phone (VoIP) device.

IP telephony system provides voice communication service in packet-based network, and it is cheaper than communication using PSTN (Public Switched Telephone Network). With the advantages of integration and effective use of network bandwidth, demand is growing due to the environment, such as a drop in computer hardware prices, the explosive growth of the Internet, and advances in DSP technology for voice compression and restoration. In the future, it is expected to replace many parts of systems that operate circuit-switched.

However, since the Internet is not designed for real-time data transmission such as voice, unlike the PSTN, it cannot guarantee a certain bandwidth and has several disadvantageous characteristics that affect the call quality (QoS). That is, the voice packet delay due to the digitization of the analog voice signal and the compression and packetization, the delay jitter caused by the characteristics of the Internet network and the transmission of the voice packet through UDP (User Datagram Protocol) Since voice loss such as packet loss has an unsuitable characteristic, a method for securing QoS is required. In addition, it is necessary to take countermeasures because it is possible to eavesdrop by third parties and is inappropriate for voice communication that requires the security of individuals or companies.

However, the addition of the encryption function to the Internet phone has the following problems.

1) The complexity of the system increases due to the complexity of encryption

2) QoS degradation due to an increase in voice packet delay due to an increase in overall encoding time

3) There is a possibility of exposing a key when transmitting a secret key for encryption and decryption between users.

The present invention has been made to overcome the above problems, and an object of the present invention is to provide a secured Internet phone capable of providing sufficient call quality in practical use without excessive packet delay while having a sufficient degree of security.

1 shows the appearance of the overall hardware of the present invention applied to the PC-to-PC method.

2A to 2C are block diagrams showing schematics of a system according to a preferred embodiment of the present invention, in which FIG. 2A shows a transmission system, FIG. 2B shows a receiving system, and FIG. 2C shows a system in which transmission and reception are integrated.

3 is a flowchart illustrating a selection algorithm of a selector according to an exemplary embodiment of the present invention.

<Description of Symbols for Major Parts of Drawings>

21: selection unit 22: voice codec

23: encryption section 24: RTP section

25: call setup and control unit 26: TCP unit

27: transceiver

The present invention guarantees QoS by supporting various voice codecs due to increased packet delay and network traffic fluctuations, and selects a cipher that is not complicated and has a sufficient level of security and measures against eavesdropping of a secret key. This goal was achieved by presenting.

The configuration of the present invention for achieving the above object is:

In the transmission system configuration of the Internet telephone system

A plurality of voice codecs for encoding and outputting an input voice signal and having different sound quality, bit rate, and processing delay characteristics;

A selection unit for selecting one of the plurality of voice codecs in consideration of the traffic amount, loss amount and jitter amount of the received signal;

An encryption unit for encrypting an output signal of the voice codec selected by the selection unit using an encryption key generated from a predetermined value distributed through a network;

A first protocol converter converting the encrypted signal into a first protocol signal;

A call setup and control unit for controlling the entire system and handling call setup operations;

A second protocol conversion unit converting a digital signal including a call setup signal output from the call setup and control unit and a signal for distribution processing of the encryption key into a second protocol signal;

A transmitter for transmitting the first protocol signal and the second protocol signal to the Internet in a mixed packet;

Characterized in that it comprises a.

In addition, the Internet telephone system according to a preferred embodiment of the present invention is characterized in that the selector selects one of the plurality of voice codecs according to the priority according to the order of network traffic, loss rate, jitter amount.

In the Internet telephone system according to a preferred embodiment of the present invention, the plurality of voice codecs include a PCM type, an ADPCM type, and a CELP type voice codec.

In addition, the Internet telephone system according to a preferred embodiment of the present invention includes a configuration in which the encryption unit employs a symmetric key block encryption algorithm.

In the Internet telephone system according to a preferred embodiment of the present invention, the plurality of voice codecs include a PCM type, an ADPCM type, and a CELP type voice codec.

In addition, the Internet telephone system according to a preferred embodiment of the present invention, the encryption unit employs the SEED encryption algorithm.

In addition, the Internet telephone system of the present invention for achieving the above object in the receiving system,

A receiver which distinguishes and receives a first protocol signal and a second protocol signal from a digital network;

A first protocol converter for converting the received first protocol signal into an encrypted signal;

A second protocol converter for converting the received second protocol signal into a digital signal including a call setup signal and a signal for distribution processing of an encryption key;

A decryption unit for decrypting the converted encrypted signal using an encryption key generated from a predetermined value distributed through a network roll;

A plurality of voice codecs having different sound quality, bit rate, and processing delay characteristics for decoding and outputting a signal input from the decoder;

A selection unit for selecting one of the plurality of voice codecs in consideration of the traffic amount, loss amount and jitter amount of the received signal;

A call setup and control unit for controlling the entire system and processing call setup operations;

Characterized in that it comprises a.

In addition, the Internet phone system of the present invention for achieving the above object

A plurality of voice codecs that differ in sound quality, bit rate, and processing delay characteristics, for encoding and outputting an input voice signal and for decoding and decoding the decoded signal received from the following encryption unit as a voice signal;

A selection unit for selecting one of the plurality of voice codecs in consideration of the traffic amount, loss amount and jitter amount of the received signal;

Encrypts an output signal of the voice codec selected by the selection unit using a transmission encryption key generated from the first predetermined value distributed through the network, while receiving a reception encryption key generated from the second predetermined value distributed through the network. An encryption unit for decrypting the encrypted signal received from the first protocol conversion unit by using;

A first protocol conversion unit converting the encrypted signal into a first protocol signal and performing inverse conversion thereof;

A call setup and control unit for controlling an entire system, processing distribution of the encryption key, and handling a call setup operation;

A second protocol conversion unit converting a digital signal including a call setup signal output from the control unit and a signal for encryption key distribution processing into a second protocol signal and performing inverse conversion thereof;

And a transmission / reception unit configured to transmit and receive the first protocol signal and the second protocol signal to the Internet in a mixed packet.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily practice the present invention.

IP telephony systems can take the form of PC-to-PC, Phone-to-PC, and Phone-to-Phone. When making a call using a personal computer, voice signal processing or protocol setting is done in software, so there is no need for any additional equipment other than peripheral devices such as headsets.However, when using a telephone, the telephone signal is converted into a digital signal suitable for packet communication. Requires equipment with an Internet Telephony Gateway (ITG) to convert.

The present invention can be applied to the IP telephony system of such various methods, and if the packet-based digital network as well as the Internet, it can be variously applied including the intranet.

Figure 1 shows the external appearance of the overall hardware of the present invention applied to the PC-to-PC method. The user sends and receives voices through a voice interface, such as a headset plugged into a PC, and the input analog signal is converted from the voice card to digital and performs a function as described later. The packet signal is converted into a packet signal through the LAN card attached to the PC to the Internet through the router equipment, and the packet signal arriving at the LAN card of the other PC through the other router passes through the LAN card. It is converted into an analog voice signal and outputted through the other party's headset.

In the case of a telephone-based IP telephony system, control signals such as dial tone and busy signals output from ordinary telephones are converted into call-setup signals conforming to VoIP standards such as H.323 or other Session Initiation Protocol (SIP). A known signaling gateway is added which performs the converting function. In addition, to connect with the receiver, a server that stores the address of the gateway connected to the exchange in the PSTN network is required. Such devices are well known at the time of filing the present invention and detailed descriptions thereof will be omitted. In this case, the present invention may be implemented by hardware, software, or a combination thereof within an Internet Telephony Gateway (ITG) connected between the PSTN and the Internet. Can be applied.

2A to 2C are block diagrams showing schematics of a system according to a preferred embodiment of the present invention, in which Fig. 2A shows a transmission system, Fig. 2B shows a receiving system, and Fig. 2C shows a system in which transmission and reception are integrated.

Various call signals, such as DTMF signals or software-generated tone transmitted from ordinary telephones, can be transferred to H.323 or other Session Initiation Protocol (SIP) by the call setup and control unit (25, 25 ', 25 "). It converts into call-setup signal conforming to VoIP standard and performs packet making process by adding RTP / TCP, UDP / IP header, etc. In the receiving system, the reverse process is performed, and the transmitting and receiving system is integrated. The two processes are the same for the call setup and control, as well as the distribution of public keys used in the control and encryption of the telephone system 23 and the monitoring of RTPs that transmit data packets. This call setup and control is already common in the VoIP technology field and can be implemented by those skilled in the art without further description. The features according to the unique configuration of the present invention will be described in detail later in relation to other components, and each component of the receiving system in a transmission system, a receiving system, and a system in which transmission and reception are integrated according to the present invention. Since the function of the reverse process of the function of the corresponding component of the transmitting system and the transmitting and receiving system perform these two functions simultaneously or in parallel, the following description will be focused on the function of the transmitting system.

The user's speech signal is encoded in speech codec 22 including a plurality of speech codecs. In a preferred embodiment of the present invention, a speech stream sampled at 8000 Hz is segmented into frames of a predetermined size and then compressed by a speech codec. The present invention is characterized by selecting the optimal codec in a given state by grasping the state of the current network from the received signal while including a plurality of codecs having different characteristics, each having a different bit rate and sound quality. Table 1 illustrates a group of codecs having different characteristics applicable to the present invention, and shows characteristics according to the types of speech coders.

Codec Coding type Bit rate (kbit / s) MOS Complexity Delay (ms) G.711 PCM 64 4.3 One 0.125 G.726 ADPCM 32 4.0 10 0.125 G.723.1 ACELP / MP-MLQ 6.3 / 5.3 3.8 25 37.5 G.729 CSA-CELP 8 4.0 30 15

Table 1: Speech coding standards, * Delay = frame size + look ahead time

Generally, PCM, ADPCM, and CELP type have higher compression ratio, and sound quality and compression ratio are generally in a trade-off relationship.

The G.711 codec has the best sound quality, the lowest processing delay, but the highest bit rate. G.723.1 has the lowest bit rate but lower quality than other codecs in sound quality and delay. Because G.711 and G.726 are not frame codecs, they need to be packetized for transmission over the Internet, and the size is defined in IETF's RFC 1889 standard, as shown in Table 2.

Codec G.711 G.726 G.723.1 G.729 Framing interval - - 30 10 Packetizing interval 20 20 30 20

Table 2. Frame composition and packetization interval (ms)

Packet size and packet period are defined as shown in Equation (1), and packet sizes according to voice codecs are shown in Table 3.

Packet Period = Packetization Processing Interval

Packet Size = Bit Rate × Packetization Interval (1)

Table 3. Packet Size (bytes) of Speech Coder

Codec G.711 G.726 G.723.1 G.729 Packet size 80 40 23.6 / 19.9 20

Packet size and packet period are important factors influencing QoS. The time required to make a voice packet from an analog signal is called a generation delay. When the sum of the time for compressing a voice packet into a voice coder and the delay of an algorithm is called a coder delay, a packet delay ) Is defined as in Equation (2).

Packet delay = generation delay + encoder delay (2)

The generation delay is a fixed value and is shown as an approximation of the packet period in this paper. Therefore, the packet delay depends on the encoder delay and is influenced by the complexity of the encoder algorithm and the computing power of the user system. Packet delay also plays a role in QoS.

The present invention is characterized by adopting a dynamic speech coder selection (DSS) algorithm that guarantees QoS by selecting a plurality of such codecs and adjusting a packet size actively transmitted according to a network environment.

Since voice communication over the Internet does not guarantee a constant bandwidth unlike communication in a PSTN, voice quality has many effects such as transmission protocol, status of the Internet, time slots, packet size and frequency, and distance between communication parties. Affected by the factor Among the many factors, the main factor of QoS can be represented by delay, jitter, and packet loss. When voice dealy is defined as in Equation (3), and packet delay is defined as in Equation (2), it means the time taken by the encryption delay encryptor to encrypt the voice data. .

Voice delay = packet delay + encryption delay + transmission delay + buffering delay (3)

Herein, the transmission delay is the time at which the RTP packet is delivered to the receiver, and the buffering delay is the time at which the received packets are stored in the buffer before playing. The above elements can be expressed as

Packet Delay = F (voice codec, system performance) (4)

Transmission delay = F (network traffic, distance between users, protocol type, time slot) (5)

Buffering delay = F (jitter, packet loss) (6)

Among these factors, voice delay is the most influential factor in QoS. Therefore, effective countermeasures against voice delays can improve the QoS of voice telephony systems. The packet delay can be sufficiently reduced by improving the system performance. The transmission delay is proportional to the distance between users and irregular value over time. The buffer delay varies with packet loss and jitter. In general, the larger the packet loss and jitter, the larger the value.

According to this analysis, the present invention adopts a method of guaranteeing QoS by controlling the packet size actively transmitted based on information such as network environment, packet loss rate, and jitter transmitted from the receiver as described in FIG. In order of network condition, loss rate, and jitter, priority was made to determine voice codec. That is, when the network traffic is heavy, small packet transmission is advantageous, so use the voice codec of low bit rate according to the result of Table 3. In the case where a lot of packet loss occurs, the loss rate decreases as the packet size is small, so a low rate voice codec is used. In situations where there is a lot of jitter, the buffer delay on the receiving side must be increased, and as a result, the voice delay increases, so the packet delay must be reduced. Therefore, a high bit rate encoder with low packet delay is used. The selectors 21, 21 ', 21 "process an algorithm for this selection to select one of a plurality of voice codecs.

The encryption unit 23, 23 ', 23 "of the present invention can be any algorithm that can be fast and ensure the security of the data, but preferably a symmetric key cryptography with the same encryption / decryption key. Secret key cryptography is suitable because symmetric key algorithms are faster than public key cryptography with different encryption / decryption keys, that is, asymmetric key cryptography. The encryption unit (23, 23 ', 23 ") according to the preferred embodiment of the present invention is suitable for the block encryption algorithm for processing messages in block units among the symmetric key algorithms. This block cipher algorithm refers to a function that converts n-bit plain text into n-bit cipher text of the same length. The encryption and decryption keys work in this conversion process to perform encryption and decryption. The block cipher algorithm is mostly designed in the facet (Feistel) structure, the encryption algorithm adopting this structure includes DES (Data Encryption Standard), FEAL, LOKI, MISTY, etc., encryption unit according to a preferred embodiment of the present invention (23, 23 ', 23 ") may adopt any of these encryption algorithms. This structure consists of 2t bit plaintext blocks (L0, R0) composed of t bits, L0 and R0 blocks, respectively, passing through r rounds. Lr, Rr) It is a repeating structure converted to Lr, Rr), where the number of rounds is determined by the tradeoff between the required inefficiency and the performance efficiency. In addition, it is possible to achieve full confusion between blocks by two executions, to perform faster, to implement easily, and yet to find structural problems. I have it.

Furthermore, the encryption unit 23, 23 ', 23 "of the present invention according to the preferred embodiment of the present invention includes the 128-bit block cryptographic algorithm standard (SEED) being promoted by the Korea Information and Communication Technology Association. Korea Information Security Agency (KISA), 128bit Symmetric Block Cipher, SEED, April 1999.Online document at URL: http://www.kisa.or.kr/technology/sub1/128-seed.pdf It is described in detail in the online documentation.

SEED is a symmetric key cryptography algorithm that outputs a 128-bit ciphertext block through 16 rounds using 16 64-bit round keys generated from 128-bit keys as input. As is known, the SEED encryptor is 2.5 times faster than the DES method, 2.6 times faster than the DES method, and 1.73 times faster when the IDEA method is used. Therefore, it can be used as the most suitable encryptor for the secure telephone system according to the present invention.

In order to use such an encryptor, the secret key of the encryptor must first be transmitted between users. However, the transmission of the encryptor over the Internet is very likely to eavesdropping, which can defeat the encryptor, so other measures must be taken. The present invention is characterized by including an algorithm for securely distributing such a secret key to the sender and receiver using the same digital network with which the entire system communicates. In this secret key distribution algorithm, a sender and a receiver generate a large random number, send and receive a result of performing a specific operation on each other through a network, and then obtain their own private key through a specific operation from the values sent and received. I'm taking the way.

According to a preferred embodiment of the present invention, the Diffe-Hellman public key distribution system (PKDS) may be used as a distribution algorithm of the secret key. This algorithm is described in detail in [17] W. Diffe and M. Hellman, "New Directions in Cryptography", IEEE Transactions on Information Theory, Vol 22, 1976.

These signals are converted into packets according to a plurality of protocols according to their characteristics and transmitted and received on the same transmission path. Data that is important for real-time transmission such as voice uses UDP as a transmission protocol, but there is a problem of data loss and reversal of order. As a result, RTP was proposed in 1996 and is widely used for the transmission of real-time data. RTP consists of an RTP header and payload and is transmitted using UDP. The header contains fields such as sequence number, time stamp, and SSRC, and RTP itself provides functions such as timely delivery, QoS guarantees, and reverse transmission prevention. Although not provided, there is an advantage in that QoS management is easy. The second protocol conversion section according to the preferred embodiment of the present invention adopts these RTP sections 24, 24 ', and 24 "to transmit the converted signal of the voice signal. The TCP section 26, 26 ', 26 " commonly used as an embodiment of the first protocol conversion section is used for transmission and reception of call signals and the like.

In order to solve the problems of guaranteeing QoS and security of communication, which are problems of the conventional IP telephony system, the present invention encrypts voice packets using a SEED encryptor having a faster encryption speed than DES or IDEA, and uses a Diffe-Hellman public key distribution method. By generating the secret key of the encryptor, we eliminate the possibility of secret key exposure. It also analyzes the status of factors affecting QoS, which is affected by the performance of the user's system and the network conditions, and uses the dynamic voice coder selection method (DSS) to ensure proper QoS. To provide.

In order to implement the present invention in a personal computer, a sound card that supports full-duplex communication is required. G721, G723.1, G726, G729 voice codec, SEED encryption algorithm, Differ-Hellman key distribution algorithm, RTP, TCP protocol converter, etc., adopted in the preferred embodiment of the present invention, prior to the filing date of the present invention Anyone having the present invention can easily implement the present invention. Anyone skilled in the art can easily understand and reproduce the present invention according to the above description. Although the present invention has been described in terms of specific embodiments such as specific encoding algorithms, those skilled in the art will appreciate that the present invention may be implemented using various encoding algorithms, encryption algorithms, and key distribution algorithms developed after application as well as algorithms known at the time of filing this application. Since many modifications can be easily made, the scope of the present invention should be interpreted only by the scope of the following claims.

Claims (9)

In the Internet phone system A plurality of voice codecs for encoding and outputting an input voice signal and having different sound quality, bit rate, and processing delay characteristics; A selection unit for selecting one of the plurality of voice codecs in consideration of the traffic amount, loss amount and jitter amount of the received signal; An encryption unit for encrypting an output signal of the voice codec selected by the selection unit using an encryption key generated from a predetermined value distributed through a network; A first protocol converter converting the encrypted signal into a first protocol signal; A call setup and control unit for controlling the entire system and handling call setup operations; A second protocol conversion unit converting a digital signal including a call setup signal output from the call setup and control unit and a signal for distribution processing of the encryption key into a second protocol signal; A transmitter for transmitting the first protocol signal and the second protocol signal to the Internet in a mixed packet; Internet telephone system comprising a. In the Internet telephone system according to claim 1, And the selector selects one of the plurality of voice codecs according to a priority in order of network traffic amount, loss rate, and jitter amount. In the Internet telephone system according to claim 1, And wherein the plurality of voice codecs includes voice codecs of PCM type, ADPCM type, and CELP type. In the Internet telephone system according to claim 1, And the encryption unit employs a symmetric key block encryption algorithm. In the Internet telephone system according to claim 2, And wherein the plurality of voice codecs includes voice codecs of PCM type, ADPCM type, and CELP type. In the Internet telephone system according to any one of claims 2, 3 or 5, And the encryption unit employs a symmetric key block encryption algorithm. In the Internet telephone system according to any one of claims 2, 3, and 5, And the encryption unit employs a SEED encryption algorithm. In the Internet telephone system, A receiver which distinguishes and receives a first protocol signal and a second protocol signal from a digital network; A first protocol converter for converting the received first protocol signal into an encrypted signal; A second protocol converter for converting the received second protocol signal into a digital signal including a call setup signal and a signal for distribution processing of an encryption key; A decryption unit for decrypting the converted encrypted signal using an encryption key generated from a predetermined value distributed through a network roll; A plurality of voice codecs having different sound quality, bit rate, and processing delay characteristics for decoding and outputting a signal input from the decoder; A selection unit for selecting one of the plurality of voice codecs in consideration of the traffic amount, loss amount and jitter amount of the received signal; A call setup and control unit for controlling the entire system and processing call setup operations; Internet telephone system comprising a. In the Internet phone system A plurality of voice codecs that differ in sound quality, bit rate, and processing delay characteristics, for encoding and outputting an input voice signal and for decoding and decoding the decoded signal received from the following encryption unit as a voice signal; A selection unit for selecting one of the plurality of voice codecs in consideration of the traffic amount, loss amount and jitter amount of the received signal; Encrypts an output signal of the voice codec selected by the selection unit using a transmission encryption key generated from the first predetermined value distributed through the network, while receiving a reception encryption key generated from the second predetermined value distributed through the network. An encryption unit for decrypting the encrypted signal received from the first protocol conversion unit by using; A first protocol conversion unit converting the encrypted signal into a first protocol signal and performing inverse conversion thereof; A call setup and control unit for controlling an entire system, processing distribution of the encryption key, and handling a call setup operation; A second protocol conversion unit converting a digital signal including a call setup signal output from the control unit and a signal for encryption key distribution processing into a second protocol signal and performing inverse conversion thereof; Transmitting and receiving unit for transmitting and receiving the first protocol signal and the second protocol signal to the Internet in a mixed packet; Internet telephone system comprising a.