KR20080041427A - Secure call service method using radio communication system - Google Patents

Abstract

A secure call service method using a radio communication system is provided to prevent an individual key from being exposed to the outside by storing the individual key in an EPROM(Erasable and Programmable Read Only Memory) of a terminal. A secure call service method using a radio communication system includes the steps of: transmitting an invite message of a client A(11) to a server B(12) from an SIP(Session Initiation Protocol) proxy server(301); transmitting a receipt answer(100 Trying) and a bell answer(180 Ringing) to the SIP proxy server from the server B and transmitting the answers to the client A from the SIP proxy sever(302,303); transmitting a 200 OK message to the SIP proxy server from the server B by setting an SDP(Session Description Protocol) of the server B and transmitting the 200 OK message to the client A from the SIP server when receiving an answer of the server B(304); transmitting an ACK message for informing of receipt of the message to the SIP proxy server from the client A in response to the 200 OK message and transmitting the ACK message to the server B from the SIP proxy server(305); starting real VoIP(Voice over Information Provider) voice service between the client A and the server B(306); transmitting a BYE message as an SIP message for session finish from the server B(307); and finishing the session by receiving the 200 OK message as an answer of the receipt of the BYE message from the client A(308).

Description

Secure call service method using radio communication system

1 is an explanatory diagram showing a call setup process using SIP when a terminal (UAC) and a server (UAS) to which the present invention is applied exist in the same domain;

2 is an explanatory diagram illustrating a call setup process using SIP when a terminal (UAC) and a server (UAS) to which the present invention is applied exist in different domains;

3 is a flow chart of an embodiment of a secure call method for a wireless communication service according to the present invention;

4 is an exemplary diagram illustrating a process of processing a voice signal according to a secure call method for a wireless communication service according to the present invention.

* Explanation of symbols on the main parts of the drawing

11: transmitting terminal 12: receiving terminal

21,22: SIP Proxy Server 31,32: SIP Registrar Server

41: SIP Redirect Server

The present invention relates to a secure communication method for a wireless communication service and a computer-readable recording medium recording a program for realizing the method. In particular, the present invention provides a method for sampling a voice during a WiBro communication service. The present invention relates to a secure call method and a computer readable recording medium having recorded thereon a program for realizing the method, so that only the receiver can hear the voice using public key encryption.

First, the public key infrastructure (PKI) public key infrastructure used in the present invention will be described, and the operation principle of public key and private key encryption in the certificate management system will be described.

PKI basically allows unsecured public network users, such as the Internet, to securely and secretly exchange data or funds by using a pair of public and private keys granted by a trusted authority.

PKI provides a digital certificate that identifies an individual or organization, and a directory service that stores the certificate and retrieves it when needed. Although the components of the PKI are generally known, a number of different approaches and services are emerging for each provider, and in the meantime, the Internet standard for PKI continues to work.

PKI uses public key cryptography, the most common method of authenticating a message sender or encrypting a message on the Internet. Traditional ciphertext usually involves creating and sharing a secret key that is used to encrypt and decrypt messages. Such a private or private key system has a deadly weakness that the message can be easily decrypted if the key is known to others or intercepted. For this reason, public key cryptography and PKI are preferred over the Internet.

On the other hand, in public key cryptography, a public key and a private key are created simultaneously by the certification authority using the same algorithm (commonly known as RSA). The private key is given only to the requester, and the public key is published as part of a digital certificate in a directory accessible to everyone. In addition, private keys are never shared with others or transmitted over the Internet.

The user (recipient) uses the private key (recipient's private key) to decrypt the text (message) encrypted by someone (the sender) using his public key (the recipient's public key) found in the public directory. Therefore, if a person (sender) sends a message to someone (recipient), first find the recipient's public key through the central administrator, and then encrypt the message using that public key and send it. The person (receiver) who received the message decrypts it using his private key (receiver's private key).

In addition to encrypting the message, the sender also encrypts the digital certificate with its private key and sends it together, so that the sender must know that the sender is the sender. Thus, the receiver can authenticate the sender by verifying (decrypting) the digital signature with the sender's public key when receiving a message from the sender.

These procedures are summarized in [Table 1] below.

To do the next thing ... Whose use? Which key do you use? Send encrypted message Receiver's Public key Send encrypted signature Sender's Private key Decrypt an Encrypted Message Receiver's Private key Decrypt the encrypted signature (and sender's certificate) Receiver's Public key

Now, the SIP (Session Initiation Protocol) of voice call service providing technology using VoIP will be described.

SIP is an application layer signaling protocol that identifies and locates terminals to communicate on packet networks including the Internet, and specifies procedures for creating, deleting, and changing multimedia communication sessions between them. It is also completely independent of network transport protocols and media and defines how to create, change or terminate the connection of a terminal regardless of its content.

The emergence of SIP has had a big ripple effect on the telecommunication service market using the Internet. Most existing VoIP systems are based on the H.323 protocol adopted by ITU-T as a standard. Since H.323 was originally developed to enable multi-party voice, video, and data communication in packet-switched LANs, it has a fundamental limitation in supporting broadband networks and large users. As the VoIP-related market has grown significantly, Internet telephony technology has attracted attention as a marketable technology, and SIP, a signaling protocol for bilateral / multilateral communication on the Internet, has attracted attention as a technology that replaces H.323.

SIP is an upgraded protocol of the Media Gateway Control Protocol (MGCP). MGCP was a protocol for converting voice signals of public switched telephone networks (PSTN) into IP data packets, but lacked scalability, a standard for voice signals only, and a complex signaling protocol. However, SIP is a protocol that solves the shortcomings of MGCP and presents a new environment specialized for multimedia.

In particular, SIP maintains a message type very similar to HTTP, allowing developers to develop applications more easily and quickly through popular programming languages such as Java (providing flexible extensibility). In addition, a number of premium services provided in an intelligent network of the PSTN, such as a caller ID (CID) service and a call waiting service, may be provided to the service providers.

The flexible scalability of SIP contributed to making SIP a new standard for VoIP voice services and is establishing itself as the dominant standard for the next generation of VoIP protocols. In addition, the 3G Association has selected SIP as the session control mechanism for next-generation wireless networks, and Microsoft announced that it will deploy it as the underlying protocol for real-time communication of Windows operating systems, MSN Messenger, and other applications.

The main feature of SIP is that it does not define the type of session when establishing a session, but describes how it should be operated. This flexibility allows SIP to be used in many applications, such as online gaming, conferencing, as well as VoIP voice services. In addition, SIP messages are text-based, so they can be easily interpreted and debugged, and new services can be easily and easily programmed.

SIP reuses existing protocols such as Multipurpose Internet Mail Extensions (MIME) type, Domain Name System (DNS), Real-Time Transport Protocol (RTP), and Real Time Streaming Protocol (RTSP), enabling more optimized session setup. . In addition, there is no need to define another service to support SIP.

SIP is easily extensible and enables new application services without changing existing network structures. Older SIP devices do not conflict with devices based on the newer version of SIP. This is because the new version of SIP ignores the old SIP headers and methods. In addition, since it is independent of the transport layer, it can be operated on the IP layer in the ATM network and can be transmitted through UDP and TCP regardless of the lower layer.

In order to establish a SIP session, as shown in Figs. 1 and 2, SIP user agents (UA) 11 and 12, SIP proxy servers 21 and 22, and SIP registrar servers are shown. (31,32), and SIP Redirect server (41) is required.

The SIP user agents (UA) 11, 12 collectively refer to cellular phones, PCs and other SIP-enabled terminals. Looking at its function, it establishes and operates a SIP session, classifies a terminal (sending terminal) requesting a SIP connection as a client (UAC) 11 and a terminal (receiving terminal) responding to a connection as a server (UAS) 12. do.

The SIP registrar servers 31 and 32 store the database, place information and IP address information of all UAs 11 and 12 in the domain, and respond to queries from the SIP proxy servers 21 and 22.

The SIP proxy servers 21 and 22 accept a session requested by the SIP UA 11 and inquire the SIP registrar servers 31 and 32 of the address information of the responding SIP UA 12.

The SIP proxy server 21 sends a session request to the server (UAS) 12 when the client (UAC) 11 and the server (UAS) 12 exist on the same domain (see FIG. 1), and the client ( If the UAC 11 and the server UAS are in different domains, the session request is transmitted to the proxy server 22 of the other domain (see FIG. 2).

The SIP redirect server 41 allows the SIP proxy servers 21 and 22 existing in the existing domain to directly configure the SIP session request existing in the other domain.

The SIP address format basically has a format of "sip: user_id @ domain_name" which is very similar to email. If there is no Domain Name Server (DNS), you can replace the domain_name part with an IP address. Here, the "user_id" part can be replaced with the assigned telephone number. That is, "sip: 031xxxxxxx@62.xx.xx.xx; user = phone" represents the same address in "sip: user_id @ domain_name" and SIP.

The message is text based and reuses HTTP as described above. Thus, it has the same identity as a message generated from web surfing. The SIP message is largely divided into a request made by the client (UAC) 11 and a response, which is a response from the server (UAS) 12.

Now, the SIP call setup process will be described with reference to FIGS. 1 and 2.

As shown in Fig. 1, when Client A (UAC) (Sender) 11 and Server B (UAS) (Receiver) 12 exist on the same domain (Domain A), Client A (UAC) The (sender) 11 and the server B (UAS) (receiver) 12 automatically transmit the IP address and availability to the SIP proxy server (domain A SIP proxy server) 21.

That is, if the client A (UAC) (sender) 11 transmits a communication request for the server B (UAS) (receiver) 12 to the SIP proxy server 21 at the time of call setup (101), the SIP proxy server ( 21 receives an IP address of the server (UAS) 12 through a request for address information from the SIP registrar server 31 (102, 103). Subsequently, the SIP proxy server 21 retransmits an INVITE message of the client A (UAC) (sender) 11 to the server B (UAS) (receiver) 12 (104), where SDP Information on the medium (audio, video, etc.) used by the defining client A (UAC) (sender) 11 for the session is included.

Subsequently, the server B (UAS) (receiver) 12 returns to the SIP proxy server 21 whether the call can be established and whether it can be received (105), and finally the SIP proxy server 21 receives the client A (UAC). By sending information to the (sender) 11 (106), a SIP session is established between the server B (UAS) (receiver) 12 and the client A (UAC) (sender) 11. Subsequently, the communication using RTP is point-to-point (P2P), and the actual VoIP voice service is started between Client A (UAC) (sender) 11 and Server B (UAS) (receiver) 12. Will be.

On the other hand, as shown in Fig. 2, the procedure is different if Client A (UAC) (sender) 11 and Server B (UAS) (receiver) 12 do not exist in the same domain. That is, when the client A (UAC) (sender) 11 establishes a call, it transmits a communication request for the server B (UAS) (receiver) 12 to the SIP proxy server (domain A SIP proxy server) 21. This is the same as the previous case, but since the SIP proxy server 21 is not directly connected to the domain B, the SIP redirect server 41 transmits the addresses of the SIP proxy servers 22 of the domain B (202 and 203). Then, the proxy server 21 existing in the domain A hands over the call to the proxy server 22 existing in the domain B (204), and the proxy server 22 existing in the domain B also exists in the same domain B. The SIP registrar server 32 queries the address of the server B (UAS) (recipient) 12 (205).

Subsequently, the SIP registrar server 32 existing in the domain B transmits the address information of the server B (UAS) (recipient) 12 to the SIP proxy server 22 of the domain B (206), and the SIP proxy server 22 ) Retransmits an INVITE message of client A (UAC) (sender) 11 to server B (UAS) (receiver) 12 (207). At this time, information on the medium (audio, video, etc.) used by the client A (UAC) (sender) 11 defined in the SDP for the session is included.

Subsequently, the server B (UAS) (receiver) 12 returns to the SIP proxy server 22 whether the call can be established and whether it can be received (answer message) (208), and the SIP proxy server 22 returns the domain A. The transmission is sent to the SIP proxy server 21 (209). Thereafter, the SIP proxy server 21 sends a response message to the client A (UAC) (sender) 11 (210), whereby the server B (UAS) (receiver) 12 and the client A (UAC) (sender) SIP session is established between 11). Subsequently, the communication using RTP is point-to-point (P2P), and the actual VoIP voice service is started between Client A (UAC) (sender) 11 and Server B (UAS) (receiver) 12. Will be.

Accordingly, there is an urgent need for a method for performing secret communication during a WiBro call service using the PKI public key infrastructure based on the SIP.

The present invention has been proposed to solve the above problems, and in particular, for non-communication communication during a WiBro call service, it is preferable that only the receiver listens to the voice by using a public key encryption method after sampling and converting the voice into data. It is an object of the present invention to provide a secure call method and a computer readable recording medium having recorded thereon a program for realizing the method.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

According to an aspect of the present invention, there is provided a secure call method for a wireless communication service, the method comprising: establishing a Session Initiation Protocol (SIP) session between a first and a second wireless communication terminal; Transmitting, by the first wireless communication terminal, packet data using a public key of a receiver and transmitting the packet data using a real time protocol (RTP); Receiving, by the second wireless communication terminal, the received packet data by decrypting the received packet data with its own secret key; And releasing the formed SIP session at the end of a call from one terminal.

In addition, the first wireless communication terminal, the step of encrypting the digital certificate with its secret key when transmitting the packet data transmitted together; And confirming, by the second wireless communication terminal, the digital certificate with the sender's public key, and decrypting the received packet data with its own secret key if it is valid.

Meanwhile, in the secure call method for a wireless communication service, when the first and second wireless communication terminals exist on the same domain, the first wireless communication terminal is a SIP (Session Initiation Protocol) proxy server. Sending an INVITE message, the SIP proxy server requesting address information from a SIP registrar server, and receiving a sender's public key together with an IP address of the second wireless communication terminal; Sending, by the SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Sending, by the second wireless communication terminal, a call setup to the SIP proxy server and whether or not it can be received; In response to a hook-off of the second wireless communication terminal, transmitting, by the SIP proxy server, the public key of the receiver in a 200 OK message to the first wireless communication terminal; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming that the message has been received by the SIP proxy server, the SIP proxy server transmits an ACK message to the second wireless communication terminal. Establishing a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the SIP proxy server transmits the packet data to the second wireless communication terminal and transmits the packet data to the second wireless communication terminal. Decrypting and reproducing the packet data with its private key; And upon termination of the call from one terminal, the SIP proxy server releasing the formed SIP session.

In addition, the present invention, if the first wireless communication terminal transmits the digital certificate encrypted with its own secret key when transmitting the packet data, the first SIP proxy server transmits it to the second proxy server, and the A second proxy server transmitting the second wireless communication terminal to the second wireless communication terminal so that the second wireless communication terminal verifies the digital certificate with the sender's public key and decrypts the received packet data with its own secret key if it is valid; Characterized in that further comprises.

On the other hand, the present invention, in the secure call method for a wireless communication service, when the first and second wireless communication terminals exist on a heterogeneous domain, the first wireless communication terminal on the first domain is the first domain When an INVITE message is sent to a first SIP proxy server on the first SIP proxy server, the first SIP proxy server requests address information from a SIP redirect server to obtain an address of a second SIP proxy server of a second domain from the SIP redirect server. Receiving a step; The first SIP proxy server forwarding the call to the second SIP proxy server; Requesting address information from a second SIP proxy server on the second domain to a SIP registrar server on the second domain, and receiving a sender's public key together with an IP address of the second wireless communication terminal; Sending, by the second SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Sending, by the second wireless communication terminal, whether the call can be established and received by the second SIP proxy server, and transmitting the second SIP proxy server to the first SIP proxy server; When the second wireless communication terminal receives a response (hook-off), the second SIP proxy server transmits a 200 OK message to the first SIP proxy server, and the first SIP proxy server sends a 200 OK message to the receiver. Carrying a public key to the first wireless communication terminal; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming receipt of the message to the first SIP proxy server, the first SIP proxy server sends an ACK message to the second SIP proxy. Transmitting to a server, the second SIP proxy server transmitting to the second wireless communication terminal to form a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the first SIP proxy server transmits the packet data to the second proxy server, and the second proxy server transmits the packet data to the second proxy server. Transmitting to the second wireless communication terminal to decode the packet data with its own secret key to play the packet data; And releasing, by the first and second proxy servers, the formed SIP session at the end of a call from one terminal.

In addition, the present invention, if the first wireless communication terminal transmits the digital certificate encrypted with its own secret key when transmitting the packet data, the first SIP proxy server transmits it to the second proxy server, and the A second proxy server transmitting the second wireless communication terminal to the second wireless communication terminal so that the second wireless communication terminal verifies the digital certificate with the sender's public key and decrypts the received packet data with its own secret key if it is valid; Characterized in that further comprises.

In order to achieve the above object, the present invention provides a wireless communication system having a processor, for establishing a secure call for a wireless data service, a function of establishing a Session Initiation Protocol (SIP) session between a first and a second wireless communication terminal; Transmitting, by the first wireless communication terminal, packet data with a public key of a receiver and transmitting the packet data using a real time protocol (RTP) during packet data transmission; Upon receiving the packet data, the second wireless communication terminal decrypts and receives the received packet data with its own secret key; And a computer readable recording medium having recorded thereon a program for realizing a function of releasing the formed SIP session upon termination of a call from one terminal.

In addition, the present invention, the first wireless communication terminal when transmitting the packet data by encrypting the digital certificate with its own secret key to transmit together; And a computer readable recording program for further realizing a function of the second wireless communication terminal to verify the digital certificate with the sender's public key and, if valid, to decrypt and reproduce the received packet data with its own private key. Provide the medium.

On the other hand, the present invention, if the first and the second wireless communication terminal on the same domain in the wireless communication system having a processor for a secure call for wireless data service, the first wireless communication terminal is SIP (Session Initiation Protocol) When an INVITE message is transmitted to a proxy server, the SIP proxy server requests address information from a SIP registrar server and transmits a sender's public key together with an IP address of the second wireless communication terminal. Receiving function; Sending, by the SIP proxy server, the public key of the sender to the INVITE message to the second wireless communication terminal; A function of returning, by the second wireless communication terminal, whether or not a call can be established to the SIP proxy server; Upon reception of the second wireless communication terminal (hook-off), the SIP proxy server transmitting the public key of the receiver in the 200 OK message to the first wireless communication terminal; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming that the message has been received by the SIP proxy server, the SIP proxy server transmits an ACK message to the second wireless communication terminal. Establishing a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the SIP proxy server transmits the packet data to the second wireless communication terminal and transmits the packet data to the second wireless communication terminal. Decrypting and reproducing packet data with its private key; And a computer readable recording medium having recorded thereon a program for realizing a function of releasing the formed SIP session by the SIP proxy server at the end of a call from one terminal.

In addition, the present invention, if the first wireless communication terminal transmits the digital certificate encrypted with its own secret key when transmitting the packet data, the first SIP proxy server transmits it to the second proxy server, and the A second proxy server transmits to the second wireless communication terminal, and the second wireless communication terminal checks the digital certificate with the sender's public key and, if valid, decrypts the received packet data with its own private key and plays it back. Provided is a computer readable recording medium having recorded thereon a program for further realization.

On the other hand, the present invention relates to a wireless communication system having a processor for a secure call for a wireless data service, when the first and second wireless communication terminals exist on a heterogeneous domain, the first on the first domain. When the wireless communication terminal transmits an INVITE message to the first SIP proxy server on the first domain, the first SIP proxy server requests address information from the SIP redirect server and requests the address information of the second domain. Receiving the address of the second SIP proxy server; Forwarding the call to the second SIP proxy server by the first SIP proxy server; Receiving a public key of the sender together with an IP address of the second wireless communication terminal by requesting address information from a second SIP proxy server on the second domain to a SIP registrar server on the second domain; Sending, by the second SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Replying, by the second wireless communication terminal, whether the call can be established and received by the second SIP proxy server, and transmitting the second SIP proxy server to the first SIP proxy server; When the second wireless communication terminal receives a response (hook-off), the second SIP proxy server transmits a 200 OK message to the first SIP proxy server, and the first SIP proxy server sends a 200 OK message to the receiver. Transmitting a public key to the first wireless communication terminal; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming receipt of the message to the first SIP proxy server, the first SIP proxy server sends an ACK message to the second SIP proxy. Transmitting to a server, the second SIP proxy server transmitting to the second wireless communication terminal to form a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the first SIP proxy server transmits the data to the second proxy server, which is then transmitted to the second proxy server. Transmits the packet data to the second wireless communication terminal so that the second wireless communication terminal decrypts and reproduces the packet data with its own secret key; And a computer readable recording medium having recorded thereon a program for realizing a function of releasing the formed SIP session by the first and second proxy servers upon termination of a call from one terminal.

In addition, the present invention, if the first wireless communication terminal transmits the digital certificate encrypted with its own secret key when transmitting the packet data, the first SIP proxy server transmits it to the second proxy server, and the A second proxy server transmits to the second wireless communication terminal, and the second wireless communication terminal checks the digital certificate with the sender's public key and, if valid, decrypts the received packet data with its own private key and plays it back. Provided is a computer readable recording medium having recorded thereon a program for further realization.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

For the present invention, the transmitting terminal (client (UAC) (sender) 11) uses an analog / digital converter (A / D converter) for converting an analog audio signal into a digital signal, and uses a smaller bandwidth of the digital signal. There is a need for a vocoder for transmission and an encryption module for encrypting digital signals.

In addition, for the present invention, the receiving terminal (server (UAS) (receiver) 12) includes a digital / analog converter (D / A converter) for converting a digital signal into a voice signal, and a decoder for reproducing a digital signal ( Decoder), and a decoding module for decoding a digital signal is required.

In addition, a private key (transmitter / receiver private key) used for message decryption (decryption) and encryption of a signature is typically a memory (EPROM) and other auxiliary storage devices (USB memory, etc.) implemented in the terminals 11 and 12. The public key (transmitter / recipient's public key) used for message encryption and decryption (decryption) of the encrypted signature is connected and stored with the SIP registrar servers 31 and 32 together with the address information. .

In order to use a voice secret call (secure call) service implemented using SIP according to the present invention, a client (UAC) 11 communicates with a server (UAS) 12.

In particular, in order to use the secure call (non-communication) service proposed by the present invention, when the client (UAC) 11 sends an INVITE message (call setup request message), the SIP proxy servers 21 and 22 are SIP registrar servers ( 31, 32 receives the IP address and the public key of the server (UAS) 12 through the address information request. When the call setup request message (INVITE message) is sent to the receiving server (UAS) 12, the public key of the sending client (UAC) 11 is also sent. When the 200 OK message is sent to the sending client (UAC) 11, the public key information of the receiving server (UAS) 12 is also sent.

Then, a secure call method for a wireless communication service according to the present invention will be described in more detail with reference to FIG. 3.

Hereinafter, the case where Client A (UAC) (sender) 11 and Server B (UAS) (receiver) 12 exist on the same domain (domain A), and Client A (UAC) (sender) 11 A description will be given of the case where the server B (UAS) (receiver) 12 does not exist in the same domain.

First, referring to FIG. 1, a call setup procedure in which a client A (UAC) (sender) 11 and a server B (UAS) (receiver) 12 exist on the same domain (domain A) will be described. (I.e., Client A (UAC) 11) attempts to call any recipient (i.e., Server B (UAS) 12), so that Client A (UAC) (sender) 11 sends a SIP proxy server ( 21, if the SDP (Session Description Protocol) of the transmitting terminal (Client A (UAC) (sender) 11) is set and an INVITE message is transmitted, the SIP proxy server 21 sends the address information to the SIP registrar server 31. The request receives the IP address of the server (UAS) 12. At this time, the public key information of the client A (UAC) (sender) 11 is transmitted along with the IP address information of the server B (UAS) (receiver) 12. Subsequently, the SIP proxy server 21 sends an INVITE message of the client A (UAC) (sender) 11 to the server B (UAS) (receiver) 12 (301). At this time, information about the medium (audio, video, etc.) used by the client A (UAC) (sender) 11 defined in the SDP for the session is included. In particular, the INVITE message includes the client A (UAC) (sender) ( Public key information of 11) is transmitted together.

On the other hand, the server B (UAS) (receiver) 12 returns to the SIP proxy server 21 whether call setup is possible and whether reception is possible (302 to 304).

That is, the server B (UAS) (receiver) 12 transmits a reception response (100 Trying) and a ring response (180 ringing) to the SIP proxy server 21, and the SIP proxy server 21 sends it to the client A (UAC). (Sender) 11 (302,303). If the receiver responds (hook-off), the server B (UAS) (receiver) 12 sends the SDP of the receiving terminal (server B (UAS) (receiver) 12) to the SIP proxy server 21. A 200 OK message is set and the SIP proxy server 21 transmits the message to the client A (UAC) (sender) 11 (304). At this time, when sending a 200 OK message to the client A (UAC) (sender) 11, the public key information of the receiving server (UAS) 12 is also sent.

In response to the 200 OK message, Client A (UAC) (sender) 11 sends an ACK message confirming that the message has been received to SIP Proxy Server 21, which SIP Server 21 sends to Server B. (UAS) (receiver) 12 to transmit (305).

In this way, a SIP session is established between the server B (UAS) (receiver) 12 and the client A (UAC) (sender) 11. Subsequently, the communication using RTP is point-to-point, and the actual VoIP voice service (voice) is performed between Client A (UAC) (sender) 11 and Server B (UAS) (receiver) 12. Call service) is initiated (306). At this time, in a state where the call session is connected, in addition to the VoIP voice call service, it is also possible to transmit and receive text, voice, image, video music files and the like in real time.

Thus, Client A (UAC) (sender) 11 or Server B (UAS) (receiver) 12 sends the message to the other party (Server B (UAS) (receiver) 12 or Client A (UAC) (sender). (11)), the message is encrypted and sent using the public key of the other party (Server B (UAS) (receiver) 12 or Client A (UAC) (sender) 11). Then, the other party (Server B (UAS) (receiver) 12 or Client A (UAC) (sender) 11) receiving the message decrypts the message using its private key stored in the memory.

At this time, in addition to encrypting the message, Client A (UAC) (sender) 11 or Server B (UAS) (receiver) 12 encrypts the digital certificate using its private key and sends it together, Server B (UAS) (receiver) 12 or Client A (UAC) (sender) 11 receives a digital signature upon receipt of the message (the client A (UAC) (sender) 11 or server B (UAS) (receiver). (12)), the other party (Client A (UAC) (sender) 11 or Server B (UAS) (receiver) 12) can be authenticated.

Thereafter, the call termination may be performed by anyone receiving or transmitting first. However, FIG. 3 illustrates a process of performing termination first at the server B (UAS) (receiver) 12 side. That is, the server B (UAS) (receiver) 12 transmits a BYE message, which is a SIP message for terminating a session (307), and receives a 200 OK message from the client A (UAC) (sender) 11 in response thereto. Receive (308) to end the session.

Meanwhile, referring to FIG. 2, referring to the call setup procedure when the client A (UAC) (sender) 11 and the server B (UAS) (receiver) 12 do not exist in the same domain, the sender (that is, Client A (UAC) 11 attempts to call any recipient (i.e., Server B (UAS) 12) so that Client A (UAC) (sender) 11 sends to SIP proxy server 21. When the INVITE message is transmitted by setting the Session Description Protocol (SDP) of (Client A (UAC) (Sender) 11), the SIP of the domain A is not directly connected because the SIP proxy server 21 is not directly connected to the domain B. The proxy server 21 requests address information from the SIP redirect server 41 and receives the address of the SIP proxy server 22 of the domain B from the SIP redirect server 41. Thereafter, the proxy server existing in the domain A ( 21) passes the call to the proxy server 22 existing in domain B, and the proxy existing in domain B. The server 22 queries the address of the server B (UAS) (recipient) 12 by requesting address information from the SIP registrar server 32, which also exists in the same domain B, and requests the server B from the SIP registrar server 32. (UAS) (receiver) 12 receives the address information, at this time, the public key information of the client A (UAC) (sender) 11 together with the IP address information of the server B (UAS) (recipient) 12; Subsequently, the SIP proxy server 22 transmits an INVITE message of the client A (UAC) (sender) 11 to the server B (UAS) (receiver) 12 (301). In this case, information about the medium (voice, video, etc.) used by the client A (UAC) (sender) 11 defined in the SDP for the session is included, and in particular, the client A (UAC) (sender) ( Public key information of 11) is transmitted together.

In response, the server B (UAS) (receiver) 12 returns to the SIP proxy server 22 whether the call can be established and whether or not it can be answered (response message), and the SIP proxy server 22 sends the SIP of the domain A to the SIP proxy server 22. It transmits to the proxy server 21 (302-304).

That is, the server B (UAS) (receiver) 12 transmits a reception response (100 Trying) and a ring response (180 ringing) to the SIP proxy server 22, and the SIP proxy server 22 proxies the proxy of domain A. By transmitting to the server 21, the proxy server 21 of domain A transmits it back to the client A (UAC) (sender) 11 (302, 303). If the receiver responds (hook-off), the server B (UAS) (receiver) 12 sends the SDP of the receiving terminal (server B (UAS) (receiver) 12) to the SIP proxy server 22. Set and transmit a 200 OK message, the SIP proxy server 22 sends it to the proxy server 21 of domain A, and the proxy server 21 of domain A again sends it to a client A (UAC) (sender) 11 (304). At this time, when sending a 200 OK message to the client A (UAC) (sender) 11, the public key information of the receiving server (UAS) 12 is also sent.

Here, referring to the process of obtaining the public key information of the receiving server (UAS) 12, the SIP proxy server 22 of the domain B requests the address information from the SIP redirect server 41 and the SIP redirect server 41. Receives the address of the SIP proxy server 21 of domain A. Subsequently, the proxy server 22 existing in the domain B hands over the call to the proxy server 21 existing in the domain A, and the proxy server 21 existing in the domain A is also a SIP registrar existing in the same domain A. The server 31 queries the address of the client A (UAC) (sender) 11 by requesting address information, and transmits the address information of the client A (UAC) (sender) 11 from the SIP registrar server 31. Receive. At this time, the public key information of the server B (UAS) (receiver) 12 is received along with the IP address information of the client A (UAC) (sender) 11.

In response to the 200 OK message, Client A (UAC) (sender) 11 transmits an ACK message confirming that the message has been received to SIP Proxy Server 21, which SIP B 21 The proxy server 22 of domain B transmits it to the server B (UAS) (recipient) 12 again (305).

In this way, a SIP session is established between the server B (UAS) (receiver) 12 and the client A (UAC) (sender) 11. Subsequently, the communication using RTP is point-to-point, and the actual VoIP voice service (voice) is performed between Client A (UAC) (sender) 11 and Server B (UAS) (receiver) 12. Call service) is initiated (306). At this time, in a state in which the call session is connected, not only a voice call service but also a text, voice, image, video music file, etc. may be transmitted and received in real time.

Thus, Client A (UAC) (sender) 11 or Server B (UAS) (receiver) 12 sends the message to the other party (Server B (UAS) (receiver) 12 or Client A (UAC) (sender). (11)), the message is encrypted and sent using the public key of the other party (Server B (UAS) (receiver) 12 or Client A (UAC) (sender) 11). Then, the other party (Server B (UAS) (receiver) 12 or Client A (UAC) (sender) 11) receiving the message decrypts the message using its private key stored in the memory.

At this time, in addition to encrypting the message, Client A (UAC) (sender) 11 or Server B (UAS) (receiver) 12 encrypts the digital certificate using its private key and sends it together, Server B (UAS) (receiver) 12 or Client A (UAC) (sender) 11 receives a digital signature upon receipt of a message from the other party (Client A (UAC) (sender) 11 or server B (UAS) (receiver). (12)), the other party (Client A (UAC) (sender) 11 or Server B (UAS) (receiver) 12) can be authenticated.

Thereafter, the call termination may be performed by anyone receiving or transmitting first. However, FIG. 3 illustrates a process of performing termination first at the server B (UAS) (receiver) 12 side. That is, the server B (UAS) (receiver) 12 transmits a BYE message, which is a SIP message for terminating a session (307), and receives a 200 OK message from the client A (UAC) (sender) 11 in response thereto. Receive (308) to end the session.

The processing of voice data on the terminals (Client A (UAC) (sender) 11, Server B (UAS) (receiver) 12) is as shown in FIG.

On the client A (UAC) (sender) 11 side, analog voice data is sampled and digitized for data transmission in an analog / digital converter. The sampled digital signal is compressed through a vocoder, encrypted using a public key value of the other party (Server B (UAS) (receiver) 12) in an encryption module, and then memory (EPROM). Or a digital certificate using its own private key (the private key of Client A (UAC) (sender) 11) stored in the auxiliary storage device and attached to the back. Then, the data is transmitted through multiple access encoding and modulation.

On the other hand, on the server B (UAS) (receiver) 12 side, after demodulating (demodulating) the received data and multiple access decoding (Multiple Access Decoding), the other party (client A (UAC) (sender) 11) Check the digital certificate with the public key, and use the private key (Server B (UAS) (receiver) (12)) stored in memory (EPROM) or other auxiliary storage device to verify the other party (client A (UAC) (sender). (11)) to decode the data (for example, voice data).

Conversely, server B (UAS) (receiver) 12 may send a message to client A (UAC) (sender) 11, in which case server B (UAS) (receiver) 12 may send client A. Performs the same function as (UAC) (sender) 11 to encrypt and send a message, and Client A (UAC) (sender) 11 performs the same function as Server B (UAS) (receiver) 12. The message is decrypted and played.

In the above, in the actual implementation, the multi-access decoding process may or may not exist depending on the characteristics of the communication system and the implementation method.

In addition, the digital signature may be attached to every data packet, may be sent only at the initial call setup, and may be implemented not to be transmitted in some cases.

In the case of encryption, the present invention has been described with reference to only the encryption method using the public key method, but it is also possible to use the secret key encryption method in parallel or to use only the secret key encryption method.

Here, in the case of using a secret key encryption method in parallel, during the initial call setup process, the transmitting or receiving terminal (11, 12) transmits the secret key in the first packet, and then encrypts or uses the secret key. The key can be received from the server of the communication service company and encrypted using the secret key. When using only the secret key encryption method, each terminal 11, 12 may have a corresponding secret key value in the EPROM in the terminals 11, 12 or may be allocated from a server of a communication service company and used for encryption.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

According to the present invention as described above, it is possible to provide a voice call service that can not be intercepted by using a wireless data service, the call can be set at the same time as the call setup time required to provide the existing VOIP call service, and also the private key There is an effect that can be fundamentally prevented from being exposed to the outside by storing the in an EPROM in the terminal device.

Claims (14)

In the secure call method for a wireless communication service, Establishing a Session Initiation Protocol (SIP) session between the first and second wireless communication terminals; Transmitting, by the first wireless communication terminal, packet data using a public key of a receiver and transmitting the packet data using a real time protocol (RTP); Receiving, by the second wireless communication terminal, the received packet data by decrypting the received packet data with its own secret key; And Releasing the formed SIP session upon termination of a call from one terminal; Secure call method for a wireless communication service comprising a. The method of claim 1, Encrypting, by the first wireless communication terminal, the digital certificate with its private key and transmitting the packet data together with the private key; And Checking, by the second wireless communication terminal, the digital certificate with the sender's public key, and decrypting the received packet data with its own secret key if it is valid; Secure call method for a wireless communication service further comprising. The method according to claim 1 or 2, The first and second wireless communication terminal, It is possible to transmit and receive the packet data, secure call method for a wireless communication service, characterized in that present in the same domain or heterogeneous domain. The method of claim 3, wherein The digital certificate, Secure call method for a wireless communication service, characterized in that attached to every data packet transmission, or transmitted only at the initial call setup. The method of claim 3, wherein When the first and second wireless communication terminals exist on the same domain, the step of establishing a SIP session between the first and second wireless communication terminals, When the first wireless communication terminal transmits an INVITE message to a SIP proxy server, the SIP proxy server requests address information from a SIP registrar server and publishes the sender together with the IP address of the second wireless communication terminal. Receiving a key; Sending, by the SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Sending, by the second wireless communication terminal, a call setup to the SIP proxy server and whether or not it can be received; In response to a hook-off of the second wireless communication terminal, transmitting, by the SIP proxy server, the public key of the receiver in a 200 OK message to the first wireless communication terminal; And In response to the 200 OK message, transmitting an ACK message confirming that the first wireless communication terminal has received the message to the SIP proxy server, and transmitting the ACK message to the second wireless communication terminal. Secure call method for a wireless communication service comprising a. The method of claim 3, wherein When the first and second wireless communication terminals exist on heterogeneous domains, the process of establishing a SIP session between the first and second wireless communication terminals may include: When the first wireless communication terminal on the first domain transmits an INVITE message to the first SIP proxy server on the first domain, the first SIP proxy server requests address information from the SIP redirect server to the SIP. Receiving an address of a second SIP proxy server of a second domain from a redirect server; Forwarding the call to the second SIP proxy server by the first SIP proxy server; Requesting address information from a second SIP proxy server on the second domain to a SIP registrar server on the second domain, and receiving a sender's public key together with an IP address of the second wireless communication terminal; Sending, by the second SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Sending, by the second wireless communication terminal, to the second SIP proxy server whether a call can be established and whether the call can be received, and transmitting the second SIP proxy server to the first SIP proxy server; When the second wireless communication terminal receives a response (hook-off), the second SIP proxy server transmits a 200 OK message to the first SIP proxy server, and the first SIP proxy server sends a 200 OK message to the receiver. Carrying a public key to the first wireless communication terminal; And In response to the 200 OK message, the first wireless communication terminal transmits an ACK message confirming that the message has been received by the first SIP proxy server, and the first SIP proxy server sends the message to the second SIP proxy server. And transmitting, by the second SIP proxy server, an ACK message to the second wireless communication terminal. Secure call method for a wireless communication service comprising a. In the secure call method for a wireless communication service, When the first and second wireless communication terminals exist on the same domain, when the first wireless communication terminal transmits an INVITE message to a Session Initiation Protocol (SIP) proxy server, the SIP proxy server is a SIP registrar. Requesting address information from a server and receiving a sender's public key together with an IP address of the second wireless communication terminal; Sending, by the SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Sending, by the second wireless communication terminal, a call setup to the SIP proxy server and whether or not it can be received; In response to a hook-off of the second wireless communication terminal, transmitting, by the SIP proxy server, the public key of the receiver in a 200 OK message to the first wireless communication terminal; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming that the message has been received by the SIP proxy server, the SIP proxy server transmits an ACK message to the second wireless communication terminal. Establishing a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the SIP proxy server transmits the packet data to the second wireless communication terminal and transmits the packet data to the second wireless communication terminal. Decrypting and reproducing the packet data with its private key; And Upon termination of a call from one terminal, the SIP proxy server releasing the formed SIP session Secure call method for a wireless communication service comprising a. In the secure call method for a wireless communication service, When the first and second wireless communication terminals exist in the heterogeneous domain, when the first wireless communication terminal on the first domain transmits an INVITE message to the first SIP proxy server on the first domain, Requesting, by the first SIP proxy server, address information from the SIP redirect server, and receiving an address of a second SIP proxy server of a second domain from the SIP redirect server; The first SIP proxy server forwarding the call to the second SIP proxy server; Requesting address information from a second SIP proxy server on the second domain to a SIP registrar server on the second domain, and receiving a sender's public key together with an IP address of the second wireless communication terminal; Sending, by the second SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Sending, by the second wireless communication terminal, whether the call can be established and received by the second SIP proxy server, and transmitting the second SIP proxy server to the first SIP proxy server; When the second wireless communication terminal receives a response (hook-off), the second SIP proxy server transmits a 200 OK message to the first SIP proxy server, and the first SIP proxy server sends a 200 OK message to the receiver. Carrying a public key to the first wireless communication terminal; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming receipt of the message to the first SIP proxy server, the first SIP proxy server sends an ACK message to the second SIP proxy. Transmitting to a server, the second SIP proxy server transmitting to the second wireless communication terminal to form a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the first SIP proxy server transmits the packet data to the second proxy server, and the second proxy server transmits the packet data to the second proxy server. Transmitting to the second wireless communication terminal to decode the packet data with its own secret key to play the packet data; And Upon termination of a call from one terminal, the first and second proxy servers releasing the formed SIP session Secure call method for a wireless communication service comprising a. The method according to claim 7 or 8, When the first wireless communication terminal transmits the digital certificate by encrypting it with its private key and transmits the packet data, the first SIP proxy server transmits the digital certificate to the second proxy server, and the second proxy server transmits the digital certificate. Transmitting to the second wireless communication terminal so that the second wireless communication terminal checks the digital certificate with the sender's public key and decrypts the received packet data with its own secret key if it is valid, and then plays it. Secure call method for a wireless communication service further comprising. In a wireless communication system having a processor for secure call for wireless data service, Establishing a Session Initiation Protocol (SIP) session between the first and second wireless communication terminals; Transmitting, by the first wireless communication terminal, packet data with a public key of a receiver and transmitting the packet data using a real time protocol (RTP) during packet data transmission; Upon receiving the packet data, the second wireless communication terminal decrypts and receives the received packet data with its own secret key; And A function of releasing the formed SIP session upon termination of a call from one terminal. A computer-readable recording medium having recorded thereon a program for realizing this. The method of claim 10, The first wireless communication terminal encrypts the digital certificate with its private key and transmits the packet data with the private key; And The second wireless communication terminal checks the digital certificate with the sender's public key, and if it is valid, decrypts the received packet data with its private key and plays it back; A computer-readable recording medium that records a program for further realization. In a wireless communication system having a processor for secure call for wireless data service, When the first and second wireless communication terminals exist on the same domain, when the first wireless communication terminal transmits an INVITE message to a Session Initiation Protocol (SIP) proxy server, the SIP proxy server is a SIP registrar. Requesting address information from a server and receiving a sender's public key together with an IP address of the second wireless communication terminal; Sending, by the SIP proxy server, the public key of the sender to the INVITE message to the second wireless communication terminal; A function of returning, by the second wireless communication terminal, whether or not a call can be established to the SIP proxy server; A function of sending, by the SIP proxy server, a public key of the receiver in a 200 OK message to the first wireless communication terminal when the second wireless communication terminal receives a hook-off; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming that the message has been received by the SIP proxy server, the SIP proxy server transmits an ACK message to the second wireless communication terminal. Establishing a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the SIP proxy server transmits the packet data to the second wireless communication terminal and transmits the packet data to the second wireless communication terminal. Decrypting and reproducing packet data with its private key; And Upon termination of a call from one terminal, the SIP proxy server releases the formed SIP session A computer-readable recording medium having recorded thereon a program for realizing this. In a wireless communication system having a processor for secure call for wireless data service, When the first and second wireless communication terminals exist in the heterogeneous domain, when the first wireless communication terminal on the first domain transmits an INVITE message to the first SIP proxy server on the first domain, A first SIP proxy server requests address information from a SIP redirect server to receive an address of a second SIP proxy server of a second domain from the SIP redirect server; Forwarding the call to the second SIP proxy server by the first SIP proxy server; Receiving a public key of the sender together with an IP address of the second wireless communication terminal by requesting address information from a second SIP proxy server on the second domain to a SIP registrar server on the second domain; Sending, by the second SIP proxy server, the sender's public key to the second wireless communication terminal in the INVITE message; Replying, by the second wireless communication terminal, whether the call can be established and received by the second SIP proxy server, and transmitting the second SIP proxy server to the first SIP proxy server; When the second wireless communication terminal receives a response (hook-off), the second SIP proxy server transmits a 200 OK message to the first SIP proxy server, and the first SIP proxy server sends a 200 OK message to the receiver. Transmitting a public key to the first wireless communication terminal; In response to the 200 OK message, when the first wireless communication terminal transmits an ACK message confirming receipt of the message to the first SIP proxy server, the first SIP proxy server sends an ACK message to the second SIP proxy. Transmitting to a server, the second SIP proxy server transmitting to the second wireless communication terminal to form a SIP session; When the first wireless communication terminal encrypts the packet data with the public key of the receiver and transmits the packet data using a real time protocol (RTP), the first SIP proxy server transmits the packet data to the second proxy server, and the second proxy server transmits the packet data to the second proxy server. Transmitting to the second wireless communication terminal so that the second wireless communication terminal decrypts and reproduces the packet data with its own secret key; And Upon termination of a call from one terminal, the first and second proxy servers release the formed SIP session A computer-readable recording medium having recorded thereon a program for realizing this. The method according to claim 12 or 13, When the first wireless communication terminal transmits the digital certificate by encrypting it with its private key and transmits the packet data, the first SIP proxy server transmits the digital certificate to the second proxy server, and the second proxy server transmits the digital certificate. Transmitting to a second wireless communication terminal so that the second wireless communication terminal checks the digital certificate with the sender's public key and, if valid, decrypts the received packet data with its private key and plays it back. A computer-readable recording medium that records a program for further realization.

Images