KR20090067041A - Method and apparatus for sip registering and establishing sip session with enhanced security - Google Patents

Abstract

A method and an apparatus for registering an sip and establishing an sip session with enhanced security are provided to effectively support mobility and supply a safe multimedia session setup function by using efficient and simple authentication and security methods. A communication unit(106) receives an SIP registration request message from a terminal(104). The communication unit transmits the SIP registration request message to the terminal. A field restoring unit(108) restores an encoded field of the SIP registration request message. A terminal registering unit(110) registers the terminal by using the restored field. The terminal authentication unit(112) authenticates the terminal.

Description

Method and device for strengthening security registration and setting SSI sessions {METHOD AND APPARATUS FOR SIP REGISTERING AND ESTABLISHING SIP SESSION WITH ENHANCED SECURITY}

The present invention relates to a SIP registration and a SIP session establishment method and apparatus, and more particularly, to a security registration enhanced SIP registration and SIP session establishment method and apparatus.

For real-time multimedia communication, nodes wanting to communicate need to designate the connection point of the media traffic by exchanging information of the connection point between the end points. To this end, many signaling protocols are being developed and operated. Currently, SIP (Session Initiaion Protocol) is being spotlighted as various multimedia session control protocols including VoIP.

In order for terminals using SIP to exchange data with each other, session establishment between terminals is required. And before establishing such a session, each terminal must go through a registration process of registering the terminal with the SIP server to use the SIP service. In this registration process and session establishment process, various SIP messages come and go between the terminal and the terminal and between the terminal and the server. However, since these SIP messages are all in the plain text state, a security vulnerability such as a malicious user stealing, altering, or tampering with a SIP message occurs.

In order to solve this security problem of SIP, several methods have been proposed. For example, the SIP standard by RFC 3261 specifies data protection by Transport Layer Security (TLS). TLS is a technology similar to that served on the web, which protects signals from SIP nodes. However, TLS is used to protect information in intervals in principle and cannot provide end-to-end information protection function in the SIP service structure. In addition, since TLS is based on a certificate on Transmission Control Protocol (TCP), it can cause a load problem due to certificate management between nodes using SIP. This problem can be particularly disadvantageous for load-sensitive mobile nodes.

Therefore, there is a need for a more efficient and concise authentication and security scheme to solve the SIP security problem.

Accordingly, an object of the present invention is to perform SIP registration and SIP session establishment that can solve security threats such as session hijacking, eavesdropping, and forced session termination due to SIP message modification.

Another object of the present invention is to provide an efficient mobility support and a secure multimedia session establishment function by using a more efficient and concise authentication and security method.

The objects of the present invention are not limited to the above-mentioned objects, and other objects and advantages of the present invention, which are not mentioned above, can be understood by the following description, and more clearly by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

In order to achieve the above object, the present invention provides a method for registering a terminal of a SIP server, comprising: receiving a Session Initiation Protocol (SIP) registration request message including an encrypted field from a terminal, restoring an encrypted field, and restoring the restored field And registering a terminal by using the field and transmitting a SIP registration response message to the terminal.

The present invention also provides a SIP registration method of a terminal, comprising: generating a SIP registration request message including an encrypted field, transmitting a SIP registration request message to a SIP server, and a response to the SIP registration request message from the SIP server; Another step is to include receiving a SIP registration response message.

In another aspect, the present invention provides a method for managing session establishment between terminals of a SIP server, the method comprising: receiving a SIP session request message from a first terminal and transmitting the same to a second terminal, for encrypting a session established between the first and second terminals Transmitting the first media key generation information used for generating the media key to the second terminal, receiving a SIP session response message for the SIP session request message from the second terminal, and transmitting the same to the first terminal; Another feature is the step of transmitting the second media key generation information used to the first terminal.

The present invention also provides a method for establishing a SIP session of a terminal, comprising: generating a SIP session request message for a receiving terminal, transmitting a SIP session request message to a receiving terminal, a SIP session response message which is a response to a SIP session request message; And receiving the media key generation information used to generate the media key for encrypting the session set up with the receiving terminal.

In another aspect, the present invention provides a method for establishing a SIP session of a terminal, the method comprising receiving a SIP session request message from an originating terminal, and generating media key generation information used for generating a media key for encrypting a session set up with an originating terminal. In another aspect, the method includes transmitting a SIP session response message, which is a response to the step of receiving and a SIP session request message.

According to the present invention as described above, there is an advantage that can perform SIP registration and SIP session establishment that can solve security threats such as session hijacking, eavesdropping, forced session termination due to SIP message modification.

In addition, the present invention has the advantage of providing an efficient mobility support and secure multimedia session setup by using a more efficient and concise authentication and security method.

The above objects, features, and advantages will be described in detail with reference to the accompanying drawings, whereby those skilled in the art to which the present invention pertains may easily implement the technical idea of the present invention. In describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used to indicate the same or similar components.

1 is a block diagram showing the configuration of a SIP server and a terminal for performing a SIP registration process according to an embodiment of the present invention.

In FIG. 1, the SIP server 102 includes a communication unit 106, a field recovery unit 108, a terminal registration unit 110, and a terminal authentication unit 112. First, the communication unit 106 plays a role of exchanging data with the terminal 104. In particular, the communication unit 106 receives a SIP registration request message from the terminal 104, and when the terminal 104 registration is completed, the terminal receives a SIP registration response message. It serves to transmit to 104. The SIP registration response message may include a random number for generating a session key used for establishing a secure session in a process of establishing a session between terminals, which will be described later. In the SIP session establishment process that occurs after the SIP registration process, each terminal generates a session key using this random number and secures the session established using this session key.

The field recovery unit 108 restores an encrypted field included in the SIP registration request message received from the terminal 104 through the communication unit 106. The terminal registration unit 110 registers the terminal by using the field restored by the field restoration unit 108.

The terminal authenticator 112 performs authentication on the terminal 104 requesting SIP registration. This authentication process is to supplement the existing security weak SIP registration process, the SIP server 102 performs the SIP registration process only for the terminal successful authentication through this authentication process. The terminal 104 may include an authenticator required for the authentication process in the SIP registration request message or transmit it to the SIP server 102 together with the SIP registration request message.

Next, the terminal 104 includes a communication unit 114, a message generator 116 and a session key generator 118. First, the communication unit 114 performs a role of exchanging data with the SIP server 102. In particular, the communication unit 114 transmits a SIP registration request message to the SIP server 102, and responds to the SIP registration request message from the SIP server 102. Receive SIP registration response message. The SIP registration request message may include a random number for generating a session key as mentioned above, and may also include an authenticator for requesting authentication to the SIP server 102.

The session key generation unit 118 generates a session key by using a random number included in the SIP registration response message transmitted from the SIP server 102. This session key is used to secure the session in the SIP session establishment process following the SIP registration process, which will be described later.

2 is a block diagram showing the configuration of a SIP server and a terminal for performing a SIP session establishment process according to another embodiment of the present invention.

In FIG. 2, the SIP server 204 manages session establishment between the originating terminal 202 and the receiving terminal 206. The originating terminal 202 and the receiving terminal 206 are each terminals using a SIP for session establishment. The originating terminal 202 is a user agent client (UAc) for the receiving terminal 206, and the receiving terminal 206 is an originating terminal. The terminal 202 may also be referred to as a user agent server (UAs). UAc and UAs are relative concepts and may be interchanged depending on who requests the session.

First, the calling terminal 202 includes a communication unit 208, a message generating unit 210, a media key management unit 212 and a session manager 214. The communication unit 208 transmits a SIP session request message to the receiving terminal 206 and receives a SIP session response message, which is a response to the SIP session request message.

The message generator 210 generates a SIP session request message for the receiver terminal 206. The media key management unit 212 receives the media key generation information used to generate the media key for encrypting the session set up with the reception terminal 206. In addition, the media key management unit 212 generates a media key using the received media key generation information.

The session manager 214 sets up and manages a session with the receiving terminal 206, which is encrypted using the media key generated by the media key manager 212. When data transmission between terminals is completed after the session is established, the message generator 210 may generate a session end message for ending the session and transmit a session end message to the receiving terminal 206 through the communication unit 208. The session end message may include an authenticator generated by using the previously generated media key. The authentication process by the authenticator is intended to prevent the session from being terminated even if the user does not want it by a malicious hacker or the like.

The SIP server 204 includes a communication unit 216, a media key generation information management unit 218, an encryption unit 220, an authentication unit 222, and a session management unit 224. The communication unit 216 receives the SIP session request message from the calling terminal 202 and transmits the received SIP session request message to the receiving terminal 206, and receives the SIP session response message for the SIP session request message from the receiving terminal 206. 202).

The media key generation information management unit 218 generates first media key generation information used to generate a media key for encrypting a session set up between the calling terminal 202 and the receiving terminal 204 and generates the first key information. send. It also plays a role of generating second media key generation information used for media key generation and transmitting it to the calling terminal 202.

Meanwhile, the encryption unit 220 encrypts the SIP session request message, the SIP session response message, the first media key generation information, and the second media key generation information. In the encryption process of the encryption unit 220, the first session key generated during the registration process of the calling terminal 202 or the second session key generated during the registration process of the receiving terminal 206 is used.

The authenticator 222 authenticates the SIP session request message from the originating terminal 202 or the SIP session response message from the receiving terminal 206. For this authentication process, the authenticator of the originating terminal 202 and the receiving terminal 206 may be included in the SIP session request message and the SIP session response message, respectively. And when the first media key generation information and the second media key generation information are transmitted to the calling terminal 202 and the receiving terminal 204 by the media key generation information management unit 218 of the SIP server 204, respectively. The terminal may perform an authentication process for this media key generation information. Therefore, the authenticator 222 may play a role in generating and managing a server authenticator used in the authentication process of the media key generation information.

The session manager 224 establishes a session between the calling terminal 202 and the receiving terminal 206. At this time, the session is encrypted through the media key generated by the first media key generation information or the second media key generation information. When data transmission by the established session is completed, the session manager 224 transmits a session end message of the calling terminal 202 or the receiving terminal 206 to the receiving terminal 206 or the calling terminal 202. The session manager 224 then terminates the established session. At this time, the session end message may include an authenticator generated using the media key for security.

The receiving terminal 206 includes a communication unit 226, a media key manager 228, and a session manager 230. The communication unit 226 receives the SIP session request message from the originating terminal 202 and transmits a SIP session response message, which is a response to the SIP session request message.

The media key manager 228 serves to receive media key generation information used to generate a media key for encrypting a session set up with the calling terminal 202. In addition, the media key manager 228 generates a media key using the received media key generation information.

The session manager 230 establishes and manages a session with the calling terminal 202, which is encrypted using the media key generated by the media key manager 228. When the data transmission between the terminals is completed after the session is established, the receiving terminal device 206 may transmit a session end message to the calling terminal 202 through the communication unit 226. The session end message may include an authenticator generated by using the previously generated media key. The authentication process by this authenticator is to prevent the end of the session against the sender's or receiver's will, as mentioned earlier.

3 is a flowchart illustrating a SIP registration process according to an embodiment of the present invention.

In order to establish a session and exchange data between SIP terminals, a SIP registration process is required. The SIP Registrar and the Authorization Authorization Accounting (AAA) server in the same domain have a security association, which is information that can authenticate a terminal in the same domain. However, when the terminal is implemented as a mobile node, security in the SIP registration process is problematic because it cannot have any security association information with any SIP network visited by the terminal. Therefore, the present invention provides a security registration process enhanced SIP to solve this problem.

An overview of the SIP registration process of the present invention is as follows. The terminal 10 transmits to the SIP proxy server 20 a SIP registration request message to which an authenticator for authentication is attached. At this time, since some fields of the SIP registration request message are encrypted, the SIP proxy server 20 cannot proceed with registration of the terminal 10 any more. Accordingly, the SIP registration request message and the authenticator are transmitted to the AAA 30, and the AAA 30 performs terminal authentication and restoration of the encrypted field through the authenticator. The AAA 30 then sends a SIP registration request message including the restored field back to the SIP proxy server 20, and the SIP proxy server registers the terminal 10 using the restored field. The AAA 30 also transmits a session key to be used in the SIP session establishment process of the SIP proxy server 20 and a random number for generating the session key. The SIP proxy server 20 transmits only the random number to the terminal 10. The terminal 10 obtains the session key using this random number.

If this is explained in more detail as follows. In FIG. 3, the terminal 10 first attempts to register a SIP by generating a SIP register request message (SIP Register) and transmitting it to the SIP proxy server 20 (302). In this case, the SIP registration request message may use a format defined in the RFC 3261 standard, and an authenticator field for authentication of the terminal may be added. The SIP registration request message of the RFC 3261 standard with the authenticator field added is as follows.

REGISTER sip: sip proxy SIP / 2.0

Via: SIP / 2.0 / UDP: 5060: branch =

MAX-Forward:

To:

From:

Call-ID:

Cseq: 1 REGISTER

Contact:

Content-Length:

Authenticator:

For the enhanced SIP registration process, certain fields of the SIP registration request message field are designated differently from the standard in the present invention. To this end, a shared secret key (SSKUA-AAA), which is a shared secret key between the terminal 10 and the AAA server 30, is used. The fields to be modified are as follows.

Via: SIP / 2.0 / UDP E (UA address, SSKUA-AAA): 5060

To: E (URI, SSKUA-AAA)

From: E (URI, SSKUA-AAA)

Authenticator: HASH (REGISTER, SSKUA-AAA)

As such, some sensitive fields can be encrypted using a shared secret key to protect the original registration message.

The SIP proxy server 20 receiving the SIP registration request message and the authenticator from the terminal 10 cannot register the terminal 10 because the important fields necessary for registration are encrypted as described above. Accordingly, the SIP proxy server 20 transmits the SIP registration request message and authenticator from the terminal 10 to the AAA server 30.

The AAA server 30 processes the authenticator of the SIP registration request message received using the shared secret key with the terminal 10, and restores the values of the encrypted Via, To, From, and Contact fields if authentication is successful. Then, the SIP registration request message including the restored field values is transmitted to the SIP proxy server 20 along with the session key and the random number (306). Here, the session key is used for establishing a SIP session after the SIP registration process of the present invention and for security in the data transmission process using the session. The random number is then used to generate this session key. The SIP registration request message that the AAA 30 sends to the SIP proxy server 20 through step 306 is as follows.

REGISTER sip: sip proxy SIP / 2.0

Via: SIP / 2.0 / UDP UA Address: 5060: branch =

MAX-Forward:

To: UA URI

From: UA URI

Call-ID:

Cseq: 1 REGISTER

Contact:

Content-Length:

Nonce:

Session-Key:

Looking at the SIP registration request message transmitted from the AAA 30 to the SIP proxy server 20, it can be seen that the encrypted Via, To, From, and Contact field values have been restored. You can also see that the Nonce and Session-Key fields are set to ���. The Nonce and Session-Key fields are defined as follows:

Nonce: AAA-generated random number

Session-Key: HASH (Nonce, SSKUA-AAA)

The SIP proxy server 20 receiving the SIP registration request message in which the encrypted field is restored from the AAA 30 deletes the Session-Key field from the SIP registration request message. Then, the terminal 10 is registered using the restored field value. When the registration is completed, the SIP proxy server transmits a 200 OK message indicating this to the terminal 10, where it may forward the random number generated by the AAA 30 together (308). Here, the random number transmitted to the terminal 10 may be encrypted for security. The terminal 10 extracts the encrypted random number and generates a session key using the random number. The generated session key is used for security in the SIP session establishment process to be described later.

4 is a flowchart illustrating a SIP session establishment process according to another embodiment of the present invention.

In order for the SIP session establishment process of the present invention to be performed, the calling terminal 40 and the receiving terminal 60 must have completed the SIP registration process of the present invention described above. Accordingly, the calling terminal 40 and the receiving terminal 60 receive random numbers from the SIP server 50, respectively, and generate a session key using the random numbers. For reference, in FIG. 4, the SIP server 50 should be understood as a module in the sense of including the SIP proxy server 20 and AAA 30 of FIG. 3.

First, the originating terminal 40 generates a SIP session request message (Invite message) for the receiving terminal 60 and transmits it to the receiving terminal 60 through the SIP server 50 (402). At this time, the Invite message is encrypted using a Secret Key of User Agent client (SKUAc-Proxy), which is a session key between the calling terminal 40 and the SIP server 50. The Invite message is also attached with an authenticator for authenticating the Invite message and authenticating the originating terminal 40 (402). The authenticator is created by the following process.

Authenticator: HASH (INVITE, SKUAc-Proxy)

The SIP server 50 that authenticates the integrity of the Invite message and the originating terminal 40 through the authenticator attaches the first media key generation information MKmaterialUAc to generate the media key to the received Invite message. 404. MKmaterialUAc is generated as follows.

MKmaterialUAc: HASH (Call-ID, SKUAc-Proxy)

The MKmaterialUAc is encrypted using SKUAs-Proxy (Secret Key of User Agent server-Proxy), which is a session key between the receiving terminal 60 and the SIP server 50. The Invite message transmitted from the SIP server 50 to the receiving terminal 60 is attached with an authenticator hashing the Invite message with SKUAs-Proxy for the integrity of the message and the sender's confirmation.

The receiving terminal 60 transmits a 180 ringing message to the calling terminal 40 through the SIP server 50 (406 and 408).

The receiving terminal 60 extracts the first media key generation information, that is, MKmaterialUAc, from the Invite message received from the SIP server 50 and generates a media key as follows.

Media Key: HASH (MKmaterialUAc, HASH (Call-ID, SKUAs-Proxy))

In this media key generation function, HASH (Call-ID, SKUAs-Proxy) means second media key generation information, namely MKmaterialUAs. That is, the media key is generated using the first media key generation information MKmaterialUAc and the second media key generation information MKmaterialUAs.

The receiving terminal 40 transmits a 200 OK message which is a SIP session response message through the SIP server 50 (410). Since this 200 OK message contains important information indicating the connection point of a Real-time Transport Protocol (RTP) stream, it is preferably encrypted with SKUAs-Proxy. In addition, by attaching an authenticator for authentication to authenticate the integrity of the message and the SIP server 50 for the receiving terminal 40 (410). The authenticator is created as follows.

Authenticator: HASH (200 OK, SKUAs-Proxy)

The SIP server 50 attaches the second media key generation information MKmaterialUAs for generating the media key to the received 200 OK message and transmits it to the calling terminal 60 (412). As mentioned earlier, MKmaterialUAs are created as follows.

MKmaterialUAs: HASH (Call-ID, SKUAs-Proxy)

In addition, the 200 OK message received by the calling terminal 40 includes an authenticator for authenticating the message and authenticating the SIP server 50 (412).

After receiving the 200 OK message, the calling terminal 40 transmits an ACK message to the receiving terminal 60 (414). Then, a session using RTP is established between the calling terminal 40 and the receiving terminal 60. This RTP session is encrypted using a media key held by both the calling terminal 40 and the receiving terminal 60. If the session is configured to periodically exchange keys using a separate mechanism, the media key according to the present invention may be utilized as a shared secret key.

Meanwhile, when data transmission between both terminals is completed using the established session, the session must be terminated. In order to terminate the session, the originating terminal 40 or the receiving terminal 60 transmits a BYE message requesting the end of the session to the counterpart terminal, respectively. However, if such a conventional message is transmitted by a malicious external third party and the termination request by this message is approved, the session is forcibly terminated before data is completed.

Therefore, the BYE message can be prevented by attaching an authenticator to distinguish the sender of the message. This authenticator is created using the media keys held by both terminals.

Authenticator: HASH (BYE, Media Key)

In FIG. 4, the receiving terminal 60 transmits the BYE message including the authenticator to the calling terminal 40 (418). The originating terminal 40 receives the BYE message and confirms that the sender of the BYE message is the receiving terminal 60 by using the authenticator. When the verification is completed, the calling terminal 40 transmits a 200 OK message to the receiving terminal 60 (420). This terminates the session. 4 shows a process in which the receiving terminal 60 requests the end of the session from the calling terminal 40, but the same applies to the case where the calling terminal 40 requests the end of the session.

Through the SIP registration process and SIP session establishment process of the present invention, it is possible to solve security threats such as session hijacking, eavesdropping, forced session termination, and ARP Poisoning (Address Resolution Protocol) due to the modification of the SIP message. In addition, due to the encryption of the URI, it can be free from threats such as SPAM messages about URI collection.

5 is a flowchart illustrating a flow of a terminal registration method of a SIP server according to an embodiment of the present invention.

First, a SIP registration request message including an encrypted field is transmitted from a terminal (502). In this case, in order to secure the SIP registration process, an authentication process for the corresponding terminal may be performed using the terminal authenticator (504).

After receiving the SIP registration request message, the encrypted field included in the message is restored (506). When the restoration is completed, the terminal registration process is performed using the restored field value (508).

When the terminal registration is completed, the SIP registration response message including the random number for generating the session key is transmitted (510). The terminal can generate a session key using this random number, which is used to secure the session in the process of establishing a SIP session between terminals after SIP registration.

6 is a flowchart illustrating a flow of a SIP registration method of a terminal according to an embodiment of the present invention.

First, a SIP registration request message including an encrypted field is generated (602). Since the fields of the existing SIP message are transmitted as they are not encrypted, there is a weak point in security. In the present invention, the important fields are encrypted. The SIP registration request message is transmitted to the SIP server. The SIP registration request message includes an authenticator used for authentication of the terminal (604).

When the terminal registration is completed in the SIP server, the SIP registration response message is transmitted. The SIP registration response message includes a random number for generating a session key (606). The session key is generated using the received random number (608). The description of the random number and the session key is omitted because it was mentioned above.

7 is a flowchart illustrating a flow of a method for managing session establishment between terminals in a SIP server according to another embodiment of the present invention.

First, a SIP session request message is received from a first terminal and transmitted to a second terminal (702). Then, the first media key generation information used to generate a media key for encrypting the session set up between the first and second terminals is transmitted to the second terminal (704).

Next, a SIP session response message, which is a response to the SIP session request message, is received from the second terminal and transmitted to the first terminal (706). The second media key generation information is then sent to the first terminal, which is used (708) to generate a media key along with the first media key.

In FIG. 7, the SIP session request message or the second media key generation information may be encrypted using the first session key generated during the SIP registration process of the first terminal. In addition, the SIP session response message or the first media key generation information may be encrypted using the second session key generated during the SIP registration process of the second terminal.

In addition, for security purposes, the SIP session request message or the SIP session response message may include an authenticator of the first terminal or the second terminal, and a terminal authentication process may be additionally performed. Similarly, the server authenticator may be included in the first media key generation information or the second media key generation information, and a server authentication process may be additionally performed.

Although not shown in FIG. 7, after the transmission of the second media key generation information by step 708 is completed, establishing a session between the first terminal and the second terminal may be further included. This session is encrypted with a media key generated using the first and second media keys. The method may also include transmitting a session end message of the second terminal to the first terminal or a session end message of the first terminal to the second terminal and ending the session to end the session. At this time, the session end message may include an authenticator generated using the media key.

8 is a flowchart illustrating a flow of a method for establishing a SIP session of a calling terminal according to another embodiment of the present invention.

First, a SIP session request message for a receiving terminal is generated (802). The session request message is transmitted to the receiving terminal (804). Media key generation information is transmitted from the receiving terminal together with the SIP session response message in response to the SIP session request message (806 and 808).

Then, the media key is generated using the received media key generation information for the security of the session (810). This media key is used to encrypt the session established with the receiving terminal (812).

When data transmission is completed after the session is established, the session termination message including the authenticator generated using the media key is transmitted (814). If authentication is successful at the receiving terminal and the session end message is approved, the session is terminated (816).

9 is a flowchart illustrating a flow of a method for establishing a SIP session of a receiving terminal according to another embodiment of the present invention.

First, a SIP session request message and media key generation information are received from a calling terminal (902, 904). In operation 906, the SIP session response message, which is a response to the SIP session request message, is transmitted.

Then, the media key is generated using the received media key generation information for the security of the session (908). This media key is used to encrypt the session established with the receiving terminal (910).

When data transmission is completed after the session is established, the session termination message including the authenticator generated using the media key is transmitted (912). If authentication is successful at the originating terminal and the session end message is approved, the session is terminated (914).

The present invention described above is capable of various substitutions, modifications, and changes without departing from the spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by.

1 is a block diagram showing the configuration of a SIP server and a terminal for performing a SIP registration process according to an embodiment of the present invention.

2 is a block diagram showing the configuration of a SIP server and a terminal for performing a SIP session establishment process according to another embodiment of the present invention.

3 is a flowchart illustrating a SIP registration process according to an embodiment of the present invention.

4 is a flowchart illustrating a SIP session establishment process according to another embodiment of the present invention.

5 is a flow chart showing the flow of the terminal registration method of the SIP server according to an embodiment of the present invention.

6 is a flow chart showing the flow of the SIP registration method of the terminal according to an embodiment of the present invention.

7 is a flowchart illustrating a flow of a method for managing session establishment between terminals in a SIP server according to another embodiment of the present invention.

8 is a flowchart illustrating a flow of a method for establishing a SIP session of a calling terminal according to another embodiment of the present invention.

Claims (31)

Receiving a Session Initiation Protocol (SIP) registration request message including an encrypted field from a terminal; Restoring the encrypted field; Registering the terminal using the restored field; And Transmitting a SIP registration response message to the terminal; Terminal registration method of a SIP server comprising. The method of claim 1, Authenticating the terminal; And the SIP registration request message includes an authenticator of the terminal. The method of claim 1, The SIP registration response message is A terminal registration method of a SIP server including a random number capable of generating a session key used for establishing a secure session. Generating a SIP registration request message including an encrypted field; Transmitting the SIP registration request message to a SIP server; And Receiving a SIP registration response message, which is a response to the SIP registration request message, from the SIP server; SIP registration method of the terminal comprising. The method of claim 4, wherein The SIP registration request message SIP registration method of a terminal including an authenticator used for authenticating the terminal in the SIP server. The method of claim 4, wherein The SIP registration response message includes a random number capable of generating a session key used for establishing a secure session. The SIP registration method And generating the session key by using the random number. A communication unit for receiving a SIP registration request message including an encrypted field from a terminal and transmitting a SIP registration response message to the terminal; A field restoration unit for restoring the encrypted field; And A terminal registration unit that registers the terminal using the restored field Including SIP server. The method of claim 7, wherein Further comprising a terminal authentication unit for authenticating the terminal, The SIP registration request message includes an authenticator of the terminal. The method of claim 7, wherein The SIP registration response message is A SIP server that contains a random number that can generate a session key for use in establishing a secure session. A message generator for generating a SIP registration request message including an encrypted field; and A communication unit which transmits the SIP registration request message to a SIP server and receives a SIP registration response message which is a response to the SIP registration request message from the SIP server; SIP terminal, including. The method of claim 10, The SIP registration request message SIP terminal including an authenticator used to authenticate the terminal in the SIP server. The method of claim 10, The SIP registration response message includes a random number capable of generating a session key used for establishing a secure session. The SIP terminal is And a session key generator for generating the session key using the random number. Receiving a SIP session request message from a first terminal and transmitting it to a second terminal; Transmitting first media key generation information used to generate a media key for encrypting a session established between the first and second terminals to the second terminal; Receiving a SIP session response message for the SIP session request message from the second terminal and transmitting the received SIP session response message to the first terminal; And Transmitting second media key generation information used to generate the media key to the first terminal; How to manage session settings between terminals of a SIP server. The method of claim 13, The SIP session request message or the second media key generation information Method of managing session establishment between terminals of a SIP server encrypted using a first session key generated during SIP registration of the first terminal. The method of claim 13, The SIP session response message or the first media key generation information Method of managing session establishment between terminals of a SIP server encrypted using a second session key generated during SIP registration of the second terminal. The method of claim 13, Authenticating the SIP session request message or the SIP session response message; And the SIP session request message or the SIP session response message includes an authenticator of the first terminal or the second terminal. The method of claim 13, The first media key generation information or the second media key generation information And a server authenticator for authenticating the first terminal or the second terminal. The method of claim 13, Establishing a session between the first terminal and the second terminal; And said session is encrypted using said media key. The method of claim 18, Transmitting a session end message of the second terminal to the first terminal or a session end message of the first terminal to the second terminal; and Terminating the session How to manage session settings between terminals of the SIP server further comprising. The method of claim 19, And the session end message comprises an authenticator generated by using the media key. Generating a SIP session request message for a receiving terminal; Sending the SIP session request message to the receiving terminal; Receiving a SIP session response message which is a response to the SIP session request message; And Receiving media key generation information used to generate a media key for encrypting a session set up with the receiving terminal; SIP session establishment method of the containing terminal. The method of claim 21, Generating the media key using the media key generation information; and Establishing a session with the receiving terminal; SIP session establishment method of the terminal is encrypted using the media key. The method of claim 22, Transmitting a session termination message for the receiving terminal; and Terminating the session SIP session establishment method of the terminal further comprising. The method of claim 23, The session end message includes a authenticator generated using the media key. Receiving a SIP session request message from an originating terminal; Receiving media key generation information used to generate a media key for encrypting a session set up with the calling terminal; And Transmitting a SIP session response message which is a response to the SIP session request message; SIP session establishment method of the containing terminal. The method of claim 25, Generating the media key using the media key generation information; and Establishing a session with the calling terminal; SIP session establishment method of the terminal is encrypted using the media key. The method of claim 26, Transmitting a session end message for the calling terminal; and Terminating the session SIP session establishment method of the terminal further comprising. The method of claim 27, The session end message includes a authenticator generated using the media key. A communication unit for receiving a SIP session request message from a first terminal and transmitting the SIP session request message to a second terminal, receiving a SIP session response message for the SIP session request message from the second terminal, and transmitting the received SIP session response message to the first terminal; The first media key generation information used to generate a media key for encrypting the session set up between the first and second terminals is generated and transmitted to the second terminal, and the second media key used to generate the media key. A media key generation information management unit generating generation information and transmitting the generated information to the first terminal Including SIP server. A message generator for generating a SIP session request message for a receiving terminal; A communication unit which transmits the SIP session request message to the receiving terminal and receives a SIP session response message which is a response to the SIP session request message; And A media key management unit receiving media key generation information used to generate a media key for encrypting a session set up with the receiving terminal; Terminal containing. A communication unit for receiving a SIP session request message from an originating terminal and transmitting a SIP session response message which is a response to the SIP session request message; A media key manager configured to receive media key generation information used to generate a media key for encrypting a session set up with the calling terminal; Terminal containing.

Images