TWI378694B - Bearer control of encrypted data flows in packet data communications - Google Patents

Description

IX. INSTRUCTIONS: TECHNICAL FIELD OF THE INVENTION The present invention relates generally to packet data communication and, more particularly, to monitoring and controlling packet data streams during packet data communication. [Prior Art] The global interconnection of the network allows instant access to information regardless of geographic distance. Figure 1 shows a simplified schematic diagram of one of the global connections of a network, commonly referred to as the Internet represented by reference numeral 20. The Internet 20 is essentially a network of many different levels of hierarchy that are connected together. The Internet 20 operates under an IP (Internet Protocol) issued by the IETF (Internet Engineering Group). Details of the IP can be found in the RFC (Request for Comments) 791 published by the IETF. The various networks connected to the Internet 20 are sometimes referred to as LAN (Regional Network) or WAN (Wide Area Network). Some of these networks 22, 24, and 26 are shown in FIG. Within each of the networks 22, 24, and 26, there may be multiple pieces of equipment that are connected to each other and that communicate with each other. Examples are computers, printers, and servers. Each device has a unique hardware address commonly referred to as a MAC (Media Access Control) address. Devices with MAC addresses are often referred to as nodes. When the node communicates over its own network via the Internet 20, an IP address needs to be assigned to the node. The assignment of IP addresses can be manual or automatic. For example, manual assignment of IP addresses can be performed by a network administrator. More generally, the IP address is automatically assigned ‘. For example, in a LAN, the IP address can be assigned by a server called DHCp (Dynamic Host Control Protocol) server (not shown) that exists inside the LAN of the node. Moreover, the Ip address can be assigned automatically and remotely in a wireless technology support. Turning back to FIG. 2 as an example, assume that one of the nodes 30 in the network 22 attempts to send a data packet to another node 34 in the network 24. Under [p], each data packet must have a source address and a destination address. In this case, the source address is the address of the node 3 in the network 22. The destination address is the address of the node 34 in the network 24. Operating in this manner, the nodes 30 and 34 are said to communicate in a simple transmission mode in which the nodes 30 and 34 use only their own IP address to IP in the data packet interchange. Zhizhi. The advent of wireless technology allows a node to move away from its originally registered network to another network. For example, referring back to the figure, the node 30 that is not permanently wired to the network 22 can be a wireless device such as a pDA (Personal Device Assistant), a cellular telephone, or a mobile computer. The wireless node 3 can operate outside the boundaries of its home network 22. Therefore, the node 3 can leave its home network. Travel to a foreign network26. In this case, the original address assigned to the node 3 will no longer be applicable to the node 30. Therefore, it is impossible for the data packet for the purpose of the address of the node to reach the node. The Action IP (Mobile Internet Protocol) stated by the IETF wishes to address node mobility issues. According to the RFC 2〇〇2 published by the *IETF, the node 3 is assigned one. Whenever it leaves the home network 22 and roams in another network, it is assigned a "transfer of the CoA (transfer address) Address ". Under RFC 2002, there are two types of c〇A, namely, FA CoA (external 103444.doc 1378694 agent transfer address) and CCoA (co-located transfer address) β FA CoΑ essentially FA (expatriate agent) The address of the device, which is a designated server in the foreign network where the node 30 is located. The use of fa CoA is applicable to IPv4. The CCoA is assigned by the foreign network to the independent but temporary address of the node. The use of CCoA applies to both IPv4 and ιρν6. In any event, regardless of when the node 30 is in the foreign domain, the node 30 must register c〇A on its home network 22, whether it is fa c〇a or CCoA, so that the home network 22 is always known. Where is the node 3? After registration, the CoA is stored in a routing table maintained by a designated server called the home network 222HA (Traditional Server) 25. Some examples are given for explanation. In the case of FACoA, it is assumed that the node 3〇 roams into the foreign network %. After reaching the regional restriction of the foreign network 26, the defect 3 receives an advertisement message from the foreign network 26, which informs the node 3 that it exists in the field of hunting. H point 30 is known from the advertisement message. The foreign network is the address of ^ 36. The node 3 then registers the μ.CoA in the home network 22 when the node 3G in the foreign network 26 sends the packet to the point 34 in the network, for example ' Knowing the address of the node μ in the network 24 can directly send the data packet. That is, the source address can be set to the HoA of the node 30 in the data packet according to ip, and the destination address can be set to the address of the node 34 in the network 24. The direction of the data packet is shown as the data path 38 shown in FIG. 103444.doc 1378694 For reverse data communication, it is not straightforward. In the reverse routing, when the node 34 in the network 24 attempts to send a data packet to the node 3 now in the foreign network 26, as described above, with IP- The source address and destination address must be specified in the data packet. In this case, the source address is the address of the node in the network 24. For the destination address, since there is no update notification from the node 3, the node 34 only knows The node 3〇H〇A is not aware of the node 3〇FA C〇A. Therefore, the destination address will be set to the node 3〇iH〇A. However, because the FACoA system of the node 30 is stored in the node In the routing table of the HA 25 in the home network 22, when the data packet arrives at the home network 22, the HA 25 of the network 22 encapsulates the received data packet with the stored FA c〇A and The node is sent to the node in the foreign network 26. That is, the encapsulated data packet uses the FACoA as the destination address. Once the foreign network 26 receives the encapsulated data packet, the FA 36 is only removed. The encapsulated FA CoA sends the original packet to the mobile node 3. The data packet is shown as the data path 4 in Figure 1. It should also be noted that the data paths such as paths 38 and 40 are in fact Passing the Internet 20 times. For the sake of brevity, avoiding obscuring Figure 1, these are The paths are only shown as passing through relevant servers, such as HA 25 and FA 36. That is, the data paths 38 and 40 are shown as the logical paths shown in Figure 1. In this manner, the mobile node 3 is It is said that the FACoA is used to communicate with the corresponding node 34 in the mobile mode transmission mode. In the above example, even if the mobile node 30 appears to receive the data packet directly from the corresponding node 9', a data tunnel is said to be via The HA 25 exists between 103444.doc 1378694 between nodes 30 and 34. The advantage of using the tunneling mode is that when the mobile node 30 moves to another foreign network, in addition to the update notification to the home network 22, The mobile node 30 does not need to send a similar notification to the corresponding node 34. Therefore, the information transmitted and received by the corresponding node 34 appears to be undisturbed.

In the case of CCoA, when the node 30 is roaming away from the home network 22, instead of requesting a FA CoA, the node 30 can instead request a CCoA from the foreign network. If the network 26 is a WAN supporting wireless technologies such as the cdma 2000 standard issued by TIA/EIA (Telecommunications Industry Association/Electronic Industries Association) and 3GPP2 (3rd Generation Partnership Project 2), the CCoA can borrow Requested and assigned by the foreign network 26 at a remote location via, for example, a PPP (Point-to-Point Protocol) between a PDSN (Data Packet Service Node) 4 and the Mobile Node 30. The PDSN 41 is basically a server in the network 36 that processes and processes data traffic in the wireless portion of the network 26. However, unlike the CCoA assigned by the foreign network 26, the node 30 performs all of the functions of a foreign agent, such as the previously mentioned FA 36. Again, the mobile node 30 must register the cc〇A with the home network 22. For example, 'for the node 34 in the network 24, the node 3 sends a data packet with two layers of addresses. . In the outer layer, the source address is set to CCoA and the destination address is set to HA 25. In the inner layer, the source address is the HoA of the node 30 and the destination address is the address of the node 34 in the foreign network 24. Upon receipt of the data packet from the roaming node 30, the hA 25 strips the external address layer and sends the data packet to the node 34 of the internal address layer. The logical path of the data packet is shown as data path 42 in FIG. "" 103444.doc 8 -10- 1378694 In the reverse data path, meaning that when the node 34 sends a data packet to the node 30, the data packet has only one address layer, and The source address is set to the node 34 and the destination address is set to the node 30

HoA. Upon receiving the data packet, the HA 25 encapsulates the data packet with the destination address of cc〇a and the address of the HA 25 as the source address and sends the encapsulated data packet to the node. The node 3 itself performs decapsulation without going through the FA 36. The direction of the data packet is shown as data path 44 of FIG. Operating in the manner described above, the roaming node 30 is said to communicate with the communication node 34 using CCoA in the mobile IP tunnel transmission mode. Often, data communication between such nodes must be monitored and controlled for different reasons. For example, t the mobile node 3 () and the corresponding node Μ in the V〇IP (Internet Voice Communication) session _, must be sure: the party (in this case, the action node 3 〇 Corresponding node 3, for each data packet, the source bit 1, the - the visual address and the destination 4 must be determined. If the session is (4), it needs to be implemented for tracking purposes for account processing. Method: For security and privacy reasons, the data packets exchanged between the nodes are usually encrypted and encrypted. The encryption method (4) used for the packet data in the transmission mode and the channel transmission mode is different. The monitoring of encrypted data packets poses a particular challenge. There is still an increasing demand for secure and private communications for shared networks. Therefore, a security monitoring scheme for packet data communication with encrypted data streams must be provided. SUMMARY OF THE INVENTION 103444.doc 1378694 Due to: ic i 机 & machine & for sexual reasons 'typically, the data stream is transmitted securely with encrypted communication data packets. Sometimes the data stream must pass A monitoring medium for data flow control is monitored. The encrypted data package includes a spi (security parameter index) for identifying an SA (security association) for data decryption. According to an exemplary embodiment of the present invention In an embodiment, the node that searches for and subscribes to each other first sends the signaling message through the orphaned medium before establishing any formal data communication, and the monitoring medium causes the SPI from the signaling message. Matches the spi selected from the data packets. During the data flow control period, if the match in the spi is found, the monitoring medium allows the data flow to pass. Otherwise, the data flow is rejected. The monitoring medium can therefore implement data flow control relatively quickly. From the following detailed description together with the accompanying drawings, those skilled in the art can understand these and other features and advantages, the same reference numerals in the drawings The same components are indicated. [Embodiment] The following description is presented to enable any person skilled in the art to make and use the invention. The details are set forth for the purpose of explanation. It will be appreciated that the present invention will be understood that the invention may be practiced without the specific details disclosed. In other instances, well-known structures are not described in detail. The present invention is not to be construed as being limited to the details of the present invention. The present invention is not limited by the illustrated embodiments, but the invention should be accorded with the broadest scope of the principles and features disclosed herein. 103444.doc -12- 5 1378694 According to the IMS/MMD (IP Multimedia Subsystem/Multimedia Domain) issued by the 3rd Generation Partnership Project (3GPP) and 3rd Generation Partnership Project 2 (3GPP2), The embodiments described below are operational. Available under the heading "3rd Generation Partnership Project: Technical Specification Group Services and System Aspects, IP Multimedia Subsystem (IMS), Stage 2" 3GPP TS 23.228; "3rd Generation Partnership Project: Technical Specification Group Core Network, End-to-end Quality of Service (QoS) Signaling Flows" 3GPP T S 29.208; and "IP Multimedia System, Stage 2" 3GPP2 X.S0013-002 and 3GPP2 X.P0013-012 publications The general discussion of IMS/MMD is found in the literature. IMS can be used in a variety of standards such as cdma2000, WCDMA (Wide-Watch Multiple Access), GPRS (General Packet Radio Service), and various other WANs. Referring now to Figure 2, an illustrative embodiment of the present invention is schematically illustrated. The entire system is generally indicated by reference numeral 50, which includes a backbone network 52, such as an intranet or an internetwork. By way of example, as shown in FIG. 2, among other networks, an HN (local network) 54, an FN (foreign network) 56, and an RN (remote network) are connected to the backbone network 52. Road) 58. In the HN 54, there is an HA (Crowd Agent) 62 that undertakes the task of managing the data traffic in the HN 54 and is also used to control the data traffic of the HN 54 for inbound and outbound routing. If the HN 54 supports wireless technology, there is typically a RAN (Radio Access Network) 55 installed and connected to a PDSN (Packet Data Service Node) 64 103444.doc -13-. For example, if the RAN 55 operates under the cdma 2000 standard, the RAN 55 typically includes at least one BSC (Base Station Controller) and a plurality of BSs (Base Stations). The PDSN 64 is essentially an access gateway between the backbone network 52 and the RAN 55. To perform various IMS/MMD functions and features, the service provider installs different servers in the HN 54. Examples of such servers include a P-CSCF (Proxy Call State Session Function) 70 and an S-CSCF (Serving Call State Session Function) 72. The functional description of these servers will be described later along with the operational description of system 50. In addition to the above nodes, there are other nodes in the HN 54, but they are not shown for the sake of brevity. These nodes can be various types of computers, printers, and any other device that can be mobile or non-action. As shown in FIG. 2, FN 5 6 and RN 5 8 are connected to the backbone network 52. Moreover, for simplicity and ease of explanation, the FN 56 and the RN 58 are illustrated as somewhat similar to the HN 54. It will be appreciated that the FN 56 and the RN 58 can be constructed very differently depending on the use. Therefore, in this case, the FN 56 also includes a FA (foreign agent) 66, a RAN 76, a PDSN 68, a P-CSCF 71, and a PCRF (Policy and Charging Rules Function) 75. Similarly, the RN 58 also includes a PDSN 78, a P-CSCF 80, an S-CSCF 82, and a PCRF 84. It should be noted that in Figure 2, the FA 66 and PDSN 68 in the FN 56 are shown as separate entities. Typically, the FA 66 and the PDSN 68 are integrated into a single unit. In the system 50, there is a MN (Action Node) 60, which initially has a 103444.doc • 14·

The HoA (Home Address) is registered with the HA 62 in the HN 54. The MN 60 can move to other foreign networks, such as FN 56, and can access the backbone network 52 via the FN 56 or other network under Mobile IP (Mobile Internet Protocol). The MN 60 may in fact be in the form of, for example, a PDA (Personal Digital Assistant), a laptop or a mobile phone. It is assumed that the MN 60 roams in the FN 56. In this particular example, assume that the user of the MN 60 wishes to have a video conferencing session in which another user operates one of the RNs 58 (communication node) 90. The node 90 can be actionable or inactive. Once the field of the FN 56 is reached, the MN 60 can obtain the address of the FA 66 via the advertisement made by the FN 56. The MN 60 then registers the FA CoA with the HA 62 in the HN 54 so that the HA 62 can track the location of the MN 60. As an alternative, the MN 60 may request a CCoA from the FA 66. The MN 60 then registers the CCoA for the same reason, i.e., allows the HA 62 to remain in contact with the MN 60. The MN 60 must go through a signaling process before establishing any traffic. To accomplish this, the MN 60 sends an invite message to the CN 90 via a medium as will be described below. Similarly, the CN 90 must use a response to the signaling process to determine the request message. In this example, the MN 60 uses the HoA originally assigned by the HA 62 in the HN 54 to register with the S-CSCF 72 in the HN 54 for accessing a SIP (Session Initiation Protocol) network. The S-CSCF 72 in the HN 54 is included. The MN 60 then sends a SIP INVITE message to the 103444.doc in the HN 54. The P-CSCF 70 should note that in actual operation, the SIP INVITE message reaches the P due to all other data traffic. The CSCF 70 first passes through the RAN 76, the PDSN 68, the FA 66, the backbone network 52, and the HA 62. Moreover, it is also known in the art that the data communication traffic operates in the system 50 via a signal carrier in the form of an electrical signal. For the sake of brevity, data traffic is simply described as a logical path in a similar manner. That is, in the following description, only the logical path of the data flow is described unless specifically emphasized. It should be further noted that the MN 60 can send the SIP INVITE message to the P-CSCF 71 in the FN 56 to initialize the conference session as an alternative. That is, instead of using the SIP network in the HN 54 for signaling, the MN 60 can use the SIP network in the FN 56 as an alternative. For the sake of consistency and simplicity of explanation, in the following description, the SIP network in the HN 54 is used for the signaling process. Suppose you want a video conferencing session to be a dedicated session. Also, as is conventional practice, the data packets exchanged between the MN 60 and the CN 90 are encrypted. At this point, it helps to provide a general explanation of IP security and a detailed explanation of the further differences between unencrypted and encrypted data packets. Under IP, the data packet is encrypted according to IPSec (Internet Security Protocol), which is a security protocol with various standards for handling data confidentiality, integrity and authentication between participants. Details of IPSec can be found in RFC 2401, 24 12 and 2451. According to IPSec, the communication node searching for secure communication needs to first agree on the security parameters of a group called '103444.doc -16 - 1378694 called SA (security association). The SA may include an encryption algorithm, a verification algorithm, an encryption key, and a verification key. Thus, after agreeing, the SA is stored in each of the nodes requesting the secure communication session. The common SA can be identified by a spi (security parameter) transmitted along with each data packet. During any secure communication session, the receiving node can always select the SPI from any data packet and call the stored one to decrypt it. An SA with a common encryption algorithm and key allows the receiving nodes to decrypt the encrypted data packets. Different forms of encrypted and unencrypted data packets are shown in FIG. Reference numeral 100 indicates that a common pre-encrypted data packet beta data packet 100 includes an IP header 102 that stores information such as the source and destination addresses of the packet 100 as needed under IP. Adjacent to the IP header 102 is a layer 4 header 104. Layer 4 is a transport layer that includes information about whether the data packet 100 is under TCP (Transmission Control Protocol) or UDP (User Datagram Protocol). Details of TCP and UDP can be found in RFC 793 and RFC 768, respectively. The layer 4 header 1〇4 thus identifies, to a minimum, whether the packet 100 is a TCP packet or a UDP packet and further includes the location of the source and destination. Information about the purpose of the information is critical to the monitoring medium's task of performing its data monitoring. Adjacent to the layer 4 header 1〇4 is the payload data i 〇6 carried by the data packet 100. Reference numeral 108 indicates an encrypted data packet in the transmission mode. The shaded portion indicates the encrypted data area. The encrypted data packet 1 〇 8 also includes an IP header 1 〇 2 identical to the unencrypted packet 〇 0. However, the layer 4 header 104A of the encrypted packet 108 and the payload data 103444.doc 106 A are the corresponding layer 4 headers 104 and payloads 106 of the unencrypted data packet 100. Encrypt the counterpart. In the data packet 108, an ESP (Package Security Payload) header 110 is disposed between the IP header 102 and the Layer 4 header 104A. The ESP header 110 includes an SPI that can be used to identify the SA as previously described with a pre-arranged algorithm for decrypting the data packet 1-8. At the end of the data packet 1-8 is an ESP tail 112 and verification data 114. The ESP trailer 112 includes information identifying the next ESP header. If any verification agreement is executed, the verification material section 114 has information for this purpose. Reference numeral 118 denotes an encrypted data packet in accordance with IPSec in tunneling mode. In the data package 118, substantially, the pre-sealed package 100 is encrypted and packaged into the package 118. Therefore, the packet section IP header 102B, the layer 4 header 104B, and the payload data 106B contain information of the corresponding section of the original packet U〇. However, the IP header 1〇2 of the packet 118 has a different content than the IP header 102B. For example, the π > header 102 includes the outer layer address of the tunnel, and the IP header 102B has the internal layer address of the track. Adjacent to the IP header 102 is the ESP header 11A, which is substantially identical to the ESP header 110 in the data packet 108. That is, the ESP header 110 includes an SPI for identifying the SA with a pre-arranged algorithm for decrypting the data packet 118. The ESP tail 112 and the verification data 114 are substantially identical to the packet 108. It should be appreciated that under IPv6, after the IP header 102 in each of the packets 1〇8, 1〇〇, and 118, there is an optional header called a "flow label" that includes identifying the The resource packet 108, 1 or 118 is an audio packet or a video 103444.doc • 18· 1378694 packet. For the sake of brevity and conciseness, the stream label header is not shown in Figure 3, as shown in Figure 3. It can be seen that in the data packet (10), the layer 4 header is encrypted. Similarly, the monitoring medium cannot identify (for example) the packet 1 to 8 is a TCP packet or a -UDP packet. First, the The layer 4 header includes information about the purpose of not being easily usable. Any monitoring medium that does not have any information about the target bee cannot perform any data monitoring. Also, in the data packet 118, in addition to encrypting the layer 4 header In addition to i〇4b, the IP header 102B is also encrypted. For example, without the information from the header 104B, the monitoring medium cannot further know the inner layer address of the data packet. Therefore, the data packet 118 Impossible to be monitored. As mentioned earlier, embedding The data SPI in each of the data packets 1 〇 8 and 118 'This SPI can be used to identify the relevant SA for data decryption. However, in this embodiment 'SPI is also implicitly used to identify and The specific purpose associated with the encrypted data packet 108 or 118 is consistent. More specifically, in the encrypted data packet 108 or 118, each of the individual Esp headers corresponds to a particular data. The stream, the particular stream of data is further characterized by, for example, the stream being an audio stream or a video stream and progressive identification of the destination. According to an exemplary embodiment, the SPE is monitored during the initial signaling process. The medium transmits directly and eventually arrives at the monitoring medium. During the monitoring of the negative material, the monitoring medium only has to match the SPI obtained during the sending process with the corresponding SPI selected from the encrypted data packet. If a match is found, then the specific stream (ie, the audio stream or video stream) can be implicitly identified along with the purpose of the fed packet. 103444.doc -19- Now turn to Figure 2. To initialize the video conferencing session, the MN 60 is as early as Description A SIP INVITE message is sent over the SIP network. The SIP IN VITE message includes a description portion called SDP (Session Description Protocol), which essentially describes the basic requirements for properly performing the requested video conference session. Included in the SDP is the IP address and number of MNs of the MN 60 and the decoder (codec) specification of the session. More importantly, in this embodiment, the SDP includes the SPI used by the MN 60. In the case where the communication session is a videoconferencing session, two SPIs are required, that is, one for the video stream and the other for the audio stream. As mentioned earlier, each SPI corresponds to a particular data stream that is uniquely associated with a particular destination. To be repeated, during the data monitoring, if the SPI included in the SIP INVITE message matches the SPI selected from the data packet of the payload communication, the destination 可 can be implicitly identified. The load communication is the content stream of the audio and video signals of the conference session. Using the identification of the destination address and the source address and destination address, the data monitoring medium can perform its data monitoring tasks. Returning now to Figure 2, the P-CSCF 70 in the HN 54 is a node that assumes the task of call session management. Upon receiving the SIP INVITE message, the P-CSCF 70 sends the SIP INVITE message to the S-CSCF 72 in the HN 54. The C-CSCF 72 in turn sends the SIP INVITE message to the RN 58 to request reception. Once the S-CSCF 72 in the HN 54 approves the session and the CN 90 in the RN 58 accepts the conference session, the P-CSCF 70 will then proceed with, for example, charging rules, authorized QoS (Quality of Service). And the stream identifier is sent to the pcRF 74 in the HN 54 with the policy phase 103444.doc •20. At the same time, meaning that after receiving by the CN 90, the MN 60 sends a TFT (Communication Flow 1 template) along with the required q〇s to the PDSN 68 in the FN 56 to establish load communication. The PDSN 68 then requests the same information related to the policy to the PCRF 75 in the FN 56 as mentioned earlier, i.e., the authorized Q〇S, charging rules and flow identifiers for the conferencing session. The PCRF 75 then forwards the request to the PCRF 74 in the HN 54 and obtains the above parameters for the streams. Any parameters permitted by the PCRF 75 must be consistent with a particular mandated strategy. Such policies may include a specified rule under the IMS/MMD standard 'a specific protocol between networks (such as a protocol for processing of load communication between the HN 54 and the FN 56), a network-specific policy, such as only The strategy specific to the FN 56 "If the requested conference session is charged, then the policies may include a specific tracking procedure for computing purposes. First, unauthorized communications will be blocked. The implementation of these policies is referred to as SBBC (Service-Based Load Control) under the IMS/MMD standard. Details of the operation of SBBC can be found under the heading "3GPP2 MMD Service

Based on the Bearer Control Document, Work in Progress, "3GPP2 X.P0013-012. A description of the SDP can be found in the document entitled "IP Multimedia Call Control Protocol Based on SIP and SDP, Stage 3" 3GPP2-X.S0013-0004. The PCRF 75 in the FN 56 is installed to determine all imposed strategies. During the decision making process, the PCRF 75 is inserted between the PCRF 74 in the HN 54 and the PDSN 68 in the FN 56. Also, there is a plug in the PDSN 68 103444.doc -21 - with the PCRF A Ty interface 92 between 75. There is also a Tx interface 94 disposed between the PCRF 74 and the P-CSCF 70 in the HN 54 as shown in Figure 2. The Ty and UI interfaces described above are used for conference sessions. Policy control between the carrier and the carrier. Details of the Ty and Tx interfaces can be found in 3GPP TS 23.107 issued by 3GPP and 3〇?X.P0013-012 issued by 3〇??2. Returning to FIG. 2, if the requested session parameter stated in the SIP INVITE message is authorized, it is transmitted from the PCRF 74 in the HN 54 and the PCRF 75 in the FN 56 from the P-CSCF 70 to the PDSN 68. In this embodiment 'it assumes that the CN 90 has a CCoA assigned by the RN 58. Therefore, once received The SIP INVITE message, the CN 90 responds with a SIP 200 OK message. The SIP 200 OK message substantially reaffirms the parameters of the original SIP INVITE message. Further, in this embodiment, the CN 90 also includes the SIP 200. The SPI in the SDP of the OK message used by the CN 90 for load communication. The SIP 200 OK follows the same data path as the SIP INVITE message but in the reverse order. The MN 60 then passes an acknowledgement message (ACK). The receipt of the SIP 200 OK message is determined along the same data path as the original SIP INVITE message. Thereafter, the payload communication is ready to be authorized according to the SIP INVITE message by the PDSN 68 in the FN 56. Established. As previously stated, under the IMS/MMD standard, load communication must be monitored and controlled via the SBBC via the network. In this example, the pDSN 68 is guided by the PCRF 75 in the FN 56. Undertake the task of forcing SBBC to be consistent with the aforementioned strategy of 103444.doc 1378694. During the implementation of SBBC, 'each data packet must be screened before being allowed to pass. Since the data packet of the payload communication is encrypted as described earlier, some important information such as the purpose of identification cannot be easily and conveniently obtained. In this embodiment, as mentioned above, the PDSN 68 suitably pre-fetches the SPI message from the SIP INVITE message during the initial signaling process and the SIP 200K message data stream. In operation, the pdsN 68 selects the basic information required by the SBBC from each data packet, such as the source and destination addresses and the SPI that implicitly identifies the data stream, and if the message and the self-sent process receive corresponding information Matching allows the data packet to be passed as part of the SBBC implementation. On the other hand, if there is a mismatch, the data packet is said to have failed the SBBC and was discarded. Operating in the manner described above, that is, with the SPI included in the SDP of the signaling message, the PDSN 68 can quickly implement the SBBC of the encrypted data traffic for the requested video conference session. The implementation of the SBBC is ongoing until the session between the MN 60 and the CN 90 is terminated. The process described above is shown in the flow chart of Figure 4. Figure 5 is a schematic representation of a portion of a hardware construction of a mobile node device, indicated by reference numeral 121, in accordance with the present invention. The device 121 can be constructed and incorporated into various devices such as a laptop, PDA or cellular telephone. The device 121 includes a central data bus 122 that links a number of circuits together. The circuits include a CPU (Central Processing Unit) or a controller, a receiving circuit 126, a transmitting circuit 128, and a memory unit. The receiving circuit 126 and the transmitting circuit 128 can be connected to an RF (Radio Frequency) circuit not shown in Fig. 103444.doc -23. The receiving circuit ι26 processes and buffers the received signals before transmitting them to the data bus 122. The other side of the transmission circuit 128 processes and buffers the data prior to the data transmitting device 121 from the data bus 122. The CPU/controller 124 performs the data management function of the negative bus 122 and further general data processing functions including executing the instructional content of the memory unit 130. The memory unit 130 includes a set of instructions, generally indicated by reference numeral 131. In this embodiment, the instructions include portions such as action ι user 132 and § 11 > user 134. The SIP user 134 includes a set of instructions in accordance with the present invention as previously described. The mobile IP user 132 includes a set of instructions for allowing the device to operate under the action and action IPs, such as various types of addresses (also as described above) for obtaining communications in various modes. In this embodiment, the memory unit 130 is a RAM (random access memory) circuit. The four exemplary instruction sections 13 2 and 13 4 are software common programs or modules. The memory unit 130 can be fixed to another 5 memory circuit (not shown) that can be of a volatile or non-volatile type. As an alternative, the memory unit 130 can be composed of, for example, an EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM (Electrically Programmable Read Only Memory), r〇m (read only memory), a disk, Optical discs and other circuit types of other memories known in the art are made. Figure 6 is a schematic representation of a portion of the hardware construction of a PDSN device in accordance with the present invention and represented by the reference numeral " The PdSn device 14A includes a central data bus 142 that connects the plurality of circuits together. The circuits include a CPU (Central Processing Unit) or a controller 44, a receiving circuit 146, a 103444.doc -24-1378694 transmission circuit 148, a database storage unit 149, and a memory unit 15A.

The receiving circuit 146 and the transmitting circuit 148 are connectable to a network data bus (not shown) connected to the PDSN device 14A. The receiving circuit 146 processes and buffers the signals received from the network data bus (not shown) before transmitting them to the internal data bus 142. The transmission circuit 148 processes and buffers the data from the asset bus 142 prior to transmitting it to the device 14. The CPU/controller 144 performs the data management function of the data bus 142 and proceeds to perform the general data processing function, which includes executing the instruction content of the memory unit 150. The database storage unit 149 stores data records such as s A having various parameters. The memory unit 150 includes a set of instructions, generally indicated by reference numeral 154. In this embodiment, the instructions include such as? Part of the delete function 156 and the SBBC function 158, "The memory unit can be made of a memory circuit type as described above and not further repeated. The pDSN function 156 and the SBBC function 158 include a set of instructions in accordance with the present invention as previously described.

Finally, in the implementation of the financial description, use cc〇a to operate under Action Ip. As mentioned above, this _(6) works well in other modes of communication and uses other types of addresses. For example, t, as an example of many alternative embodiments, the read 6G can use FA CgA and in the action „> the transmission mode T and CN9Qit. In addition, the bidirectional* in the (four) financial description is applied to the _ 6〇 Encryption with the CN9G. It is also possible to use only one-way and two-way application of f-material encryption. In addition, as expected, it is described as a mobile device roaming to a foreign network. It should be understood that The node 60, which is exactly fixed. Further, any of the logical blocks, circuits, and calculation steps described in connection with the embodiments may be implemented in hardware, software, (4), or a combination thereof, 103444.doc • 25·1378694 Those skilled in the art will appreciate that these and other changes can be made in form and detail without departing from the scope and spirit of the invention. [FIG. 1 is a schematic diagram of a global connection of a network; 2 is a schematic diagram showing an embodiment of the present invention; FIG. 3 is a schematic diagram of unencrypted and encrypted data packets in various formats; and FIG. 4 is a diagram showing steps for initial signaling and content communication establishment according to an embodiment of the present invention. Flow chart BRIEF DESCRIPTION OF THE DRAWINGS FIG. 5 is a schematic diagram of a circuit for configuring a mobile node according to the present invention; and FIG. 6 is a schematic diagram of a circuit for monitoring a medium according to the present invention. 20 Internet 22 Network/Home Network Road 24 Network 25 Local Agent 26 Network/Foreign Network 30 Node 34 Node 36 Network/FA 38 Data Path 40 Data Path 41 PDSN (Packet Data Service Node) 42 Data Path 103444.doc 1378694

44 Data path 50 System 52 Backbone network 54 Home network 55 Wireless access network 56 Foreign network 58 Remote network 60 Mobile node 62 Local agent 64 Packet data service node 66 Foreign agent 68 PDSN (Packet data service Node) 70 P-CSCF (Proxy Call Status Session Function) 71 P-CSCF (Proxy Call Status Session Function) 72 S-CSCF (Service Call Status Session Function) 74 PCRF 75 PCRF (Policy and Billing Rules | J Function) 76 Wireless Access Network 78 PDSN (Packet Data Service Node) 80 P-CSCF (Proxy Call Status Session Function) 82 S-CSCF (Serving Call Status Session Function) 84 PCRF (Proxy and Charging Rules Function) 90 Corresponding Lang Point 92 Ty Interface 103444.doc -27- 5 1378694 94 Tx Interface 100 Data Packet 102 IP Header 104 Layer 4 Header 104A Layer 4 Header 106 Payload Data 106A Payload Data 108 Encrypted Data Packet 110 ESP (Package Security Sexual payload) header 112 ESP tail 114 verification data 118 data packet 102B packet segment IP header 106B payload data 120 IP header 121 rows Node device 122 central data bus 124 CPU/controller 126 receiving circuit 128 transmission circuit 130 memory unit 131 instruction 132 mobile IP user 134 SIP user 103444.doc .28· 5 1378694 140 PDSN device 142 central data bus 144 CPU/ Controller 146 Receive Circuit 148 Transfer Circuit 149 Library Storage Unit 150 Memory Unit 154 Command 156 PDSN Function 158 SBBC Function 103444.doc · 29· 5

Claims (1)

Patent application scope: A method for communication session via a supervisory patent application No. 094124012 The control medium carries an index to the source device via the 'including: " identification process; the device is included in the destination device signaling message; and is transmitted via the monitoring medium The signaling message having the index is sent to the communication session between the source device and the destination device: wherein the monitoring medium is operable to implement a γ/, the cable on the communication session? An associated security policy, wherein the implementation includes matching the index from the signaling message with a corresponding index from one of the data packets. The method of claim 1, wherein the step of signaling the communication session comprises, -i being responsive by the monitoring medium to an invitation to the communication session. 3. The method of claim 1, further comprising providing the index in the data packets of the communication session. 4. A method for conducting a communication session with an encrypted data packet via a monitoring medium in a communication system supported by 1 (Internet Protocol), comprising: providing an identification-SA (security association) SPI (Security Parameter Index); the SPI is included in a signaling message selected from the group consisting of a SIP INVITE message and a SIp 200 OK message; and the message having the SPI is sent via the monitoring medium Having a message to send a message to the communication session to allow the monitoring medium to use the SPI for packet data monitoring and for implementing on the communication session - a security policy associated with the index 103444-l010727.doc 5. The implementation includes matching the SPI from the signaling message with a SPI corresponding to one of the data packets. A method for monitoring a communication session having a data packet such as ~, and two additions, comprising: receiving a first index of a decryption process from a user's message at a monitoring medium, The signaling message is transmitted from a source mobile device to a destination mobile device; in the monitoring medium, a data packet of the communication session between the source mobile device and the destination mobile device receives a data packet a second index; performing a set of policies on the communication session with the monitoring medium by comparing the first node with the second index; and comparing the index to the second index And causing the data packet of the comparison-matching H-Heng L session to pass through the monitoring medium, and rejecting the data packet of the communication session when the comparison of the first index of the first index causes a comparison mismatch by. 6. The method of claim 5, wherein the signaling message is a first signaling message, the method further comprising receiving the first index from a second signaling message. 7. The method of claim 6, wherein the first signaling message is an invitation clearing heart of the communication session, and the second signaling message is one of the invitation messages responsive to the message. 8. A method for monitoring a communication session with an encrypted data packet in a communication system supported by IP (Internet Protocol), comprising: from a selected from a SIP INVITE message and a SIP 200 The signaling message of the group consisting of OK messages receives a first SPI (Security Parameter Index); I03444-I010727.doc I Year Out £: All: 匕2 Replacement Page I Receives a packet from the data session of the communication session A set of policies for implementing the communication session by using a monitoring medium, including the first SPI and the second SPI, wherein the implementation includes including the signaling from the signaling The first SPI of the Matsushita Matsui matches the second SPI from the data packets. 9. (4) A splitting of a communication session with an encrypted data packet via a monitoring medium, comprising: 1 providing a component identifying an encryption process to a source mobile device for use in the index Included in the mobile device signaling message; and for transmitting, via the supervisor, the sender, the sender, and the monitoring medium are operable to In the communication session; the second set of associated security policies, wherein the implementation includes matching the index of the message with the index.祁 corresponds to 〇·:: means of item 9 wherein the signaling message is an invitation message = includes means for responding to the invitation message in the indexer response message. 11. If the device of claim 9 is further configured, the index is included in the component of the data packet of the Yang encrypted data. Difficult 12. A device for controlling media "into" encrypted resources in a communication system that is controlled by a monitoring medium by Ip (Internet Protocol), which includes: The session 103444-I010727.doc is used to provide a component for identifying an SPI (Security Parameter Index) of an SA (Security Association); and for including the SPI in a group selected from a SIP INVITE message and a SIP 200 ⁄κ message a component in the signaling message; and means for transmitting the signaling message having the SPI via the monitoring medium to allow the monitoring medium to use the index for packet data monitoring and for implementing a set of A component of the security policy associated with the index, wherein the implementing includes matching the SPI from the signaling messages with a SPI corresponding to one of the data packets. 13. Apparatus for monitoring a communication session having an encrypted data packet, comprising: a signaling message for receiving an identification from a source mobile device to a destination mobile device at a monitoring medium a means for a first index of a decryption process; means for receiving a second index of the data packets of the communication session between the source mobile device and the destination mobile device at the monitoring medium; and for Means for comparing the first index with the second index to implement a group policy for the communication session with the monitoring medium; and for when the comparison of the first index and the second index results in a comparison match The data packets of the communication session are allowed to pass through the monitoring medium, and when the first index and the second index are compared, the means for rejecting the data packets of the communication session are rejected. 14. The apparatus of claim 13, wherein the signaling message is a first signaling message, 103444-1010727.doc -4 1378694. The apparatus further includes means for self-referencing. !Ι5ΓΤΓΓ5----------. I year of the month repair (more) Qiu Jie set page 丨i two signaling messages to receive the first cable 15. For example: the device of claim 14 'the first of which The signaling message is the message of the packet data message "Invite message, and the second signaling message is one of the invitation messages to respond to the message. 16. A device for monitoring a communication session with an encrypted data packet in a communication system supported by IP (Internet Protocol), comprising: for selecting from a SIp mvITE message and a SIp 2〇〇〇 means that the signaling message of the group of messages receives a first spi (security parameter index); means for receiving a second spl from the data packets of the communication session; and for borrowing Means for implementing a set of policies on the communication session by comparing the first SPI with the second spi with a monitoring medium, wherein the implementing includes causing the first SPI from the signaling message to be from the first SPI The second SPI of the data packet matches. 17. An apparatus for conducting a communication session with an encrypted data packet via a monitoring medium, comprising: a memory unit having computer readable instructions for self-contained at a monitoring medium A signaling message transmitted by a source mobile device to a destination mobile device receives a first index identifying an encryption process at which the data packets of the communication session between the source mobile device and the destination mobile device are Receiving a second index and including comparing the first cable by including? And the second index to implement a set of policies 103444-1010727.doc on the communication session, and allow the general cooperation when the comparison of the first index and the second index results in a comparison match The data packets are passed through the monitoring medium and the data packet rejecting the communication session when the comparison between the first index and the second index results in a comparison mismatch; and the processor circuit is transferred to the The memory unit handles these computer readable instructions. 18. The device of claim 17 which further comprises computer readable instructions for including the index in the data packets of the communication session. 19. A device for communication session with an encrypted data packet in a communication system supported by 1ρ (Internet Protocol), (4) by a supervisor (four), comprising: - a memory unit having a computer Readable finger +, which is used to provide - identify - SA (security association) spi (security parameter index), signaling for including the SPI in a group selected from - nlp INVITE message and -sip message And in the message, and for transmitting, by the monitoring medium, the signaling message having the SPI to allow the monitoring medium to use the SPI for packet data monitoring and for implementing a set of associated with the index on the communication session a security policy, wherein the implementing includes matching the SPI from the signaling messages with one of the data packets; and the processor circuit is coupled to the memory unit to process the computers Readable instructions. 20. A device for monitoring a communication session with an encrypted data packet comprising: a package 103444-10I0727.doc 1378694 a memory unit having a computer readable fingerprint that receives a first index identifying a decryption process by a signaling message, receiving a second index from the data packets of the communication session, and by including a ratio The first index and the second index are implemented on the communication session by a monitoring medium, wherein the implementation includes causing the first SPI from the signaling messages and the second from the data packets The SPI is matched; and the processor circuit is lightly coupled to the memory unit to process the computer readable instructions. 21. The apparatus of claim 2G, further comprising: a computer for allowing the data packets of the communication session to pass when the comparison between the first cable and the first index results in a comparison A readable instruction, and means for rejecting the passage of the data packets of the communication session when the comparison of the index and the second index results in a comparison mismatch. 22. The device of claim 2, wherein the signaling message is a - signaling message, the device further comprising computer readable instructions for receiving the first index from a second signaling message. 23. The apparatus of claim 22, wherein the first signaling message is an invitation message of the communication session and the second signaling message is a response message of the invitation message. 24. A device for monitoring a communication session with an encrypted data packet in a communication system supported by IP (Internet Protocol), comprising: a § memory unit having a computer readable An instruction for receiving a first SPI (Security Parameter Index) from a group of 103444-1010727.doc selected from a group consisting of a SIP INVITE message and a SIp 2〇〇〇κ message (3⁄4 positive replacement page signaling message) Receiving a second SPI from the data packets of the communication session, and implementing a set of policies on the communication session by comparing the first SPI and the second SPI with a monitoring medium, wherein the implementation includes The first SPI from the signaling messages matches the second SPI from the data packets; and a processor circuit coupled to the memory unit to process the computer readable instructions. An electrotype program product that includes computer readable instructions for: providing an index identifying an encryption process to a source mobile device; including the index in a one to one destination mobile device signaling message; Transmitting, by the monitoring medium, the signaling message having the index, the communication session between the source mobile device and the destination mobile device, wherein the monitoring medium is operable to implement a set of The security policy associated with the index, wherein the implementation includes matching the index from the signaling messages with a corresponding index from one of the data packets. 26 - a computer program product that includes a computer readable The instructions are for: receiving, at a monitoring medium, a first index identifying a decryption process from a signaling message, the signaling message being transmitted from a source mobile device to a destination mobile device; at the monitoring medium from the source The data packet of the communication session between the mobile device and the destination mobile device receives a second index; and implements a group on the communication session with the monitoring medium by comparing the first index with the second index Strategy; and 103444-10lQ727.doc 1378694 ... 10L 7. 25 j month for t 2" .: ί _a au. η : _, > Tian the index and the second index The comparison causes the data packets of the pass k session to pass through the monitoring medium when a comparison is matched, and when the comparison of the first index and the second index results in a comparison of the mismatch, the data of the communication session is rejected. The packet passed. 103444·丨010727.doc -9*