WO2005013558A1 - Procede d'authentification pour passerelle de media - Google Patents

Procede d'authentification pour passerelle de media Download PDF

Info

Publication number
WO2005013558A1
WO2005013558A1 PCT/CN2003/001069 CN0301069W WO2005013558A1 WO 2005013558 A1 WO2005013558 A1 WO 2005013558A1 CN 0301069 W CN0301069 W CN 0301069W WO 2005013558 A1 WO2005013558 A1 WO 2005013558A1
Authority
WO
WIPO (PCT)
Prior art keywords
media gateway
shared key
key
gateway controller
lifetime
Prior art date
Application number
PCT/CN2003/001069
Other languages
English (en)
French (fr)
Inventor
Kezhi Qiao
Ming Ni
Original Assignee
Zte Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zte Corporation filed Critical Zte Corporation
Priority to US10/566,206 priority Critical patent/US7492899B2/en
Priority to ES03779653.9T priority patent/ES2515815T3/es
Priority to AU2003289653A priority patent/AU2003289653A1/en
Priority to EP03779653.9A priority patent/EP1653661B1/en
Publication of WO2005013558A1 publication Critical patent/WO2005013558A1/zh
Priority to US11/566,206 priority patent/US7389408B1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/068—Network architectures or network communication protocols for network security for supporting key management in a packet data network using time-dependent keys, e.g. periodically changing keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/102—Gateways
    • H04L65/1023—Media gateways
    • H04L65/103—Media gateways in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/102—Gateways
    • H04L65/1033—Signalling gateways
    • H04L65/104—Signalling gateways in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1101—Session protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method for implementing a media gateway authentication using a MEGAC0 / MGCP protocol. Background technique
  • the Media Gateway Control (MEGAC0) protocol is the RFC3015 protocol of the Internet Engineering Task Force (IETF).
  • FIG. 1 shows the system network diagram of the MEGAC0 protocol.
  • the MEGAC0 protocol adopts the concept of a separate gateway, and divides the original signaling and media processing gateway into two parts: a media gateway (Media Gateway, MG for short) and a media gateway controller (Media Gateway Control, MGC).
  • the MGC controls the actions of the MG through the MEGACO protocol:
  • the MGC sends a ⁇ I command to the MG, the MG executes and returns the result, and the media gateway controller MGC must also handle the events reported by the media gateway MG actively. Please call the logic in the MEGACO protocol
  • the relationship is shown through the connection model.
  • the two most basic components in the connection model are the association and the termination point.
  • the relationship between the termination point and the topology relationship is shown.
  • the main commands between the Media Gateway Controller MGC and the Media Gateway MG include
  • SERVICECHANGE register
  • ADD add
  • MODIFY modify
  • SUBTRACT delete
  • NOTIFY notification
  • the media gateway MG is regularly posed with a constant key ⁇ :
  • the same key is used for long-term authentication, which is easy for third parties to crack ;
  • the method of periodic authentication the third party is easy to filter the authentication message to the real M (to enable successful authentication between the media gateway controller MGC and the media gateway MG, and forge other MG messages to initiate a call
  • the gateway controller MGC authenticates the media gateway MG, so the media gateway MG may be called by an illegal media gateway controller MGC to forge messages.
  • the purpose of the present invention is to provide a more complete authentication mechanism for media gateways, which solves the problem that the third party in the traditional MG authentication method is easy to forge the media gateway MG to initiate a call, and it is easy to forge the media gateway controller MGC to call the media gateway MG and the key
  • the problem that may not be solved for a long time can be solved, each call can be authenticated, and the shared key can be changed regularly to effectively prevent illegal forged messages from calling it.
  • the invention is implemented as follows:
  • the invention discloses a method for authenticating a media gateway, which includes: setting an initial key for an initial digital signature of both parties, for the media gateway and the media gateway controller; the media gateway and the media gateway The controller performs signaling communication with the initial key to generate a new shared key with a specific lifetime; the media gateway and the media gateway controller use the new shared key to authenticate calls and responses If the lifetime of the new shared key ends, the media gateway and the media gateway controller update the shared key.
  • the step of generating the shared key further includes: the media gateway initiates registration signaling to the media gateway controller for registration, and the registration signaling carries parameters for generating the shared key and the The digital signature generated by the initial key; after the media gateway controller verifies that the media gateway is legal with the initial key, generating a shared key and setting a lifetime of the shared key; the media gateway controller Initiating a modification command to the media gateway, where the modification command carries parameters for generating a shared key, a digital signature generated from the initial key, and a lifetime of the shared key; the media gateway uses the initial After the key verifies that the media gateway controller is legitimate, a shared key is generated and a lifetime of the shared key is set.
  • the authentication step further includes: the media gateway controller digitally signs each call message to the media gateway with the shared key; and the media gateway uses the shared key to pair the call with each other.
  • the digital signature in the message is used for verification. If it is valid, then Return to the media gateway controller a response message digitally signed with the shared key; the media gateway controller uses the shared key to verify the digital signature in the response message, and if it is valid, then Set up the call, otherwise, reject the call.
  • the step of updating the shared key further includes: the media gateway sends a notification command to the media gateway controller, requesting the media gateway controller to generate a new shared key, and the notification command carries a
  • the media gateway controller uses the initial key to verify that the media gateway is legal, and generates a new shared key and sets the share. Key lifetime; the media gateway controller initiates a modification command to the media gateway, wherein the modification command includes parameters for generating a shared key, a digital signature generated from the initial key, and a shared key
  • the media gateway verifies that the media gateway controller is legal with the initial key, generates a shared key and sets a lifetime of the shared key.
  • the algorithm used by the media gateway controller and the media gateway to generate a shared key is different from the algorithm used by the media gateway controller and the media gateway to generate a digital signature.
  • the transmission of the parameters for generating the shared key and the digital signature can be implemented by extending the fields or packets of the protocol.
  • the lifetime of the shared key may be time or the number of times a new shared key is available for authentication.
  • the beneficial effect of adopting the technical solution of the present invention is that it can not only change the key regularly, but prevent easy authentication with the same key for a long time; it can authenticate each call of the media gateway MG, and solve the problem of filtering messages by a third party.
  • the problem of initiating an illegal call it can also prevent the media gateway MG from completing the call under the control of an illegal media gateway controller MGC.
  • Figure 1 shows the schematic diagram of the MEGAC0 protocol system
  • FIG. 2 is a schematic flowchart of realizing a media gateway gateway right according to the present invention. detailed description
  • the invention discloses a method for media gateway authentication, which includes the following steps:
  • the algorithm for generating a shared key by the media gateway controller and the media gateway, and the algorithm for generating a digital signature by the media gateway controller and the media gateway may adopt an appropriate algorithm according to the needs of the security level.
  • the present invention There is no limitation on the specific algorithm used.
  • the media gateway MG and the media gateway controller MGC are initially provided with a key S for the initial digital signature of the two parties.
  • the key S of the media gateway MG and the media gateway controller MGC may be different, as long as the other party's digital The signature is enough; the transmission of the key and parameters can be realized by extending the MEGAC0 field or the packet.
  • the media gateway MG first initiates registration signaling registration with the media gateway controller MGC, and carries a ⁇ : and a digital signature for generating a shared key.
  • the media gateway controller MGC generates a shared key after it is valid, and sends a modify command to the media gateway MG to generate the shared key parameters, digital signature, and set the shared key lifetime. After receiving the media gateway MG, it verifies that the digital signature is valid and generates Shared key.
  • the media gateway controller MGC and the media gateway MG use the shared key to sign and verify each other's legitimacy before making the call. call.
  • the media gateway controller MGC> ⁇ some keys are invalid; the media gateway MG needs to immediately request the media gateway controller MGC to use the notification command to generate a new shared key and obtain the survival of the new key. period.
  • Figure 2 shows a detailed process of implementing authentication. Set the initial key between MG and MGC to S.
  • the media gateway MG initiates a registration message to the media gateway controller MGC.
  • the message carries the information M for the media gateway controller MGC to generate a shared key, and it also carries a common key S to the public key.
  • the media gateway controller MGC After receiving the message, the media gateway controller MGC uses the key S to verify the digital signature, and if successful, it uses the shared key information M to generate the shared key S ', and responds to the media gateway MG with success;
  • the media gateway controller MGC and the body gateway MG send a modification (MODIFY) message, which carries the information N for the media gateway MG to generate the shared key, and carries the information N for the shared key with the key S or the entire message generation Digital signature with new shared key lifetime:
  • the lifetime can be a time, or the number of times the new shared key can be used for authentication;
  • the media gateway MG After receiving the message, the media gateway MG uses the key S to verify the digital signature. If it succeeds, it uses the shared key information N to generate a shared key, and responds to the media gateway controller MGC.
  • the media gateway controller MGC digitally signs with the new shared key S ';
  • the media gateway MG After receiving the message, the media gateway MG uses the new shared key to verify the digital signature. If the media gateway controller MGCJ successfully proves to be legal, the response to the media gateway controller MGC is also digitally signed with the new shared key. After receiving the media gateway controller MGC, the call is established with the new shared key S 'and the call is established successfully. Otherwise, the call is rejected by the illegal media gateway MG, and the media gateway controller MGC periodically authenticates the media gateway MG. In the same way
  • the media gateway MG reports a notification (N0ITFY) message to the media gateway controller MGC, and the message carries a message for the media gateway controller MGC to generate the shared key.
  • Information with a digital signature generated by the key S to the shared key information NT or the entire message;
  • the media gateway controller MGC digitally signs the key S after receiving the message, and if successful, generates the shared key S using the shared key information, and responds to the media gateway MG with success;
  • the media gateway controller MGC body gateway MG sends a modification (MODIFY) message,
  • the message carries the information N ′ used for the media gateway MG to generate the shared key, and carries the shared key information N ′ with the key S or the digital signature generated by the entire message, and also carries the new shared key lifetime.
  • the media gateway MG uses the shared key information N 'to generate a new shared key and uses the new shared key to authenticate subsequent calls and periodic authentication;
  • the media gateway MG successfully responds to the media gateway controller MGC.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)

Description

媒体网关鉴权的方法
技术领域
本发明涉及通信技术领域， 尤其涉及用 MEGAC0/MGCP协议实现媒体 网关鉴权方法。 背景技术
媒体网关控制（Media Gateway Control , MEGAC0) 协议是因特网工 程业务组 （The Internet Engineering Task Force , 简称 IETF)的 RFC3015协议。
如图 1所示为实现 MEGAC0协议的系统组网图。 MEGAC0协议采用了分 离网关思想， 将原来信令和媒体集中处理的网关分解为两部分： 媒体网 关（Media Gateway , 简称 MG)和媒体网关控制器（Media Gateway Control ler , 简称 MGC)。 MGC通过 MEGACO协议控制 MG的动作： MGC向 MG发出^ I行的命令， MG执行并将结果返回， 媒体网关控制器 MGC也要 处理媒体网关 MG主动上报所发生的事件请农 MEGACO协议中的逻辑关系 是通过连接模型^^示， 连接模型中两个最基本的构件就是关联和终结 点， 关^^示了终结点之间的连接和拓朴关系。
媒体网关控制器 MGC 和媒体网关 MG 之间的主要命令包括
SERVICECHANGE (注册）， ADD (增加）， MODIFY (修改）， SUBTRACT (删除）， NOTIFY (通知）等等。
传统的媒体网关鉴权方法， 当媒体网关 MG注册完成后， 通过一个不 变的密钥定期对媒体网关 MG进行姿^: 一方面用同一密钥长时间进行鉴 权， 易于被第三者破解； 另一方面定期鉴权的方法， 第三者易于通过只 把鉴权消息过滤给真正 Μ(¾使媒体网关控制器 MGC和媒体网关 MG之间成 功鉴权， 而伪造其它的 MG消息发起呼叫； 第三， 原有的方法中只有媒体 网关控制器 MGC对媒体网关 MG鉴权， 因此媒体网关 MG有可能被不合法 的媒体网关控制器 MGC伪造消息对其呼叫。 发明内容
本发明的目的在于提供一种更加完备的对媒体网关鉴权机制， 解决 传统 MG鉴权方法中第三者易于伪造媒体网关 MG发起呼叫、 易于伪造媒 体网关控制器 MGC呼叫媒体网关 MG以及密钥长时间不变可能^破解的 问题， 能对每个呼叫都进行鉴权， 能定期更换共享密钥， 有效防止不合 法的伪造消息对其呼叫。
本发明是这样实现的：
本发明公开了一种媒体网关鉴权的方法， 包括： 为媒体网关和媒体 网关控制器之间设定一个用于 ji iE双方初始数字签名的初始密钥； 所述 媒体网关和所述媒体网关控制器用所述初始密钥进行信令通信， 以生成 新的具有特定生存期的共享密钥； 所述媒体网关和所述媒体网关控制器 用所述新的共享密钥对呼叫和应答进行鉴权； 若所述新的共享密钥的生 存期结束， 则所述媒体网关和所述媒体网关控制器更新所述共享密钥。
优选地， 所迷生成共享密钥的步骤进一步包括： 所述媒体网关向所 述媒体网关控制器发起注册信令进行注册， 所述注册信令中带有用于生 成共享密钥的参数及由所述初始密钥生成的数字签名； 所述媒体网关控 制器用所述初始密钥验证所述媒体网关合法后， 生成共享密钥并设定所 述共享密钥的生存期； 所述媒体网关控制器对所述媒体网关发起修改命 令， 所述修改命令中带有用于生成共享密钥的参数、 由所述初始密钥生 成的数字签名及共享密钥的生存期； 所述媒体网关用所述初始密钥验证 所述媒体网关控制器合法后， 生成共享密钥并设定所述共享密钥的生存 期。
优选地， 所述鉴权步骤进一步包括： 所述媒体网关控制器用所述共 享密钥在每次对媒体网关的呼叫消息中进行数字签名； 所述媒体网关用 所述共享密钥对所述呼叫消息中的所述数字签名进行验证， 若合法， 则 返回给所述媒体网关控制器带有用所述共享密钥数字签名的应答消息； 所述媒体网关控制器用所述共享密钥对所述应答消息中的所述数字签名 进行验证， 若合法， 则建立呼叫， 否则， 拒绝此次呼叫。
优选地， 所述更新共享密钥的步骤进一步包括： 所述媒体网关向所 述媒体网关控制器发送通知命令， 请求所述媒体网关控制器生成新的共 享密钥， 所述通知命令中带有用于生成共享密钥的参数和由所述初始密 钥生成的数字签名； 所述媒体网关控制器用所述初始密钥验证所述媒体 网关合法后， 生成新的共享密钥并设定所述共享密钥的生存期； 所述媒 体网关控制器对所述媒体网关发起修改命令， 所述修改命令中带有用于 生成共享密钥的参数、 由所述初始密钥生成的数字签名及共享密钥的生 存期； 所述媒体网关用所述初始密钥验证所述媒体网关控制器合法后， 生成共享密钥并设定所述共享密钥的生存期。
优选地， 所述媒体网关控制器和所述媒体网关生成共享密钥采用的 算法与所述媒体网关控制器和所述媒体网关生成数字签名的算法为不同 的算法。
优选地， 所述生成共享密钥的参数和数字签名的传送可以通过扩展 协议的字段或包来实现。
优 ^地， 所述共享密钥的生存期可以是时间， 也可以是新的共享密 钥可用于鉴权的次数。
采用本发明技术方案的有益效果， 不仅能够定期更换密钥， 防止长 时间用同一密钥鉴权易于被破解； 能够对媒体网关 MG 的每一个呼叫 进行鉴权， 解决了第三者通过过滤消息发起非法呼叫的问题； 还能够防 止媒体网关 MG被不合法的媒体网关控制器 MGC控制完成呼叫。 附图说明
图 1示出了 MEGAC0协议系统的原理图；
图 2示出了本发明实现媒体关网关婆权的流程示意图。 具体实施方式
本发明公开了一种媒体网关鉴权的方法， 包括以下步骤：
设定媒体网关 MG和媒体网关控制器 MGC之间生成共享密钥采用的算 法为 y=f i (x) ,设定 MG和 MGC之间生成数字签名采用的算法为 y=f 2 (x)； 所述媒体网关控制器和所述媒体网关生成共享密钥的算法， 以及所述媒 体网关控制器和所述媒体网关生成数字签名的算法， 可以根据安全級别 的需要而采用合适算法， 本发明对具体所用的算法不做限定。
媒体网关 MG和媒体网关控制器 MGC之间初始配有一个用于¾£双方 初始数字签名的密钥 S, 媒体网关 MG和媒体网关控制器 MGC的密钥 S可 以不同， 只要能验证对方的数字签名即可； 密钥及参数的传送可以通过 扩展 MEGAC0字段或包来实现。
媒体网关 MG首先向媒体网关控制器 MGC发起注册信令注册， 并带有 生成共享密钥的^：及数字签名。 媒体网关控制器 MGC 合法后生成 共享密钥，用修改命令发送给媒体网关 MG生成共享密钥的参数、 数字签 名及设定共享密钥生存期， 媒体网关 MG收到后验证数字签名合法将生成 共享密钥。
在后续的媒体网关控制器 MGC和媒体网关 MG之间的每一个呼叫建立 及应答的消息中，媒体网关控制器 MGC和媒体网关 MG用共享密钥进行签 名， 相互验证合法后进行呼叫， 否则拒绝呼叫。
当共享密钥生存期结束以后， 媒体网关控制器 MGC >ί 、有的密钥无 效； 媒体网关 MG需立刻用通知命令请求媒体网关控制器 MGC生成新的共 享密钥及获取新密钥的生存期。
如此不断变化密钥并用新的密钥对呼叫鉴权。
下面将结合附图， 举例说明本发明的一个实施的方式。
图 2所示的一种实现 鉴权的详细过程。 设定 MG和 MGC之间的初 始密钥为 S。
201) 媒体网关 MG向媒体网关控制器 MGC发起注册消息， 消息中带 有用于媒体网关控制器 MGC生成共享密钥的信息 M,并带有用密钥 S对共 享密钥的信息 M或注册消息生成的数字签名；
202)媒体网关控制器 MGC收到该消息后用密钥 S验证数字签名， 如 果成功则用共享密钥的信息 M生成共享密钥 S'，并给媒体网关 MG应答成 功；
203) 媒体网关控制器 MGC 体网关 MG发修改（MODIFY )消息， 消息中带有用于媒体网关 MG生成共享密钥的信息 N, 并带有用密钥 S对 共享密钥的信息 N或整个消息生成的数字签名， 同时还带有新的共享密 钥生存期： 生存期可以是一个时间， 也可以是新的共享密钥可用于鉴权 的次数；
204) 媒体网关 MG收到该消息后用密钥 S验证数字签名， 如果成功 则用共享密钥的信息 N生成共享密钥 ， 并给媒体网关控制器 MGC应答 成功；
205) 在以后的每次呼叫建立的某个消息（比如 ADD )中， 媒体网关 控制器 MGC用新的共享密钥 S'进行数字签名；
206) 媒体网关 MG收到该消息后用新的共享密钥 验证数字签名， 如果成功证明是合法的媒体网关控制器 MGCJ对媒体网关控制器 MGC的应 答也用新的共享密钥 进行数字签名， 媒体网关控制器 MGC收到后用新 的共享密钥 S'验证成功后建立呼叫， 否则为非法的媒体网关 MG, 拒绝该 呼叫； 在媒体网关控制器 MGC对媒体网关 MG的定期鉴权中也用同样的方 法；
207) 当媒体网关控制器 MGC设定的共享密钥生存期结束后， 媒体网 关 MG向媒体网关控制器 MGC上报通知 ( N0ITFY )消息， 消息中带有用于 媒体网关控制器 MGC生成共享密钥的信息 ， 并带有用密钥 S对共享密 钥的信息 NT或整个消息生成的数字签名；
208)媒体网关控制器 MGC收该消息后用密钥 S 数字签名， 如果 成功则用共享密钥的信息 生成共享密钥 S ， 并给媒体网关 MG应答成 功；
209) 媒体网关控制器 MGC 体网关 MG发修改（MODIFY )消息， 消息中带有用于媒体网关 MG生成共享密钥的信息 N'， 并带有用密钥 S 对共享密钥的信息 N'或整个消息生成的数字签名， 同时还带有新的共享 密钥生存期； 媒体网关 MG用共享密钥的信息 N'生成新的共享密钥 并用新的共享密钥 对后续呼叫鉴权及定期鉴权；
210)媒体网关 MG给媒体网关控制器 MGC成功的应答。
新的共享密钥 生存期到后再重复 207)—210)步骤生成新的共享 密钥 S' ' ' , 依次类推。 权的方法进行了特别描述， 本领域技术人员将能理解， 在不偏离本发明 的范围和精神的情况下， 可以对它进行形式和细节的种种显而易见的修 改。 例如， 由于 MEGAC0协议和 MGCP协议的相似性， 本法的技术方案的 实质内同对于使用 MGCP协议实现媒体网关鉴权同样适用。 因此， 以上描 述的实施例是说明性的而不是限制性的， 在不脱离本发明的精神和范围 的情况下， 所有的变化和修改都在本发明的范围之内。

Claims

权利要求
1， 一种媒体网关鉴权的方法， 其特征在于， 该方法包括： 为媒体网关和媒体网关控制器之间设定一个用于 双方初始数字 签名的初始密钥；
所述媒体网关和所述媒体网关控制器用所述初始密钥进行信令通 信， 以生成新的具有特定生存期的共享密钥；
所述媒体网关和所述媒体网关控制器用所述新的共享密钥对呼叫和 应答进行鉴权；
若所述新的共享密钥的生存期结束， 则所述媒体网关和所述媒体网 关控制器更新所述共享密钥。
2. 如权利要求 1所述的方法， 其特征在于， 所述生成共享密钥的步 骤进一步包括：
所述媒体网关向所述媒体网关控制器发起注册信令进行注册， 所述 注册信令中带有用于生成共享密钥的参数及由所述初始密钥生成的数字 签名；
所述媒体网关控制器用所述初始密钥验证所述媒体网关合法后， 生 成共享密钥并设定所述共享密钥的生存期；
所述媒体网关控制器对所述媒体网关发起修改命令， 所述修改命令 中带有用于生成共享密钥的参数、 由所述初始密钥生成的数字签名及共 享密钥的生存期；
所述媒体网关用所述初始密钥验证所述媒体网关控制器合法后， 生 成共享密钥并设定所述共享密钥的生存期。
3. 如权利要求 1所述的方法， 其特征在于， 所述鉴权步驟进一步包 括：
所述媒体网关控制器用所述共享密钥在每次对媒体网关的呼叫消息 中进行数字签名；
所述媒体网关用所述共享密钥对所述呼叫消息中的所述数字签名进 行验证， 若合法， 则返回给所述媒体网关控制器带有用所述共享密钥数 字签名的应答消息；
所述媒体网关控制器用所述共享密钥对所述应答消息中的所述数字 签名进行验证， 若合法， 则建立呼叫， 否则， 拒绝此次呼叫。
4. 如权利要求 1所述的方法， 其特征在于， 所述更新共享密钥的步 驟进一步包括：
所述媒体网关向所述媒体网关控制器发送通知命令， 请求所述媒体 网关控制器生成新的共享密钥， 所述通知命令中带有用于生成共享密钥 的参数和由所述初始密钥生成的数字签名；
所述媒体网关控制器用所述初始密钥 所述媒体网关合法后， 生 成新的共享密钥并设定所述共享密钥的生存期；
所述媒体网关控制器对所迷媒体网关发起修改命令， 所述修改命令 中带有用于生成共享密钥的参数、 由所述初始密钥生成的数字签名及共 享密钥的生存期；
所述媒体网关用所述初始密钥验证所述媒体网关控制器合法后， 生 成共享密钥并设定所述共享密钥的生存期。
5. 如权利要求 2、 3或 4所述的方法， 其特征在于， 所述媒体网关 控制器和所述媒体网关生成共享密钥采用的算法与所述媒体网关控制器 和所述媒体网关生成数字签名的算法为不同的算法。
6. 如权利要求 2、 3或 4所述的方法， 其特征在于， 所述生成共享 密钥的参数和数字签名的传送可以通过扩展协议的字段或包来实现。
7. 如权利要求 1所述的方法， 其特征在于， 所述共享密钥的生存期 可以是时间， 也可以是新的共享密钥可用于鉴权的次数。
PCT/CN2003/001069 2003-08-05 2003-12-16 Procede d'authentification pour passerelle de media WO2005013558A1 (fr)

Priority Applications (5)

Application Number Priority Date Filing Date Title
US10/566,206 US7492899B2 (en) 2003-08-05 2003-12-16 Authentication method for media gateway
ES03779653.9T ES2515815T3 (es) 2003-08-05 2003-12-16 Método de autenticación para pasarela médica
AU2003289653A AU2003289653A1 (en) 2003-08-05 2003-12-16 Authentication method for medic gateway
EP03779653.9A EP1653661B1 (en) 2003-08-05 2003-12-16 Authentication method for medic gateway
US11/566,206 US7389408B1 (en) 2003-08-05 2006-12-01 Microarchitecture for compact storage of embedded constants

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN03149767.5A CN1286306C (zh) 2003-08-05 2003-08-05 媒体网关鉴权的方法
CN03149767.5 2003-08-05

Publications (1)

Publication Number Publication Date
WO2005013558A1 true WO2005013558A1 (fr) 2005-02-10

Family

ID=34109573

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2003/001069 WO2005013558A1 (fr) 2003-08-05 2003-12-16 Procede d'authentification pour passerelle de media

Country Status (7)

Country Link
US (1) US7492899B2 (zh)
EP (1) EP1653661B1 (zh)
CN (1) CN1286306C (zh)
AU (1) AU2003289653A1 (zh)
ES (1) ES2515815T3 (zh)
PT (1) PT1653661E (zh)
WO (1) WO2005013558A1 (zh)

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1275419C (zh) * 2002-10-18 2006-09-13 华为技术有限公司 一种网络安全认证方法
CN100384251C (zh) * 2004-08-02 2008-04-23 华为技术有限公司 用户授权方法及其授权系统
CN1992706A (zh) * 2005-12-26 2007-07-04 华为技术有限公司 媒体网关中统计参数取值调整方法
EP2165507B1 (de) * 2007-06-11 2011-09-07 Fts Computertechnik Gmbh Verfahren und architektur zur sicherung von echtzeitdaten
WO2009130931A1 (ja) * 2008-04-21 2009-10-29 日本電気株式会社 Imsシステム、as装置およびmgw装置、imsシステムにおける輻輳規制通知方法
EP2487856B1 (en) 2010-02-11 2016-04-20 Huawei Technologies Co., Ltd. Media stream transmission key operating method, apparatus and system
CN102202389B (zh) * 2010-03-25 2016-03-30 中兴通讯股份有限公司 一种对网关实现管理的方法及系统
CN102215560B (zh) * 2010-04-08 2015-06-10 中兴通讯股份有限公司 一种对m2m终端实现管理的方法及系统
US8555332B2 (en) 2010-08-20 2013-10-08 At&T Intellectual Property I, L.P. System for establishing communications with a mobile device server
US8438285B2 (en) 2010-09-15 2013-05-07 At&T Intellectual Property I, L.P. System for managing resources accessible to a mobile device server
US8610546B2 (en) 2010-10-01 2013-12-17 At&T Intellectual Property I, L.P. System for selecting resources accessible to a mobile device server
US8504449B2 (en) 2010-10-01 2013-08-06 At&T Intellectual Property I, L.P. Apparatus and method for managing software applications of a mobile device server
US8478905B2 (en) 2010-10-01 2013-07-02 At&T Intellectual Property I, Lp System for synchronizing to a mobile device server
US8516039B2 (en) 2010-10-01 2013-08-20 At&T Intellectual Property I, L.P. Apparatus and method for managing mobile device servers
US8443420B2 (en) 2010-10-01 2013-05-14 At&T Intellectual Property I, L.P. System for communicating with a mobile device server
US8989055B2 (en) 2011-07-17 2015-03-24 At&T Intellectual Property I, L.P. Processing messages with a device server operating in a telephone
US9392316B2 (en) 2010-10-28 2016-07-12 At&T Intellectual Property I, L.P. Messaging abstraction in a mobile device server
US9066123B2 (en) 2010-11-30 2015-06-23 At&T Intellectual Property I, L.P. System for monetizing resources accessible to a mobile device server
CN103685353A (zh) * 2012-09-05 2014-03-26 中兴通讯股份有限公司 网关管理终端的方法及装置
US9462332B2 (en) 2012-12-05 2016-10-04 At&T Intellectual Property I, L.P. Method and apparatus for controlling a media device
CN103560875B (zh) * 2013-08-27 2016-08-17 兴唐通信科技有限公司 基于h.248协议的专用通道密钥协商方法及装置
JP2015186249A (ja) * 2014-03-26 2015-10-22 沖電気工業株式会社 通信システム、セッション制御装置及び転送制御装置
US11223473B2 (en) * 2019-02-01 2022-01-11 EMC IP Holding Company LLC Client-driven shared secret updates for client authentication

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1308472A (zh) * 2000-02-09 2001-08-15 朗迅科技公司 利用刷新密钥执行密钥刷新的方法和装置
WO2002054201A2 (en) * 2000-12-29 2002-07-11 Intel Corporation System and method for providing authentication and verification services in an enhanced media gateway
CN1411224A (zh) * 2001-09-29 2003-04-16 华为技术有限公司 一种pc客户端的安全认证方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7089211B1 (en) * 2000-01-12 2006-08-08 Cisco Technology, Inc. Directory enabled secure multicast group communications
EP1316171A4 (en) * 2000-08-04 2006-05-03 First Data Corp PERSONNEL AND CONTOUR DIGITAL SIGNATURE SYSTEM
EP1318683A1 (de) * 2001-12-10 2003-06-11 Siemens Aktiengesellschaft Verfahren zum Übermitteln von Signalisierungsnachrichten, zugehörige Vorrichtung, zugehörige Signalisierungsnachricht und zugehöriges Programm
US20060274899A1 (en) * 2005-06-03 2006-12-07 Innomedia Pte Ltd. System and method for secure messaging with network address translation firewall traversal

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1308472A (zh) * 2000-02-09 2001-08-15 朗迅科技公司 利用刷新密钥执行密钥刷新的方法和装置
WO2002054201A2 (en) * 2000-12-29 2002-07-11 Intel Corporation System and method for providing authentication and verification services in an enhanced media gateway
CN1411224A (zh) * 2001-09-29 2003-04-16 华为技术有限公司 一种pc客户端的安全认证方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1653661A4 *

Also Published As

Publication number Publication date
ES2515815T3 (es) 2014-10-30
EP1653661A1 (en) 2006-05-03
US20060236101A1 (en) 2006-10-19
US7492899B2 (en) 2009-02-17
CN1286306C (zh) 2006-11-22
CN1581858A (zh) 2005-02-16
EP1653661A4 (en) 2012-01-04
AU2003289653A1 (en) 2005-02-15
PT1653661E (pt) 2014-10-22
EP1653661B1 (en) 2014-07-30

Similar Documents

Publication Publication Date Title
WO2005013558A1 (fr) Procede d'authentification pour passerelle de media
US7813509B2 (en) Key distribution method
JP2010086529A (ja) 連続する再認証を必要としないｓｉｐシグナリング
JP3936362B2 (ja) セキュリティアソシエーションの寿命を制御するための方法及び通信システム
US6892308B1 (en) Internet protocol telephony security architecture
WO2006000144A1 (fr) Procede d'identification de protocole initial de session
WO2007009343A1 (fr) Systeme d'autorisation d'acces d'un reseau de communication et son procede
US8923279B2 (en) Prevention of voice over IP spam
JP2007006154A (ja) 通信システム及びセッション確立方法
US20070211867A1 (en) Method and apparatus for token distribution in session for future polling or subscription
JP2013512594A (ja) 認証システム、方法および設備
WO2007076720A1 (fr) Procédé et dispositif de régulation de ressources média
CN110572819B (zh) 基于区块链的多域无线Mesh网络跨域认证方法及系统
US7591013B2 (en) System and method for client initiated authentication in a session initiation protocol environment
JP4778282B2 (ja) 通信接続方法及びシステム並びにプログラム
US20040043756A1 (en) Method and system for authentication in IP multimedia core network system (IMS)
EP2809042A1 (en) Method for authenticate a user associated to a user agent implemented over SIP protocol
WO2012003689A9 (zh) 分布式动态密钥管理方法及装置
JP2012519997A (ja) 通信ネットワークにおける個人情報の一時共有によって強化された通信のための方法およびノード
DE60300912D1 (de) Verfahren zur Verwaltung von der Sicherheit von Border-Gateway-Protocol-Nachrichten
CN1881870A (zh) 一种设备间安全通信的方法
WO2010115322A1 (zh) 预定义加入群组会话的加入实现方法和系统
CA2461418C (en) Method and device for implementing a firewall application for communication data
CN100382484C (zh) 一种直接路由模式下跨关守管理范围的会话密钥分配方法
CN103200200A (zh) 一种sip终端的防盗打方法及一种sip服务器

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): BW GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2003779653

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2003779653

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2006236101

Country of ref document: US

Ref document number: 10566206

Country of ref document: US

WWP Wipo information: published in national office

Ref document number: 10566206

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: JP