WO2009094812A1

WO2009094812A1 - Method and apparatus for implementing the security of point to point media stream

Info

Publication number: WO2009094812A1
Application number: PCT/CN2008/000624
Authority: WO
Inventors: Yinxing Wei; Zhimeng Teng
Original assignee: Zte Corporation
Priority date: 2008-01-23
Filing date: 2008-03-28
Publication date: 2009-08-06
Also published as: CN101222324B; CN101222324A

Abstract

A method and apparatus for implementing the security of point to point media stream are provided. The method includes the following steps: the first terminal and the second terminal establish a session including the signaling layer; the first terminal and the second terminal negotiate about the security parameters in the signaling layer; the security parameters are transferred from the signaling layer to the media layer; and the point to point media stream in the media layer between the first terminal and the second terminal is protected using the security parameters. The invention can provide security protection for the point to point mediastream.

Description

For end-to-end media streaming security

The present invention relates to the field of communications, and in particular to a method and apparatus for implementing media stream security for end-to-end (ie, user-to-user, Point To Point, P2P). BACKGROUND With the rise of Internet Protocol Television (IPTV) and the widespread use of Voice over IP (VoIP) technology, media stream security is becoming more and more important. Media stream security protects user-side data (such as video, voice, pictures, text, etc.) to prevent unauthorized users from accessing the data illegally. Media stream security is a value-added service of the network; in addition, the security requirements of the media stream involving user privacy also require the network to provide corresponding security. In the next Next Generation Network (NGN), media stream security is a basic requirement. The NGN network should be able to guarantee the confidentiality and integrity of the transmitted media stream. The media stream security here refers to cryptographic security, that is to say, using cryptographic protection technologies (such as integrity protection, encryption protection), the attacker cannot decipher the protected media stream data with limited resources. At present, the implementation method of media stream security is: negotiation and allocation of keys and security parameters required by network devices to participate in media stream security. This reduces the security of end-to-end media stream transmission. SUMMARY OF THE INVENTION An implementation method and apparatus for end-to-end media stream security can solve the problem that the prior art cannot provide security protection for end-to-end media streams. In an embodiment of the present invention, an end-to-end scheme is provided. The method for implementing the media stream security includes the following steps: the first end and the second end establish a session including a signaling plane; the first end and the second end negotiate security parameters on the signaling plane; and the security parameter is transmitted from the signaling plane To the media side; and using the security parameters to protect the end-to-end media stream on the media side between the first end and the second end. Preferably, the security parameters include: a key, a key length, and a security algorithm. Preferably, the channel for negotiating security parameters between the first end and the second end on the signaling plane includes: negotiating through a signaling channel, or negotiating through a special key management protocol. Preferably, the use of the security parameter to protect the end-to-end media stream on the media plane between the first end and the second end comprises: encrypting the media stream with a security parameter before sending the media stream on the media plane; and receiving the media on the media plane The stream is then decrypted using the security parameters. Preferably, the use of the security parameter to protect the end-to-end media stream on the media plane between the first end and the second end comprises: performing integrity protection on the media stream with security parameters before sending the media stream on the media plane; After the media side receives the media stream, it uses the security parameters to perform an integrity check on the media stream. Preferably, the session including the signaling plane includes: a session following the session initial protocol; a session following the session description protocol. Preferably, the first end and the second end use a secure real-time transport protocol and an associated key management protocol on the signaling plane to negotiate security parameters. In an embodiment of the present invention, an apparatus for implementing end-to-end media stream security is further provided, including: an establishing module, configured to establish a session including a signaling plane by the first end and the second end; and a negotiation module, The first end and the second end are used to negotiate a security parameter on the signaling plane; the delivery module transmits the security parameter from the signaling plane to the media plane; and the protection module is configured to protect the first end and the second by using the security parameter End-to-end media streaming between the ends on the media side. Preferably, the protection module specifically includes: an encryption unit, configured to encrypt the media stream with a security parameter before the media plane sends the media stream; and a decryption unit, configured to decrypt the media stream by using the security parameter after the media plane receives the media stream. Preferably, the protection module specifically includes: an integrity protection unit, configured to perform integrity protection on the media stream by using a security parameter before the media plane sends the media stream; and an integrity checking unit, configured to use after the media plane receives the media stream The security parameters perform an integrity check on the media stream. The implementation method and the implementation device of the foregoing embodiment propose that the communication between the first end and the second end directly negotiates the security parameters through the signaling plane, thereby providing security protection for the end-to-end media stream. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a flow chart showing an implementation method for end-to-end media stream security according to an embodiment of the present invention; FIG. 2 is a block diagram showing an end-to-end media stream security according to an embodiment of the present invention; FIG. 3 illustrates a media flow security parameter negotiation process based on a secure signaling path according to an embodiment of the present invention; FIG. 4 is a flowchart of a media flow security parameter delivery based on a secure signaling path according to an embodiment of the present invention; 5 shows a media stream security parameter negotiation process based on a key management protocol according to an embodiment of the present invention; FIG. 6 shows a flow chart of media stream security parameter delivery based on a key management protocol according to an embodiment of the present invention; A diagram of an apparatus for implementing end-to-end media stream security in accordance with an embodiment of the present invention is shown. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings in conjunction with the embodiments. FIG. 1 is a flowchart of a method for implementing end-to-end media stream security according to an embodiment of the present invention. The following steps are performed: Step S10: A first end and a second end establish a session including a signaling plane; Step S20, the first end and the second end negotiate security parameters on the signaling plane; Step S30, the security parameter is transmitted from the signaling plane to the media plane; and in step S40, the first end and the second end are protected by using the security parameter. End-to-end on the media side Media stream. The communication between the first end and the second end is a media flow from the user to the user. The implementation method proposes that the communication between the first end and the second end directly negotiates the security parameters through the signaling plane, thereby implementing security protection for the end-to-end media stream. Preferably, the security parameters include: a key, a key length, and a security algorithm. Preferably, the first end and the second end negotiating the security parameters on the signaling plane include: negotiating through a signaling channel, or negotiating through a special key management protocol. Preferably, the signaling plane notifies the media plane to perform secure communication; and the security parameter is transmitted to the media plane; Step S40 specifically includes: encrypting the media stream with the security parameter before sending the media stream on the media plane; and after receiving the media stream on the media plane Decrypt the media stream using security parameters. Preferably, the method further includes: the first end and the second end use the security parameter to perform integrity protection and checking on the end-to-end media stream between the first end and the second end. The above protections are all cryptographic protection. After the integrity protection is added, the security mechanism is more complete. Preferably, the communication plane is notified by the signaling plane to perform secure communication; 4 bar security parameters are transmitted to the media plane; Step S40 specifically includes: performing integrity protection on the media stream with security parameters before sending the media stream on the media plane; The media stream is integrity checked using security parameters after receiving the media stream. Preferably, the session including the signaling plane includes at least one of the following: a session following a session initial protocol; a session following a session description protocol. Preferably, the first end and the second end use a secure real-time transport protocol and an associated key management protocol on the signaling plane to negotiate security parameters. The session protocols and security protocols that can be employed are given here, and the specific practices of the embodiments of the present invention can be performed by using these protocols. The foregoing embodiment provides an implementation method for end-to-end media stream security in the NGN. The method has the following features: (1) The network does not need to participate in the distribution of key materials and security parameters, and the end user directly completes the foregoing process; (2) Meet the security needs of users' privacy. Figure 2 shows the modules that implement media stream security and the connections between modules in an end-to-end scenario. When the user 1 100 (ie, the first end) and the user 2 110 (ie, the second end) perform secure communication, a session is established on the signaling plane 160 by the signaling protocol module 120 on both sides of the communication, through the key management protocol module 130. Security parameters (such as keys, key lengths, cryptographic algorithms, etc.) are negotiated between users, which are then passed from the signaling plane 160 to the media plane 170. On the user side, the user 100 data passes through the medium. The body stream protocol module 150 encodes and then performs integrity protection and encryption protection through the secure media stream protocol module 140, which can be securely transmitted to the user 110 over an unsecured channel, and the user 110 then performs integrity checks on the data. And decryption. This achieves end-to-end media stream security. Further explanation of Figure 2 is as follows:

(1) For end-to-end media stream security, the user negotiates security parameters through the signaling plane, and the security parameters are transmitted from the signaling plane to the media plane, and the data is transmitted securely on the media plane.

(2) The signaling protocol establishes a call session between two users, the key management protocol negotiates security parameters, the media stream protocol performs media encoding and decoding, and the secure media streaming protocol is used to encrypt/decrypt the media stream. The key management protocol is notified by the signaling protocol and passed to the secure media streaming protocol by the key management protocol.

(3) End-to-end secure communication can be achieved without the network participating in key distribution. The following is the Session Initiation Protocol (SIP), the Session Description Protocol (SDP), the Secure Real-time Transport Protocol (SRTP), and the related key management protocol. This example illustrates the specific implementation of end-to-end media stream security. Secure RTP (SRTP, Secure RTP) provides security services for RTP. In SRTP packets, the Master Key Identifier (MKI) identifies the master key, and the session key is derived from the master key for authentication and Encrypt the packet. The MKI is defined, signaled, and used by the signaling management protocol. A message authentication code (MAC) is used to carry authentication data. FIG. 3 is a media flow security parameter negotiation process based on a secure signaling path. The process adds a new attribute "a=crypto" to the SDP to negotiate the security parameters of the SRTP media stream 250. The method relies on a secure signaling path (eg, SIPS) to protect the keys exchanged in the signaling can be seen as a "key management protocol" embedded in the secure signaling protocol. The two SIP user agents 200 and 210 prepare the key material for the SRTP media stream 250, and pass the SDP data through the Secure SIP Signaling Channel (SIPS, SIP over TLS) 220, which is transmitted in the SDP in plaintext. FIG. 4 is a media flow security parameter delivery process based on a secure signaling path. The method transmits the security parameter 330 negotiated on the SIPS secure signaling channel 320 to the media plane 310 on the signaling plane 300. The SRTP protocol 340 resides in the security parameter. Secure media streams. FIG. 5 is a media stream security parameter negotiation process based on a key management protocol. The process key management protocol (such as MIKEY) establishes a security association for a security protocol (such as SRTP), and the MIKEY message is transmitted along the SIP signaling path, and is in the SDP. incidentally. KEYMGT defines an extension "a=key-mgmt" in SDP to carry messages specified by a key management protocol such as MIKEY. A MIKEY message contains one or more keys and a set of parameters required by a security protocol, such as the encryption and authentication algorithms used. KEYMGT is able to establish end-to-end security for media streams and is independent of signaling protection. This method requires the endpoint to have a pre-configured key or public safety infrastructure. The two SIP User Agents 400 and 410 establish a session with SIP signaling 420 through the corresponding SIP Proxy Servers 430 and 440, respectively, and the MIKEY Key Management Protocol 450 prepares security parameters for the SRTP Media Stream 460. FIG. 6 is a media stream security parameter delivery process based on a key management protocol. The method transmits the security parameter 530 to the MIKEY key management protocol 540 via the SIP signaling protocol 520 on the signaling plane 500. The result of the security parameter negotiation by the MIKEY The 550 is passed to the media plane 510, and the SRTP protocol 560 secures the media stream based on security parameters. FIG. 7 is a block diagram of an apparatus for implementing end-to-end media stream security according to an embodiment of the present invention, including: an establishing module 10, configured to establish a session including a signaling plane by a first end and a second end; 20, the first end and the second end are used to negotiate a security parameter on the signaling plane; the delivery module 30 is configured to transmit the security parameter from the signaling plane to the media plane, and the protection module 40 is configured to use the security parameter to protect An end-to-end media stream on the media surface between the first end and the second end. Preferably, the protection module 40 specifically includes: an encryption unit, configured to encrypt the media stream with a security parameter before the media plane sends the media stream; and a decryption unit, configured to decrypt the media stream by using the security parameter after the media plane receives the media stream. Preferably, the protection module 40 specifically includes: an integrity protection unit, configured to perform integrity protection on the media stream by using a security parameter before the media plane sends the media stream; and an integrity checking unit, configured to: after receiving the media stream on the media plane Use the security parameters to perform an integrity check on the media stream. The communication between the first end and the second end is a media flow from the user to the user. The implementation device proposes that the communication between the first end and the second end directly negotiates the security parameters through the signaling plane, thereby providing security protection for the end-to-end media stream. From the above description, it can be seen that the present invention proposes an end-to-end media stream security implementation method and apparatus in NGN, which has the following features: (1) does not require network participation key material and security parameter allocation, directly by The end user completes the above process; (2) meets the security needs of the user's privacy. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device, or they may be separately fabricated into individual integrated circuit modules, or they may be Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A method for implementing end-to-end media stream security, comprising the steps of: establishing a session including a signaling plane by a first end and a second end;

The first end and the second end negotiate security parameters on the signaling plane;

Passing the security parameter from the signaling plane to a media plane;

The end-to-end media stream on the media surface between the first end and the second end is protected using the security parameters.

The implementation method according to claim 1, wherein the security parameters include: a key, a key length, and a security algorithm.

The implementation method of claim 1, wherein the channel for negotiating security parameters between the first end and the second end on the signaling plane includes:

Negotiate through the signaling channel or through a special key management protocol.

The implementation of the method according to claim 1, wherein the use of the security parameter to protect the end-to-end media stream between the first end and the second end on the media plane comprises: Encrypting the media stream with the security parameter before transmitting the media stream; and

The media stream is decrypted using the security parameter after the media face receives the media stream.

The implementation method of claim 1, wherein the using the security parameter to protect the end-to-end media stream between the first end and the second end on the media plane comprises: Performing integrity protection on the media stream by using the security parameter before sending the media stream; and

Performing an integrity check on the media stream using the security parameter after the media face receives the media stream.

The implementation method according to any one of claims 1 to 5, wherein the session including the f-face includes:

a session that follows the session initiation protocol;

A session that follows the session description protocol.

The implementation method according to any one of claims 1 to 5, wherein the first end and the second end adopt a secure real-time transmission protocol and an associated key management protocol on the signaling plane. Negotiate security parameters.

An apparatus for implementing end-to-end media stream security, comprising:

a establishing module, configured to establish a session including a signaling plane by the first end and the second end, and a negotiation module, configured to negotiate, by the first end and the second end, a security parameter on the signaling plane;

a delivery module that communicates the security parameter from the signaling plane to a media plane; and a protection module for protecting the media surface between the first end and the second end using the security parameter End-to-end media streaming.

The implementation device according to claim 8, wherein the protection module specifically includes: an encryption unit, configured to encrypt the media stream by using the security parameter before sending the media stream on the media plane ; as well as

And a decryption unit, configured to decrypt the media stream by using the security parameter after the media plane receives the media stream.

The implementation device according to claim 8, wherein the protection module specifically includes: an integrity protection unit, configured to use the security parameter to send the media stream before the media plane sends the media stream Media stream integrity protection;

And an integrity checking unit, configured to perform an integrity check on the media stream by using the security parameter after the media plane receives the media stream.