WO2009094813A1

WO2009094813A1 - Security parameters negotiation method and apparatus for realizing the security of the media flow

Info

Publication number: WO2009094813A1
Application number: PCT/CN2008/000638
Authority: WO
Inventors: Yinxing Wei; Zhimeng Teng
Original assignee: Zte Corporation
Priority date: 2008-01-23
Filing date: 2008-03-31
Publication date: 2009-08-06
Also published as: CN101247218A; CN101247218B

Abstract

A security parameters negotiation method for realizing the security of the media flow includes the following steps: both communication parties establish a session that includes the control layer; the communication parties use a key management protocol to negotiate the security parameters on the control layer; and the communication parties use the negotiated security parameters to protect the media flow between the communication parties. A security parameters negotiation apparatus is also provided for realizing the security of the media flow. The present invention uses a key management protocol to negotiate the security parameters, and realizes the secure transmission of the media flow effectively.

Description

The present invention relates to the field of communications, and in particular to a method and apparatus for negotiating security parameters for implementing media stream security. BACKGROUND With the rise of Internet Protocol Television (IPTV) and the widespread use of Voice over IP (VoIP) technology, media stream security becomes more and more important. Media stream security protects user-side data (such as video, voice, pictures, text, etc.) to prevent unauthorized users from accessing the data illegally. Media stream security is not only the basis for content providers to operate; it is also a value-added service for networks. In addition, the security requirements related to user privacy in the media stream also require the network to provide corresponding security; Digital Right Management (DRM) and Lawful Interception (LI) technology also puts corresponding requirements on media stream security. The media stream security here refers to cryptographic security, that is to say, using cryptographic protection technologies (such as integrity protection, encryption protection), the attacker cannot decipher the protected media stream data with limited resources. . In the next Next Generation Network (NGN), media stream security is a basic requirement. The NGN network should be able to guarantee the confidentiality and integrity of the transmitted media stream. The International Telecommunication Union (ITU-Telecommunication)-NGN currently stipulates the Secure Real-time Transport Protocol (SRTP) to implement media stream security, and the power of the current network is The Internet Converged Services and Protocols for Advanced Networks (TISPAN, Telecoms & Internet converged Services & Protocols for Advanced Networks) are currently available;

SRTP provides confidentiality and integrity security services for media based on Real-time Transport Protocol (RTP), and media information carried in media lines (m=) in the Session Description Protocol (SDP). ( ^ RTP/SAVP ) to inform SRTP of the secure transmission of media streams, where SAVP represents a secure audio/video profile (Secure Audio/Video Profile). In the process of implementing the present invention, the inventor has found that the key negotiation method for media stream security in NGN has the following disadvantages: The user obtains the primary key of the SRTP from the SAA-FE/TAA-FE through the boundary element (BE, Border Element). Key, and then derive the encrypted and authenticated session key from the master key, where SAA-FE indicates Service Authentication and Authorization Functional Entity, and TAA-FE indicates transmission authentication and authorization Transport Authentication and Authorization Functional Entity. This is actually a statically configured approach that is not scalable and flexible. SUMMARY OF THE INVENTION The present invention is directed to a security parameter negotiation method and apparatus for implementing media stream security, which can solve the problem that the lack of security parameter negotiation in the prior art leads to lack of scalability and flexibility. In an embodiment of the present invention, a security parameter negotiation method for implementing media stream security is provided, including the following steps: a communication party establishes a session including a control plane; and the communication parties adopt a key management protocol on the control plane. Negotiating the security parameters; and the foregoing communication parameters are used by the communication parties to protect the media stream between the two communication parties. Preferably, the foregoing security parameter includes a key and at least one of the following: a key length, a key life cycle, and a cryptographic algorithm. Preferably, the above key management protocol comprises a multimedia internet key protocol. Preferably, the above key management protocol package 4 is a secure real-time transmission protocol and an associated key management protocol. Preferably, the foregoing session including the control plane includes at least one of the following: a Session Initiation Protocol (SIP)-compliant session; and a Session Description Protocol (SDP)-compliant session. In an embodiment of the present invention, a security parameter negotiation apparatus for implementing media stream security is further provided, including: an establishing module, configured to establish, by the communication parties, a session including a control plane; The negotiation module is configured to use the key management protocol to negotiate the security parameter on the control plane, and the protection module, configured to use the security parameter negotiated by the two communication parties to protect the media stream between the two communication parties. Preferably, the foregoing security parameter includes a key and at least one of the following: a key length, a key life cycle, and a cryptographic algorithm. Preferably, in the above device, the following features are also included: The key management protocol includes a multimedia internet key protocol. Preferably, in the foregoing apparatus, the following features are also included: The key management protocol includes a secure real-time transport protocol and an associated key management protocol. Preferably, in the foregoing apparatus, the following features are also included: the foregoing session including the control plane includes at least one of: a session following a session initial protocol; and a session following a session description protocol. In the foregoing embodiment of the present invention, the key negotiation adopts an independent key management protocol, so it is expandable and has the following features: (1) Supporting negotiation of session-level and media-level security parameters; (2) Independent of the signaling channel, Directly support end-to-end security parameter negotiation; (3) support no signaling protection or signaling only supports hop-by-hop protection; (4) flexible configuration and good scalability. The foregoing security parameter negotiation method and apparatus improve the security of the media stream by using a separate key management protocol to negotiate security parameters. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a flow chart showing a method for implementing media stream security according to an embodiment of the present invention; FIG. 2 is a diagram showing a basic structure of NGN media stream security applied in an embodiment of the present invention; 3 shows the process of key negotiation process for NGN media stream security in the embodiment of the present invention 4 is a structural diagram showing separation of signaling control and media transmission of an NGN media stream security device according to an embodiment of the present invention; FIG. 5 is a diagram showing a protocol of an NGN media stream security device according to an embodiment of the present invention; A structural diagram of NGN media stream security in the case of a home network according to an embodiment of the present invention; FIG. 7 is a structural diagram of NGN media stream security in a plurality of domain cases according to an embodiment of the present invention; A block diagram of a security parameter negotiation apparatus for implementing media stream security according to an embodiment of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings in conjunction with the embodiments. FIG. 1 is a flowchart of a method for implementing media stream security according to an embodiment of the present invention, including the following steps: Step S10: A communication party establishes a session including a control plane; Step S20, the communication parties adopt a control plane. The key management protocol negotiates the security parameters; and in step S30, the communication parties use the negotiated security parameters to protect the media stream between the two communicating parties. Preferably, the security parameter includes a key and at least one of the following: a key length, a key life cycle, and a cryptographic algorithm. Preferably, the key management protocol comprises a multimedia internet key agreement. Preferably, the key management protocol comprises a secure real-time transport protocol and an associated key management protocol. Preferably, the session including the control plane includes at least one of the following: a session following a session initiation protocol; and a session following the session description protocol. The key negotiation mechanism is provided in the foregoing method, which obviously solves the problem that the prior art lacks security parameter negotiation and does not have scalability and flexibility. In addition, in the prior art, the key is transmitted directly through the field (k=) of the session level or the media level in the SDP. This field is not extensible, so this method is not suitable for the case of transmitting multiple security parameters; in addition, the password conversion defined in SRTP cannot be configured in SDP. In addition, the prior art adds a new attribute (a-crypto) in the SDP to negotiate a security parameter for the SRTP media stream. The method uses a secure signaling channel to protect the SDP data, so other security requirements are required: δ S/MIME (Secure/Multipurpose Internet Mail Extensions), TLS (Transport Layer Security) support. This method cannot handle the following situations: (a) negotiation of session-level security parameters; (b) intermediate agent needs to access SDP media parameters when applying end-to-end protection to SDP; (c) end-to-end protection is not used for sessions In the case where the media stream requires end-to-end protection, security parameters need to be protected. In the implementation method of the embodiment, the key negotiation adopts an independent key management protocol, so it can be extended, and has the following features: (1) Support negotiation of session level and media level security parameters; (2) Independent of signaling Channels, directly support end-to-end security parameter negotiation; (3) support no signaling protection or signaling only supports hop-by-hop protection; (4) flexible configuration, good scalability. The above method may include: executing on a terminal device, a network border device, and a home network gateway. Further, the foregoing method further has the following features: The device first checks the parameters included in the INVITE of the SDP, and if the conditions are met, the security parameters are generated according to the method of the independent key management protocol, and the security parameters are piggybacked by the SDP. Figure 2 shows the end user 100 (End user 100) communicating through the NGN (120), the NGN (120) provides the ability to secure media streams, using the functional entity BE (110) to support the key management protocol. , SRTP protocol, encryption/decryption functions, and more. End user (100) also supports the ability of media stream security. The operator decides which device to implement media stream security based on the security policy. The above BE corresponds to the S/BC (Session/Border Control) function and has the functions of control plane and user plane processing. Figure 3 shows the process of the key negotiation process when the BE provides the media stream security monthly session during the session establishment process. The specific steps are as follows: Step 320, End user 1 (300) and End user 2 ( 315 ) pass the boundary element BE1 ( Border Element, 305), BE2 (310) establish a session; In step 325, End user 1 (300) notifies BE1 (305) in the session control signaling that media stream security protection is required. For the SIP control signaling, the attribute of the SDP part of the SIP INVITE request includes the parameters related to the media stream security; Step 330, when the BE1 (305) receives the media stream protection request, processes the request message. For SIP control signaling, check the attributes of the SDP. If "RTP/SAVP" is included in the "m=" line, it means that security services need to be provided for the media stream; further, if the attribute "a=key-mgmt" If yes, an independent key management protocol such as MIKEY is used to negotiate the key and security parameters of the media stream; Step 335, BE1 (305) initiates a key negotiation request to BE2 (310), where the request includes BE1 (305) Calculate good keys and security parameters. For SIP control signaling, these parameters are carried to the BE2 (310) through the SDP; Step 340, BE2 (310) processes the received key negotiation request, and selects appropriate parameters according to their capabilities, under normal circumstances, The media stream security parameters of the two are agreed upon; in step 345, BE2 (310) notifies end user 2 (315) of media stream protection; step 350, End user 2 (315) responds to BE2 (310) for media stream protection. In step 355, BE2 (310) responds to the key ten-office request of BE1 (305); step 360, BE1 (305) responds to the request of media stream protection initiated by End user 1 (300); Step 365, in session control Under the signaling, the secure media stream is transmitted; Step 370, the secure media stream is transmitted between End user 1 (300) and End user 2 (315). Figure 3 shows a typical situation. End user only sends out the request/response of media stream protection. The security service is provided by BE. There are other possible situations: (1) End user has the ability to provide security services. Complete key negotiation and encryption/decryption functions; (2) Enduser is only a dumb terminal, such as: a traditional telephone, can not send media stream protection requests, but there is a need for secure media stream communication, in this case The agreement between the user and the network is completely completed by the BE to perform key negotiation and encryption/decryption functions. Figure 4 shows the structure of the signaling control and media transmission separation of the NGN media stream security device. The media stream security provided by the NGN is implemented by BE-SP (130) and BE-MP (140), respectively, where BE-SP represents The Border Element - Signaling Process function completes the negotiation of keys and security parameters in the media stream; MP represents the Border Element - Media Process function, completes the media stream encryption/decryption and integrity. Protection/verification function. The BE-SP passes the negotiated key and security parameters to the BE-MP through the interface. If the BE-SP and BE-MP are physically separated, the parameters need to be passed through the standard interface; if BE-SP and BE -MP is a single physical entity, and parameters can be passed through standard interfaces or internal interfaces. Figure 5 shows the protocol that the NGN media stream security device needs to implement, where the key management protocol can be a simple key management protocol, such as a key and security parameter negotiation process embedded in the secure signaling protocol; A separate key management protocol to accomplish the above process. The specific content is as follows: Step 500 is a device that implements media stream security, such as a terminal device or a border device. The device needs to implement a basic protocol including a signaling protocol 530, a key management protocol 540, a secure media streaming protocol 550, and a media stream ten 560; these ten protocols belong to different planes, the first two belong to the control plane 510, and the last two belong to the control plane 510. The user plane 520 belongs to the user plane 520. The relevant parameters of the control plane 510 are transmitted to the user plane through the external interface or the internal interface. Step 510 is to implement a media flow security control plane, complete the establishment of the session, and the key and security required for media stream security. Negotiation of parameters; Step 520, is to implement a user plane of media stream security, complete encryption/decryption of media stream, integrity protection/checking of media stream, and processing of other basic media streams; Step 530, is a session control letter The protocol may be used to carry parameters related to the key management protocol; step 540, which is a key management protocol, used to create keys and security parameters, negotiate keys and security parameters with other media stream security devices, and finally these The parameter is passed to the user plane; step 550, is a secure media streaming protocol, receiving parameters from the control plane, providing confidentiality for the media stream Sex and integrity services; Step 560, is a media streaming protocol that performs basic media processing functions. FIG. 6 shows the structure of NGN media stream security in the case of a home network. The Customer Network Gateway (CNG) 130 completes the negotiation of the media stream key and security parameters and provides the function of the media stream security service. In this case, End user (100) and BE (110) do not need to provide media stream security services. When End user (100) provides this function, then CNG (130) and BE (110) can ignore the signaling request for this media stream security service. Figure 7 shows the structure of NGN media stream security in multiple domains. It is divided into two cases: (1) across NGN operators, when NGN-1 (720) users End user 1 (700) and NGN -2 ( 740 ) When user End user 2 ( 750 ) communicates, according to the security policy between different NGN operators, BE1 ( 710 ) and BE2 ( 715 ) negotiate keys and security parameters and media streams Security services such as encryption/decryption. (2) A similar approach is used in roaming situations. Media stream security means that the cryptography method is to protect the integrity and confidentiality of the media stream. The next generation network needs to support the security of the media stream. The core of the media stream security is to negotiate the security parameters used to protect the media stream (such as Key, key length, cryptographic algorithm, etc.). The invention adopts an independent key management protocol to implement key negotiation of media stream security in the next generation network, and the method has the following features: (1) support negotiation of session level and media level security parameters; (2) independent of signaling Channels, directly support end-to-end security parameter negotiation; (3) support no signaling protection or signaling only supports hop-by-hop protection; (4) flexible configuration, good scalability Figure 8 shows implementation according to the present invention The block diagram of the device for implementing media stream security includes: an establishing module 10, configured to establish a session including a control plane by the communication parties; and a negotiation module 20, configured to use the key management protocol to negotiate security parameters on the control plane And a protection module 30 for the communication parties to use the negotiated security parameters to protect the media stream between the two parties. Preferably, the security parameter includes a key and at least one of the following: a key length, a key life cycle, and a cryptographic algorithm. Preferably, the key management protocol comprises a multimedia internet key agreement. Preferably, the key management protocol comprises a secure real-time transport protocol and an associated key management protocol. Preferably, the session including the control plane includes at least one of the following: a session following the session initiation protocol; a session following the protocol description protocol. The above implementation device improves the security of the media stream by negotiating security parameters by using a separate key management protocol. Media stream security means that the cryptography method is to protect the integrity and confidentiality of the media stream. The next generation network needs to support the security of the media stream. The core of the media stream security is to negotiate the security parameters used to protect the media stream (such as Key, key length, cryptographic algorithm, etc.). The invention adopts an independent key management protocol to implement key negotiation of media stream security in a next generation network. The method and device have the following features: (1) support negotiation of session level and media level security parameters; (2) independent of The signaling channel directly supports end-to-end security parameter negotiation; (3) Supports no signaling protection or signaling only supports hop-by-hop protection; (4) Flexible configuration and good scalability. Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present invention can be implemented by a general-purpose computing device, which is concentrated on a single computing device or distributed among multiple computing devices. On the network, optionally, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device, or they may be separately fabricated into individual integrated circuit modules, or they may be Multiple modules or steps in the fabrication are implemented as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above description is only a preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A security parameter negotiation method for implementing media stream security, comprising the steps of:

The communication parties establish a session including a control plane;

The communication parties use the key management protocol to negotiate security parameters on the control plane; and

The communicating parties protect the media stream between the two communicating parties using the negotiated security parameters.

The security parameter negotiation method according to claim 1, wherein the security parameter comprises a key and at least one of the following: a key length, a key life cycle, and a cryptographic algorithm.

3. The security parameter negotiation method according to claim 1, wherein the key management protocol comprises a multimedia internet key protocol.

4. The security parameter negotiation method according to claim 1, wherein the key management protocol comprises a secure real-time transmission protocol and an associated key management protocol.

The security parameter negotiation method according to claim 1, wherein the session including the control plane comprises at least one of the following:

a session that follows the session initiation protocol;

A session that follows the session description protocol.

A security parameter negotiation device for implementing media stream security, comprising: an establishing module, configured to establish a session including a control plane by a communication party;

a negotiation module, configured to: use, by the communication parties, a key management protocol to negotiate a security parameter on the control plane;

And a protection module, configured to protect, by the communication parties, the media parameter between the two parties by using the negotiated security parameter.

7. The security parameter negotiation apparatus according to claim 6, wherein the security parameter comprises a key and at least one of the following: a key length, a key life cycle, and a cryptographic algorithm.

8. The security parameter negotiation apparatus according to claim 6, wherein the key management protocol comprises a multimedia internet key protocol.

9. The security parameter negotiation apparatus according to claim 6, wherein the key management protocol comprises a secure real-time transmission protocol and an associated key management protocol.

10. The security parameter negotiation apparatus according to claim 6, wherein the session including the control plane comprises at least one of the following:

a session that follows the session initiation protocol;

A session that follows the session description protocol.