WO2010083695A1

WO2010083695A1 - Method and apparatus for securely negotiating session key

Info

Publication number: WO2010083695A1
Application number: PCT/CN2009/074792
Authority: WO
Inventors: 梁丽
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-01-23
Filing date: 2009-11-04
Publication date: 2010-07-29
Also published as: CN101790160A

Abstract

The present invention discloses a method for securely negotiating a session key and includes: after an access gateway registered to a softswitch successfully, both the access gateway and the softswitch obtaining a shared key separately and storing the shared key in itself separately; before the registered access gateway implements each session, the softswitch distributing a session key for the session according to the request of the access gateway and encrypting the session key distributed every time with the shared key, and then transferring the encrypted session key to the access gateway; the access gateway decrypting the encrypted session key with the shared key and obtaining the session key every time when it receives the encrypted session key. The present invention also discloses an apparatus for securely negotiating a session key. The present invention can further assure the safety of the voice communication at the same time with assuring the safety of the session key, and is easy to be implemented.

Description

Method and device for securely negotiating session key

The present invention relates to a key processing technique, and more particularly to a method and apparatus for securely negotiating a session key. Background technique

In the Next Generation Network (NGN) system, in order to reduce construction costs and facilitate user access, voice over IP (VoIP) signaling and media data are transmitted over the Internet. Since the Internet Protocol (IP) network is an open network, its security is not high. Therefore, in order to prevent the user from being eavesdropped, the media stream transmitted in the session needs to be encrypted to ensure the security of the voice call. The key of the stream is called the session key (SK, Session Key).

Currently, there are two main methods for negotiating session keys in the prior art: point-to-point direct negotiation and softswitch (SS) allocation of keys.

FIG. 1 shows an example of two access gateways (AGs) performing point-to-point direct negotiation to acquire SK. As shown in FIG. 1, before the call is made, AG1, which is the key initiator, sends a request message to the key receiver AG2 (LMESSAGE). ), which carries the relevant information of the session key negotiation; after receiving the relevant information of the session key negotiation, the AG2 sends a response message (R_MESSAGE) to the AG1, so that the two parties can be based on a specific security protocol such as the Secure Real-Time Transport Protocol (SRTP). The media stream is separately encrypted and decrypted using the obtained session key. However, the point-to-point direct negotiation mode is not very applicable to the application scenario of the group switching device such as the AG. Because there are many users of the AG, if multiple users need to make calls at the same time, the number of message interactions of the key negotiation is very large, which will result in A waste of a large amount of system resources.

Therefore, the industry mostly prefers the way SS assigns keys: SS assigns session keys to AG1 and AG2 that need to make calls and transmits them to AG1 and AG2 through signaling channels, as shown in Figure 2.

Among them, because the signaling channel is also insecure, in order to ensure that the session key is not stolen To retrieve, the session key needs to be encrypted. In the prior art, the encryption of the session key mainly has the following methods:

1, the default shared key

The original key is manually configured for each AG as a preset shared key, and the SS directly encrypts the session key with the original key.

2, public key

A key pair is configured for each AG using a public key infrastructure (PKI), the key pair including a public key and a private key, and the SS encrypts the session key with the public key of each AG.

3, DH exchange

A DH (Differ-Hellman) exchange is performed before each call, and the SS encrypts the session key with the key exchanged by the DH.

However, the above three methods have their own disadvantages, and the disadvantages of the preset shared key are: the algorithm is simple, the security is poor, and it is easy to be cracked; the disadvantage of the public key is that: PKI is required. System support, and the PKI system currently used in the communication field has yet to be established, so this method is temporarily not feasible; the disadvantage of DH exchange is that: although the security is high, due to the complexity of the algorithm, and each call Before the DH exchange, the calculation is too large, which seriously affects the performance of the system. For these reasons, voice security guarantees in current NGN systems are difficult to achieve. Summary of the invention

In view of this, the main object of the present invention is to provide a method and apparatus for securely negotiating a session key that is easy to implement and effective under a non-secure channel to ensure the security of voice calls.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A method for securely negotiating a session key. After the access gateway successfully registers with the softswitch, the two obtain a shared key separately, and each stores the shared key by itself; the method further includes: the registered access gateway The softswitch is requested by the access gateway before each session is performed. Assigning a session key to the session, and encrypting the assigned session key with the shared key, and then transmitting the encrypted session key to the access gateway;

Each time the access gateway receives the encrypted session key, the shared session key is decrypted by the shared key to obtain a session key.

After the access gateway decrypts the session key, the method further includes:

The access gateway encrypts the media stream to be sent in the session with the decrypted session key, or decrypts the media stream received in the session.

The algorithm for encrypting or decrypting the session key by using the shared key is MD5. A device for negotiating a session key, including a shared key generation and storage module, a session key allocation module, a session key encryption module, a session key sending module, a session key receiving module, and a session secret Key decryption module, where:

a shared key generation and storage module, configured to generate a shared key after the access gateway successfully registers with the softswitch, and store the generated shared key;

a session key allocation module, configured to allocate a session key for each session;

An encryption module of the session key, configured to use the shared key to perform a strong secret on the assigned session key;

a sending module of the session key, configured to send the encrypted session key;

a receiving module of the session key, configured to receive the encrypted session key;

A decryption module of the session key, configured to decrypt the received encrypted session key by using the shared key.

The generating and storing modules of the shared key are respectively located in the access gateway and the soft switch;

The allocation module of the session key and the encryption module of the session key are located in the softswitch, and the decryption module of the session key is located in the access gateway;

The sending module of the session key is located in the soft switch, and the receiving mode of the session key The block is located in the access gateway.

In addition, the device further includes an encryption module of the media stream and a decryption module of the media stream, where: the encryption module of the media stream is configured to encrypt the media stream to be sent in the session by using the decrypted session key;

A decryption module of the media stream, configured to decrypt the media stream received in the session by using the decrypted session key.

The encryption module of the media stream and the decryption module of the media stream are located in the access gateway.

It can be seen from the above technical solution that the present invention performs a shared key negotiation only when the access gateway registers with the softswitch, and the obtained shared key is always stored on the access gateway and the softswitch during the entire working period. The softswitch encrypts the assigned session key each time using the shared key obtained by negotiation. Accordingly, the access gateway decrypts the encrypted session key each time by using the shared key obtained by negotiation. The method is not only easy to implement, but also greatly reduces the amount of calculation, and further reduces system overhead. Moreover, the shared key is obtained through the key negotiation mode of the DH exchange, so that the security is high and the session key is not easily stolen, thereby ensuring the security of the media stream transmitted in the session. Therefore, the present invention is well suited for use in NGN systems currently built on IPv4 networks that are not integrated with IPsec to ensure voice call security. DRAWINGS

1 is a schematic diagram of a point-to-point direct negotiation of a prior art access gateway to obtain a session key; FIG. 2 is a schematic diagram of a prior art softswitch assigning a session key;

3 is a schematic diagram of a security negotiation session key according to the present invention;

4 is a schematic diagram of an apparatus for securely negotiating a session key according to the present invention;

5a and 5b are flowcharts of the access gateway requesting registration by the access gateway of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In order to make the present invention more clearly understood by those skilled in the art, the implementation of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 3 is a schematic diagram of a security negotiation session key according to the present invention. As shown in FIG. 3, the method for securely negotiating a session key according to the present invention includes the following steps:

Step A: After the AG registers with the SS successfully, the two obtain the shared key KEY-AG and KEY-SS respectively, and store the shared key in each.

Step B: Before each session of the registered AG, the SS allocates SK to the session according to the request of the AG, and encrypts the allocated SK by using the shared key KEY-SS;

Among them, the SS side encrypts SK according to formula (1):

KEY-SALT=MD5 ( KEY-SS, SK ) ( 1 ) The encryption algorithm used in formula (1) is MD5. In practical applications, other encryption algorithms can also be used, which are not listed here.

Step C, the SS sends the encrypted session key to the AG;

According to the prior art, the SS can send the encrypted session key KEY-SALT in the crypto attribute line by adding a crypto attribute line in the Session Description Protocol (SDP) descriptor in the Add Context (ADD) message. Give AG.

Step D, each time the AG receives the encrypted session key, decrypts the encrypted session key with the shared key KEY-AG to obtain SK;

Of course, the decryption should use the same algorithm as encryption, such as MD5.

Further, step E may be performed: the AG encrypts the media stream to be sent in the session with the decrypted session key, or decrypts the media stream received in the session.

For example, when the AG is used as the call originator, as shown in FIG. 3, the AG side may encrypt the media stream to be sent in this session according to a specific security protocol, such as SRTP, and then send the encrypted media stream. Give another AG (not shown) as the call recipient, call receiver The AG decrypts the encrypted media stream with the same session key. Similarly, the session key may be encrypted by the SS with the shared key obtained in the registration process of the call recipient AG and transmitted to the call recipient AG, except that the registration process is the registration process of the call receiver AG to the SS. .

In order to implement the foregoing method for securely negotiating a session key, the present invention provides a device for securely negotiating a session key. As shown in FIG. 4, the device includes:

a shared key generation and storage module, configured to generate a shared key after the AG successfully registers with the SS, and store the generated shared key; wherein the shared key generation and storage module are respectively located in the AG and the SS ;

a session key allocation module, configured to allocate a session key for each session; wherein, the allocation module of the session key is located in the SS;

An encryption module of the session key, configured to encrypt the allocated session key by using the shared key; wherein the encryption module of the session key is located in the SS;

a sending module of the session key, configured to send the encrypted session key; wherein, the sending module of the session key is located in the SS;

a receiving module of the session key, configured to receive the encrypted session key; wherein, the receiving module of the session key is located in the AG;

a decryption module of the session key, configured to decrypt the received encrypted session key by using the shared key; wherein the decryption module of the session key is located in the AG.

Further, the device further includes: an encryption module of the media stream, configured to encrypt the media stream to be sent in the session by using the decrypted session key; and a decryption module of the media stream, configured to utilize the decrypted session secret The key decrypts the media stream received in the session;

The encryption module of the media stream and the decryption module of the media stream are located in the AG.

It can be seen from the above analysis that the present invention always encrypts the session key allocated each time by using the shared key negotiated in the registration process, which is easy to implement and safe and convenient. Enter one Step by step, even if the encrypted media stream is intercepted during transmission, the voice information cannot be recovered because the session key is difficult to obtain, and therefore the present invention can effectively ensure the security of the voice call.

The process of obtaining the shared key KEY-AG and KEY-SS by the AG and SS respectively through the registration process is described in detail below. The registration process is based on the H.248 protocol.

Before the description, let's introduce the authentication parameters of the four static configurations that will be used during the registration process:

The initial shared key Ki, usually 128 bits in length;

Gateway device identifier MGID, usually 128 bits in length;

The base g and modulus for DH exchange P, g are usually chosen in 2, 3, 5, 7 and 9. P is a prime number and is usually 768 bits long.

These authentication and authentication parameters are known by the AG itself and the SS managing the AG in the initial configuration, and are not publicly transmitted on the H.248 protocol interface.

As shown in FIG. 5a and FIG. 5b, the process for the AG to request registration from the SS includes the following steps: Step 401: The AG sends a service change (ServiceChange) message to the SS to request registration, and the ServiceChange message carries an X field for authentication, including: Algorithm ID, random number Rand_mg, key A for DH exchange, and digital signature MG _AUTH for access gateway; The following details the origin of the X field used for authentication:

The AG first generates a random number Rand_mg, typically 64 bits, and a private number a for DH exchange, which is typically a 32-bit random number;

Next, calculate the key A for DH exchange according to formula (2):

A=g ^a mod ( P ) ( 2 )

Then, calculate the digital signature MG _{AUTH of the} AG according to formula (3):

MG _A UTH=MD5 ( Ki, MGID, A, Rand_mg ) ( 3 ) Here, the MD5 algorithm is used to calculate the digital signature MG _AUTH . In actual applications, other encryption algorithms may also be used, which are not enumerated here; So, you get four X fields for authentication:

X-EA - algorithm ID, the invention uses the MD5 algorithm and is assigned a value of 1;

X-RANDOM - the random number generated by the AG for calculating MG _AUTH , assigned as Rand_mg;

X-DH - the key used by the AG for DH exchange based on g, a, P, assigned

A;

X-AUTH - The digital signature calculated by the AG, assigned the value MG _AUTH .

Steps 402 to 404, the SS calculates the authentication value MGRES by using the random number Rand_mg, the key A, and the algorithm ID in the received ServiceChange message, and determines whether the authentication value MGRES is equal to the digital signature MG _{AUTH of the} AG. If the two are equal, Then the SS sends a correct Reply message to the AG, otherwise, sends an error Reply message, and ends the current authentication process;

Wherein, the authentication value MGRES is calculated according to formula (4):

MGRE _S =MD5 ( Ki, MGID, A, Rand_mg ) ( 4 ) If MGRE _S = MG _AUT H, it means that the authentication information sent by the legal AG is passed, so the authentication passes; otherwise, the authentication is rejected.

Step 405: After sending the correct Reply message to the AG, the SS first calculates the key B for DH exchange by using the private number b generated by itself, and calculates the shared key KEY-SS by using the key A and the private number b, and then Regenerating the random number Rand_ss, and then calculating the digital signature SSAUTH of the SS by using the key B, the shared key KEY-SS, the random number Rand_ss, and the algorithm ID;

After the SS confirms that the authentication information sent by the legal AG is sent, the SS first generates a private number b for the DH exchange, which is usually a 32-bit random number, and calculates the density for the DH exchange according to the formula (5). Key B:

B=g ^b mod ( P ) ( 5 )

And calculate the authentication key KEY-SS to be shared with the AG according to formula (6): KEY-SS= A ^b mod ( P ) = g ^ab mod ( P ) ( 6 )

Then SS generates a random number Rand_ss, usually 64 bits, and calculates the digital signature SS _{AUTH of} SS according to formula (7):

SS _AUTH = MD5 ( KEY-SS, Ki, B, Rand_ss ) (7) Step 406, the SS sends a Modify message to the AG, where the Modify message carries the field for authentication obtained by step 405, including Ea, random, dhkey, and key information:

Ea - algorithm ID, the invention uses the MD5 algorithm and is assigned a value of 1;

Random - SS generation, a random number used to calculate SS _AUTH , assigned Rand_ss; dhkey - the key used by SS for DH exchange based on g, b, P, assigned B; key - SS is calculated The digital signature is assigned to SS _AUTH .

Steps 407~409, after receiving the Modify message, the AG first calculates the shared key KEY-AG by using its own private number a and the key B in the Modify message, and then uses the shared key KEY-AG and the received random number. The number Rand_ss, the key B and the algorithm ID calculate the authentication value SSRE _S , and determine whether the authentication value SSRES is equal to the digital signature SS _{AUTH of the} SS. If the two are equal, the AG sends the correct Reply message to the SS, otherwise, the error Reply is sent. Message, and end the current certification process;

Wherein, the shared key KEY-AG is calculated according to formula (8):

KEY-AG= B ^a mod ( P ) = g ^ab mod ( P ) ( 8 ) Calculate the authentication value SSRES according to formula ( 9 ):

SSRES: MD5 ( KEY- AG, Ki, B, Rand_ss ) ( 9 ) If SSRE _S =SS _AUT H, it means that the information sent by the legal SS is successful, which means that the mutual authentication of the AG and the SS is successful, that is, The AG requests the SS to register successfully. After that, the SS can encrypt the session key by using the shared key KEY-SS obtained in the registration process, and the AG can decrypt the encrypted session key by using the shared key KEY-AG. Since the invention has been used for registration The shared key obtained by the process encrypts the session key for each call, so the private numbers a, b used to generate the shared key are always reserved/used throughout the H.248 protocol session. If the registration fails, neither SS nor AG can use the shared key.

During the operation of the H.248 protocol interface after the AG successfully registers with the SS, the SS can periodically authenticate the AG to prevent the illegal entity from impersonating the AG to send a message to the SS, or to impersonate the SS to send a message to the AG. The authentication process is as follows: Said:

Step 410: The SS sends a Modify message to the AG for authentication. The Modify message carries a field for authentication, including: an algorithm ID, a random number d, and a digital signature SS _{AUTH of the} SS. The following describes the origin of the fields used for authentication:

The SS first generates a random number d, usually 128 bits, and then uses the shared key KEY-SS to calculate the digital signature SS _{AUTH of the} SS according to equation (10):

SS _AUTH =MD5 ( KEY-SS , d ) ( 10 ) In this way, the field for authentication is obtained, including ea, random and key information: ea - algorithm ID, the invention adopts the MD5 algorithm and is assigned a value of 1;

Random - SS generated, a random number used to calculate SS _AUTH , assigned the value d;

Key - the digital signature calculated by SS, assigned the value SS _AUTH .

Steps 411~413, after receiving the Modify message, the AG calculates the authentication value SSRES by using the random number d in the shared key KEY-AG and the Modify message and the algorithm ID, and determines whether the authentication value SSRES is equal to the digital signature SS _{auth of the} SS. If the two are equal, indicating that the authentication information is sent by the legal SS, the AG calculates the digital signature MG _{AUTH of} the AG by using the shared key KEY-AG, the random number d, and the algorithm ID, and then sends the correct Reply message to the SS, and The Reply message carries a field for authentication, including: an algorithm ID and a digital signature MG _{AUTH of the} AG; if the SS is illegal, the AG sends an error Reply message to the SS, and the Reply message is in the Reply message. Does not carry any authentication field to prevent the illegal entity from obtaining the authentication information of the AG and ends the current authentication process. Among them, AG calculates the authentication value SSRES according to formula (11):

SSRE _S =MD5 ( KEY- AG, d ) ( 11 )

The following describes the origin of the field used for authentication in the correct Reply message:

The AG uses the shared key KEY-AG, MGID, and SS to carry the random number d carried in the Modify message to calculate the digital signature MG _{AUTH of the} AG according to formula (12):

MG _A UTH=MD5 ( KEY- AG, MGID, d ) ( 12 ) In this way, the fields for authentication, including ea and key information, are obtained:

Key - the digital signature calculated by the AG, assigned the value MG _AUTH .

Step 414, after receiving the correct Reply message, the SS calculates the authentication value MGRES of the AG by using the shared key KEY-SS, the MGID, the random number d, and the algorithm ID carried in the correct Reply message, and determines the authentication value. Whether MGRES is equal to the digital signature MG _{auth of the} AG. If the two are equal, the AG is legal, so the authentication succeeds; otherwise, if the AG is illegal, the authentication fails;

Where SS calculates MGRES according to formula (13):

MGRES = MD5 ( KEY-SS , MGID, d ) ( 13 ) At this point, the entire authentication process ends. If the authentication fails, the illegal AG cannot obtain the session key, thereby ensuring the security of the media stream transmitted in the session.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

A method for securely negotiating a session key. After the access gateway successfully registers with the softswitch, the two obtain the shared key separately, and each of the storage keys is stored in the storage gateway. The method further includes:

Each time the registered access gateway performs a session, the softswitch assigns a session key to the session according to the request of the access gateway, and encrypts the allocated session key with the shared key, and then encrypts the session key. Sending a session key to the access gateway;

The method for securely negotiating a session key according to claim 1, wherein after the access gateway decrypts the session key, the method further includes:

The method for securely negotiating a session key according to claim 1 or 2, wherein the algorithm for encrypting or decrypting the session key with the shared key is MD5.

A device for securely negotiating a session key, the device comprising a shared key generation and storage module, a session key allocation module, a session key encryption module, a session key sending module, and a session a key receiving module and a session key decrypting module, wherein:

a receiving module of the session key, configured to receive the encrypted session key; a decryption module of the session key, configured to decrypt the received encrypted session key by using the shared key.

The device for securely negotiating a session key according to claim 4, wherein the shared key generation and storage module is located in the access gateway and the softswitch, respectively.

The apparatus for securely negotiating a session key according to claim 5, wherein the session key allocation module and the session key encryption module are located in the softswitch, and the session key is decrypted. The module is located in the access gateway.

The apparatus for securely negotiating a session key according to claim 6, wherein the sending module of the session key is located in the softswitch, and the receiving module of the session key is located in the access gateway. in.

The device for securely negotiating a session key according to claim 4, wherein the device further comprises an encryption module of the media stream and a decryption module of the media stream, wherein:

An encryption module of the media stream, configured to encrypt the media stream to be sent in the session by using the decrypted session key;

9. The apparatus for securely negotiating a session key according to claim 8, wherein the encryption module of the media stream and the decryption module of the media stream are located in the access gateway.