WO2011131051A1

WO2011131051A1 - Method and device for security communication negotiation

Info

Publication number: WO2011131051A1
Application number: PCT/CN2011/071028
Authority: WO
Inventors: 田甜; 朱允文; 韦银星
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-04-19
Filing date: 2011-02-16
Publication date: 2011-10-27
Also published as: CN102223355A; CN102223355B

Abstract

The present invention discloses a method and device for security communication negotiation. When a called user device or its own network does not support security capability of end to access edge, a calling user device and the called user device process media plane security negotiation and communicate according to a negotiated key. The media plane security negotiation is usually processed in the security scenario of end to access edge. The media plane security negotiation includes the steps as follows: the calling user device carries a security capability parameter in the conversation initiating request, wherein the security capability parameter indicates a required security capability of the calling user device; the called user device or its own network returns a conversation response message which carries a security capability parameter, wherein the security capability parameter indicates the security capability supported by the called user device or its own network. The negotiation method and device for security communication mode of the present invention can realize the negotiation of security communication mode among the communication participators and improve the user satisfaction.

Description

Safety communication negotiation method and device

The present invention relates to the field of communications, and in particular, to a secure communication negotiation method and apparatus. Background technique

At present, from the security point of view, IMS (IP Multimedia System) media plane security is divided into end-to-end (e2e) security, end to access edge (e2ae) security. The deeper the media security endpoint is, the better the network is, ie the e2e security level is higher than the e2ae security.

Figure 1 is a typical example of the end-to-access side edge, that is, the network architecture diagram of the end (user equipment) to the IMS media access gateway; in Figure 1, the solid line is the media stream path and the dashed line is the signaling path. The user equipment is the sender of the media information; the P-CSCF (Proxy-Call Session Control Function) and the S-CSCF (Service-Call Session Control Function) are IMS network elements.

The SDES (Session Description Protocol Security Key Attribute) scheme is used in 3GPP TS 33.328v9.0.0 to address e2ae scenario security. The SDES solution is very simple. For example, user A calls user B. The SDP key attribute of the call setup request INVITE message that initiates the call carries the key K1, and K1 is used to encrypt the media stream sent from user A to user B. User B This key will be saved after receiving the K1 and used to decrypt the encrypted media stream received from User A. After the call is successfully established, the SDP key attribute carrying the key K2 in the call success response 200 OK message sent back by the user B to the user A is used for the encryption of the media stream sent by the user B to the user A; the user A receives the message. After that, K2 is saved for decrypting the encrypted media stream received from User B.

For e2e security, the SDES and KMS (Key Management Service) schemes are currently used in this specification. The SDES scheme relies on signaling plane security and is an e2e security solution for most common users; the KMS scheme does not depend on Secure on the signaling plane, it is an e2e security solution that can meet a small number of users with higher security level requirements. Currently, when the calling party and its associated P-CSCF support e2ae, the calling party can initiate a session request requesting e2ae security, and when any one of the P-CSCFs of the network to which the responder or the responder belongs does not support e2ae, both parties use No media surface security measures to communicate.

Obviously, the above processing method is obviously inappropriate, especially when the communication parties or any party support the media face security encryption capability and pay for the encrypted communication, if the called party does not support the e2ae security capability due to the network reason The communication established for the calling party and the called party is actually without any media protection, and neither the calling party nor the called party may be aware of it, which is unfair and unreasonable to the user, and Conducive to communication security, will significantly reduce user satisfaction. Summary of the invention

In view of this, the main object of the present invention is to provide a secure communication negotiation method and apparatus to achieve security between communication participants and improve user satisfaction.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A secure communication negotiation method, the method comprising:

When the called user equipment or its network does not support the e2ae security capability of the access side edge, the primary and the called user equipments perform media plane security negotiation and communicate according to the negotiated key.

The media plane security negotiation is performed in the e2ae security scenario, including:

The calling user equipment carries the security capability parameter in the session initiation request, where the security capability parameter refers to the security capability required by the calling user equipment;

The called user equipment or its network returns a session response message, and the session response message carries a security capability parameter, which refers to the security capability supported by the called user equipment or its network.

The method for the called user equipment or its network to return a session response message includes:

If the network where the called user equipment is located does not support the e2ae security capability of the access side edge, if the called user equipment does not support the e2ae security capability from the end to the access side edge, only the end-to-end e2e security is supported. Fully capable, the called user equipment carries an e2e security capability parameter in the session response message; if the called user equipment supports the access side edge e2ae security capability, the called user equipment is in the session response message The SDES e2e security capability parameter with the session description protocol security key attribute is carried.

The method for the called user equipment or the network to return the session response message includes: if the called user equipment supports the access side edge e2ae security capability, the called user equipment carries the SDES e2e security in the session response message. Capability parameter

The result of the negotiation is: The primary and called user equipments perform secure communication according to the SDES e2e security mode.

If the called user equipment does not support the end-to-end e2ae security capability, but only supports the end-to-end e2e security capability, the negotiation process includes:

The calling user equipment performs security negotiation with the called user equipment according to its e2e security capability and a preset policy.

The result of the security negotiation is at least one of the following: encrypted communication, the called user equipment uses unencrypted communication and the calling user equipment uses encrypted communication, does not encrypt communication, and terminates communication.

When the result of the security negotiation is that the communication is not encrypted, the method for communicating according to the negotiated key is: the called user equipment determines whether to continue communication according to a preset policy.

If the called user equipment does not support the end-to-end e2ae security capability and does not support the end-to-end e2e security capability, the session response message returned by the network where the called user equipment is located carries the called party The user equipment does not support an indication of encrypted communication.

A secure communication negotiation device, comprising: a security capability maintenance unit, a security capability negotiation unit, and a security capability decision unit; wherein

The security capability maintenance unit is configured to save and maintain the obtained security capabilities of the primary and the called user equipment; The security capability negotiation unit is configured to perform media plane security negotiation on the primary and called user equipments;

The security capability decision unit is configured to apply the negotiated key support communication.

Each unit included in the device is combined or divided into at least one of the following:

The calling user equipment, the called user equipment, the proxy-call session control function P-CSCF, the service-call session control function S-CSCF.

The media plane security negotiation performed by the security capability negotiation unit is performed in the e2ae security scenario, and the security capability negotiation unit performs the media plane security negotiation when used for:

The security capability parameter is carried in the session initiation request initiated by the calling user equipment, where the security capability parameter refers to the security capability required by the calling user equipment;

The security response parameter is carried in the session response message returned by the called user equipment or the network it is in. The security capability parameter refers to the security capability supported by the called user equipment or the network where it is located.

The method and device for negotiating the secure communication method of the present invention can realize the negotiation of the secure communication mode between the communication participants, thereby improving user satisfaction. DRAWINGS

1 is a network architecture diagram of a prior art end-to-access gateway;

2 is a call flow diagram of an end-to-access gateway in which a peer terminal does not support any media plane security capability according to an embodiment of the present invention;

3 is a flow chart of a called end to an access gateway of a peer terminal that does not support any media plane security capability according to an embodiment of the present invention;

4 is a flow chart of a call from the end to the access gateway supporting the SDES e2e security capability of the peer terminal according to an embodiment of the present invention;

FIG. 5 is a flow chart of the called end to the access gateway of the peer terminal supporting the SDES e2e security capability according to an embodiment of the present invention;

FIG. 6 is an end-to-end connection of a peer terminal only supporting KMS e2e security capability according to an embodiment of the present invention; Call flow diagram into the gateway;

FIG. 7 is a flow chart of a called end-to-access gateway of a peer terminal only supporting KMS e2e security capability according to an embodiment of the present invention; FIG.

FIG. 8 is a schematic diagram of a negotiation process of a secure communication mode according to an embodiment of the present invention; FIG.

FIG. 9 is a diagram of a secure communication mode negotiating apparatus according to an embodiment of the present invention. detailed description

Figure 2 and Figure 3 show the end-to-access gateway scenario where the peer terminal does not support any media plane security capability in the e2ae security scenario. Figure 2 shows the call flow. The specific steps are as follows:

Step 201: User equipment A sends an SDP request (SDP offer) to the P-CSCF, and the SDP offer includes an SDES key attribute, where the key attribute includes the key K1 l. The SDP Offer indicates that the user needs the security capabilities of e2ae.

Step 202: The P-CSCF interacts with the IMS access gateway of the media plane to allocate the required resources. Step 203: The P-CSCF changes the received SDP Offer, changes the transmission mode from the Secure Real-Time Transport Protocol (SRTP) to the Real-Time Transport Protocol (RTP), deletes the security attributes of the SDES, and then sends the changed SDP Offer to the S. -CSCF.

Step 204: The S-CSCF forwards the received SDP Offer to the called party network.

Step 205: The S-CSCF receives an SDP answer (SDP Answer) from the called party network, where

SDP Answer indicates that the other user does not have any security capabilities.

Step 206: The S-CSCF forwards the received SDP Answer to the P-CSCF.

Step 207: The P-CSCF forwards the received SDP Answer to the user equipment A.

Step 208: User equipment A accepts the peer device according to the policy to accept the unencrypted communication mode and uses e2ae to continue communication or terminate communication.

Figure 3 illustrates the terminal-to-access gateway call flow when the peer terminal does not support any media plane security capability when using e2ae security. The specific steps are as follows:

Step 301: The S-CSCF of the called party network receives the SDP of the RTP from the calling party network. Offer.

Step 302: The S-CSCF forwards the received SDP Offer to the P-CSCF.

Step 303: The P-CSCF checks the security capability of the user equipment B. In this embodiment, user equipment B does not have any security capabilities.

Step 304: The P-CSCF returns an SDP Answer to the S-CSCF, where the message indicates that the user device B does not have any security capabilities.

Step 305: The S-CSCF returns the received SDP Answer to the calling party network in the corresponding SIP message.

Figure 4 and Figure 5 show the scenario of the end-to-end access gateway supporting the SDES e2e security capability in the e2ae security scenario. Figure 4 shows the call flow. The specific steps are as follows:

Step 401 to step 404: User equipment A initiates an SDP offer to the called party network. The operations of steps 401 through 404 have similar principles to those of steps 201 through 204, respectively.

Step 405: The S-CSCF receives an SDP Answer from the called party network, where the SDP Answer indicates that the called user equipment has e2e SDES capability.

Step 406: The S-CSCF forwards the received SDP Answer to the P-CSCF.

Step 407: The P-CSCF forwards the received SDP Answer to the user equipment A.

Step 408: User equipment A sends a new SDP Offer to the P-CSCF, where the new SDP offer includes an SDES key attribute, and the key attribute contains the key K1. The new SDP Offer indicates that the user is using e2e security.

Step 409: The P-CSCF forwards the received SDP Offer to the S-CSCF.

Step 410: The S-CSCF sends the received SDP Offer to the called party network.

Step 411: The S-CSCF receives an SDP Answer from the called party network, and the SDP Answer indicates that the other party also uses the e2e SDES. The SDP Answer carries the key K2.

Step 412: The S-CSCF forwards the received SDP Answer to the P-CSCF.

Step 413: The P-CSCF forwards the received SDP Answer to the user equipment A. After that, the user equipment Α can send the K1 encrypted media stream to the called party network, and can also receive the K2 encrypted media stream from the called party network.

Figure 5 illustrates the called process of the end-to-end gateway supporting the SDES e2e security capability in the e2ae security scenario. The specific steps are as follows:

Step 501: The S-CSCF of the called party network receives the SDP of the RTP from the calling party network.

Offer.

Step 502: The S-CSCF forwards the received SDP Offer of the RTP to the P-CSCF.

Step 503: The P-CSCF checks the security capability of the user equipment B. In this embodiment, the user device B has the SDES e2e security capability.

Step 504: The P-CSCF returns an SDP Answer to the S-CSCF, where the SDP Answer indicates that the user equipment B uses the SDES e2e security.

Step 505: The S-CSCF sends the received SDP Answer to the calling party network.

Step 506: The S-CSCF of the called party network receives an SDP Offer from the calling party network indicating that the SDES e2e security is used, and the SDP Offer carries the key K1.

Step 507: The S-CSCF forwards the received SDP Offer to the P-CSCF.

Step 508: The P-CSCF forwards the received SDP Offer to the user equipment B.

Step 509: User equipment B returns an SDP Answer message, and the SDP Answer carries the key K2.

Step 510: The P-CSCF forwards the received SDP Answer message to the S-CSCF.

Step 511: The S-CSCF sends the received SDP Answer message to the calling party network. After that, user equipment B can receive the K1 encrypted media stream from the calling party network, and can also send the K2 encrypted media stream to the calling party network.

Figure 6 and Figure 7 show the scenario where the peer terminal only supports the KMS e2e security capability from the end to the access gateway in the e2ae security scenario. Figure 6 shows the call flow. The specific steps are as follows:

Step 601: User equipment A sends an SDP offer to P-CSCF, where the SDP offer includes SDES key attribute, which contains the key Kl l. The SDP Offer indicates that the user needs the security capability of e2ae.

Step 602: The P-CSCF interacts with the IMS access gateway of the media plane to allocate the required resources. Step 603: The P-CSCF changes the received SDP Offer, changes the transmission mode from SRTP to RTP, deletes the security attribute of the SDES, and then sends the changed SDP Offer to

S-CSCF.

Step 604: The S-CSCF forwards the received SDP Offer to the called party network.

Step 605: The S-CSCF receives an SDP Answer from the called party network, and the SDP Answer indicates that the peer terminal uses a higher level of e2e KMS security.

Step 606: The S-CSCF forwards the received SDP Answer to the P-CSCF.

Step 607: The P-CSCF forwards the received SDP Answer to the user equipment A.

Step 608: User equipment A selects to use the same higher-level security scheme as the peer terminal according to its own security capabilities and policies, accepts the peer device to use unencrypted communication, and uses e2ae to continue communication or terminate communication. If the unencrypted communication method is used, the peer terminal needs to be notified.

Figure 7 shows the process of the called end to the access gateway of the KMS e2e security capability in the e2ae security scenario. The specific steps are as follows:

Step 701: The S-CSCF of the called party network receives the SDP of the RTP from the calling party network.

Offer.

Step 702: The S-CSCF forwards the received SDP Offer of the RTP to the P-CSCF.

Step 703: The P-CSCF checks the security capability of the user equipment B. In this embodiment, user equipment B only has higher security capabilities: e2e KMS security.

Step 704: The P-CSCF returns an SDP Answer to the S-CSCF, where the SDP Answer indicates that the user equipment B has the e2e KMS security capability.

Step 705: The S-CSCF returns the received SDP Answer to the calling party network in the corresponding SIP message. If the information returned from the calling party network indicates that the same security protection as the user equipment B is used, that is, e2e KMS, the subsequent communication process uses the same process as the existing KMS scheme, and will not be described again. If the information returned from the calling party network indicates that encryption protection is not used, the user equipment B can decide whether to continue communication according to the policy.

In actual applications, the calling user equipment and the called user equipment may be referred to as calling and called, respectively.

It can be seen from the above-mentioned flowchart that when the called party or its network does not support the e2ae security capability, the master and the called party can perform media plane security negotiation and perform communication according to the negotiated key. Specifically, the above-mentioned secure communication mode negotiation idea can represent the flow shown in FIG. 8. Referring to FIG. 8, FIG. 8 is a schematic diagram of a negotiation process of a secure communication mode according to an embodiment of the present invention, where the process includes the following steps:

Step 810: The primary and called user equipments negotiate a secure communication manner based on their own security capabilities.

Step 820: The primary and the called user equipment determine the communication mode according to the result of the negotiation.

In summary, when the called user equipment does not support any media plane security capability, that is, does not support e2ae and e2e, the P-CSCF in the called party network receives the message requesting e2ae security, and then the SDP Answer message. The caller carries the indication that the called party does not have any security capability and returns to the calling party network. The calling party network needs to notify the calling party that the communication cannot achieve media plane security, whether to continue to use the unencrypted communication mode or terminate the communication according to the policy or the user. Choose the decision.

If the called party network does not support e2ae security, and the called user equipment supports e2e security, if the called user equipment supports the SDES e2e security capability, the SDP message carries the key K2 and carries the e2e security indication. The SDP message is returned to the calling party network to indicate that the called party supports e2e security, and the subsequent communication uses the SDES e2e security mode. If the called user equipment does not support SDES e2e security, select a higher-level security scheme such as KMS e2e security, and carry an indication that the corresponding security capability is supported in the return message; the calling party according to its own security capability, ie Whether to support the security capabilities returned by the called party, and according to the security policy to decide to use a higher level of security to communicate or not to use media side security to communicate or terminate communication.

It should be noted that, in the above description, in addition to considering the security capabilities of the user equipment, the security capability of the communication network may be further considered in the negotiation process; in actual applications, the corresponding users may be considered according to different application scenarios. Equipment security capabilities and/or communication network security capabilities to determine the communication methods that need to be used in subsequent communications. In addition, during the interaction of the user equipment, the network where the user equipment is located may also participate, such as: indicating the required security capability, returning an indication to indicate the supported security capabilities, and the like.

In addition, the present technology can be applied to other communication environments using the SIP protocol, in addition to being applicable to IMS.

It can be seen that the secure communication method negotiation method of the present invention can realize the secure communication mode negotiation between the communication participants, and can improve user satisfaction.

In order to ensure that the above operations can be performed normally, a device as shown in Fig. 9 can be provided. Referring to FIG. 9, FIG. 9 is a diagram of a secure communication mode negotiating device according to an embodiment of the present invention. The device includes a security capability maintenance unit, a security capability negotiation unit, and a security capability decision unit that can be connected in pairs. The functional units can be combined or It is divided into devices such as user equipment, CSCF, etc., and the CSCF may be a P-CSCF and/or an S-CSCF.

In a specific application, the security capability maintenance unit can obtain the security capability of the user equipment by checking the security capability of the user equipment, and perform maintenance operations including saving and providing for the security capability of the user equipment.

The security capability negotiation unit is configured to perform a negotiation interaction operation including a request, a response, and the like according to the user equipment, and finally obtain a result obtained by the negotiation of the user equipment, for example, a security capability that can be implemented by the called user equipment. In addition, the security capability negotiation unit can transmit the content of the negotiation, the response, and the like through the S-CSCF, the P-CSCF, and the like as the negotiation transit unit, so as to ensure that the negotiation process can be successfully completed. The security capability decision-making unit can obtain the result of negotiation (such as a key) of the security capability negotiation unit by means of active acquisition or passive acceptance, and determine the communication mode to be used in the subsequent communication process to support communication according to the obtained result of the negotiation. For example, the key supported by the application security capability negotiation unit supports communication.

The specific operations that can be implemented by the above functional units are specifically described in the foregoing process, and are not described herein again. In general, the security capability maintenance unit can save and maintain the acquired security capabilities of the primary and the called; the security capability negotiation unit can perform media surface security negotiation between the primary and the called; the security capability decision unit can apply security. The key negotiation communication after negotiation by the capability negotiation unit.

In summary, it can be seen that both the method and the device, the secure communication method negotiation method of the present invention can realize the secure communication mode negotiation between the communication participants, and can improve user satisfaction.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included. Within the scope of protection of the present invention.

Claims

Claim

A secure communication negotiation method, the method comprising:

The method according to claim 1, wherein the media plane security negotiation is performed in an e2ae security scenario, including:

3. The method according to claim 2, wherein the method for the called user equipment or the network in which the network response message is returned comprises:

If the network where the called user equipment is located does not support the e2ae security capability of the access side edge, if the called user equipment does not support the e2ae security capability from the end to the access side edge, but only supports the end-to-end e2e security capability, the called party is called. The user equipment carries the e2e security capability parameter in the session response message; if the called user equipment supports the access side edge e2ae security capability, the called user equipment carries the session description protocol security in the session response message. Key attribute SDES e2e security capability parameter.

4. The method of claim 3, wherein

The result of the negotiation is: The primary and the called user equipment perform secure communication according to the SDES e2e security mode.

The method according to claim 3, wherein, if the called user equipment does not support the security capability of the end-to-end e2ae, but only supports the end-to-end e2e security capability, the negotiation process includes:

The method according to claim 5, wherein, when the result of the security negotiation is that the communication is not encrypted, the method for performing communication according to the negotiated key is: the called user equipment is preset according to the preset The strategy determines whether to continue communicating.

The method according to claim 2, wherein, if the called user equipment does not support the end-to-end e2ae security capability and does not support the end-to-end e2e security capability, the called user The session response message returned by the network where the device is located carries an indication that the called user equipment does not support encrypted communication.

A secure communication negotiation device, comprising: a security capability maintenance unit, a security capability negotiation unit, and a security capability decision unit;

The security capability maintenance unit is configured to save and maintain security capabilities of the obtained primary and called user equipments;

The security capability negotiation unit is configured to perform media plane security negotiation on the primary and called user equipments;

9. The device according to claim 8, wherein each unit included in the device is combined or divided into at least one of the following:

The calling user equipment, the called user equipment, the proxy-call session control function P-CSCF, Service-Call Session Control Function S-CSCF.

The apparatus according to claim 8 or 9, wherein the media plane security negotiation performed by the security capability negotiation unit is performed in an e2ae security scenario, and the security capability negotiation unit performs a media plane. Used during security negotiation: