Controlling access to traversal using relays around network address translation (TURN) servers using trusted single-use credentials

• US 10,129,243 B2
• Filed: 12/27/2013
• Issued: 11/13/2018
• Est. Priority Date: 12/27/2013
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Yoakum, John H., Singh, Kundan, Ezell, Joel, Johnston, Alan B.
• Primary Examiner(s): Rashid, Harunur
• Application Number:
  US14/141,798
• Publication Number:
  US 20150188902A1
• Time in Patent Office: 1,782 Days
• Field of Search: 726 7
• CPC Class Codes: H04L 61/2589 over a relay server, e.g. traversal using relay for network address translation [TURN]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Embodiments disclosed provide access to Traversal Using Relays around Network Address Translation (TURN) servers using trusted single-use credentials, and related methods, systems, and computer-readable media. In one embodiment, a method comprises receiving, by a TURN authentication agent, a request for a TURN server credential. Responsive to determining that the request is authorized, the agent generates a trusted single-use credential and transmits it to the requestor. Using this trusted single-use credential allows untrusted clients to access a TURN server without exposing a userid/password combination. In another embodiment, a method comprises receiving, by the TURN server, a request for a TURN service. The server challenges the request, and receives a userid and a password. Responsive to determining that the userid and the password constitute a trusted single-use credential and responsive to determining that the request is authorized, the server provides the TURN service for the requestor.

Claims

1. A method for controlling access to a Traversal Using Relays around Network Address Translation (TURN) server, the method comprising:

receiving, by the TURN server, a request from a Web Real-Time Communications (WebRTC) client for a TURN service;

challenging, by the TURN server, the request for the TURN service;

receiving, by the TURN server, a userid comprising an authorized domain identifier and a password comprising an encrypted authentication token from the WebRTC client, wherein the authentication token comprises enterprise policy instructions, wherein the authentication token was generated by a TURN authentication agent executing on a computing device in response to a determination by the TURN authentication agent to authorize a request for a TURN server credential from the WebRTC client;

determining, by the TURN server, whether the userid comprises an authorized single-use credential by determining if the userid comprises the authorized domain identifier;

determining, by the TURN server, whether to authorize the request for the TURN service by decrypting the password to obtain the authentication token using a key based on the authorized domain identifier, wherein the authentication token comprises enterprise policy instructions; and

responsive to determining whether to authorize the request for the TURN service, providing, by the TURN authentication agent, the TURN service for the WebRTC client according to the enterprise policy instructions.

2. The method of claim 1, further comprising determining that the request originated from an authorized requestor.

3. The method of claim 2, wherein determining that the request originated from the authorized requestor comprises examining an origin header of the request.

4. The method of claim 1, wherein the authentication token comprises a value selected from the group consisting of:

a domain address;

a nonce value;

a signature; and

the enterprise policy instructions.

5. The method of claim 1, wherein the authentication token was encrypted using a shared secret.

6. The method of claim 1, wherein the authentication token was encrypted using an asymmetric key.

7. A system for controlling access to a Traversal Using Relays around Network Address Translation (TURN) server, the system comprising:

a TURN server configured to;

receive a request from a Web Real-Time Communications (WebRTC) client for a TURN service;

challenge the request for the TURN service;

receive a userid comprising an authorized domain identifier and a password comprising an encrypted authentication token from the WebRTC client, wherein the authentication token comprises enterprise policy instructions, wherein the authentication token was generated by a TURN authentication agent executing on a computing device in response to a determination by the TURN authentication agent to authorize a request for a TURN server credential from the WebRTC client;

determine whether the userid comprises an authorized single-use credential by determining if the userid comprises the authorized domain identifier;

determine whether to authorize the request for the TURN by decrypting the password to obtain the authentication token using a key based on the authorized domain identifier, wherein the authentication token comprises enterprise policy instructions; and

responsive to determining whether to authorize the request for the TURN service, provide the TURN service for the WebRTC client according to the enterprise policy instructions.

8. The system of claim 7, wherein the authentication token comprises a value selected from the group consisting of:

a domain address;

a nonce value;

a signature; and

enterprise policy instructions.

9. The method of claim 7, further comprising determining that the request originated from an authorized requestor.

10. The method of claim 9, wherein determining that the request originated from the authorized requestor comprises examining an origin header of the request.

14. The system of claim 7, wherein the authentication token was encrypted using a shared secret.

15. The method of claim 7, wherein the authentication token was encrypted using an asymmetric key.

11. A non-transitory computer-readable medium storing one or more programs, the one or more programs comprising instructions, which when executed by an electronic device cause the electronic device to implement a method for controlling access to a Traversal Using Relays around Network Address Translation (TURN) server, the method comprising:

receiving, by the TURN server, a request from a Web Real-Time Communications (WebRTC) client for a TURN service;

challenging, by the TURN server, the request for the TURN service;

receiving, by the TURN server, a userid comprising an authorized domain identifier and a password comprising an encrypted authentication token from the WebRTC client, wherein the authentication token comprises enterprise policy instructions, wherein the authentication token was generated by a TURN authentication agent executing on a computing device in response to a determination by the TURN authentication agent to authorize a request for a TURN server credential from the WebRTC client;

determining, by the TURN server, whether the userid comprises an authorized single-use credential by determining if the userid comprises the authorized domain identifier;

determining, by the TURN server, whether to authorize the request for the TURN service by decrypting the password to obtain the authentication token using a key based on the authorized domain identifier, wherein the authentication token comprises enterprise policy instructions; and

responsive to determining whether to authorize the request for the TURN service, providing, by the TURN authentication agent, the TURN service for the WebRTC client according to the enterprise policy instructions.

12. The non-transitory computer-readable medium of claim 11, wherein the authentication token was encrypted using a shared secret.

13. The non-transitory computer-readable medium of claim 11, wherein the authentication token was encrypted using an asymmetric key.

16. The non-transitory computer-readable medium of claim 11, wherein the authentication token comprises a value selected from the group consisting of:

a domain address;

a nonce value;

a signature; and

enterprise policy instructions.

17. The non-transitory computer-readable medium of claim 11, further comprising determining that the request originated from an authorized requestor.

18. The non-transitory computer-readable medium of claim 17, wherein determining that the request originated from the authorized requestor comprises examining an origin header of the request.