Securing Voice over IP traffic

• US 20020059516A1
• Filed: 11/15/2001
• Published: 05/16/2002
• Est. Priority Date: 11/16/2000
• Status: Abandoned Application

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Schultz, Goran, Lindborg, Seppo, Turtiainen, Esa, Linnakangas, Tommi, Karna, Juha-Petri
• Application Number:
  US10/003,776
• Publication Number:
  US 20020059516A1
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

A method of sending streamed data over an IP network from a first node 1 to a second node 4, the method comprising using Internet Key Exchange (IKE) to establish an IKE security association (SA) between the first and second nodes 1,4. A shared secret is established between the first and second nodes using the IKE SA, and the streamed data encrypted at the first node 1 with a cipher using the shared secret or a key derived using the shared secret. IP datagrams are constructed containing in their payload, segments of the encrypted streamed data, the datagrams not including an IPSec header or headers. The IP datagrams are then sent from the first node 1 to the second node 4.

Claims

1. A method of sending streamed data over an IP network from a first node to a second node, the method comprising:

using Internet Key Exchange (IKE) to establish an IKE security association (SA) between the first and second nodes;

using the IKE SA to establish an IPSec SA between the first and second nodes;

encrypting the streamed data at the first node with a cipher using a shared secret forming part of said IPSec SA;

constructing IP datagrams containing in their payload segments of the encrypted streamed data, the datagrams not including an IPSec header or headers; and

sending the IP datagrams from the first node to the second node.

2. A method according to claim 1, wherein said streamed data is VoIP data or videoconferencing data.

3. A method according to claim 1, wherein said peer nodes are end points for the data.

4. A method according to claim 1, wherein said peer nodes tunnel data between respective end points.

5. Apparatus for sending streamed data over an IP network to a peer node, the apparatus comprising:

processing means and memory containing software instructions for implementing IPSec protocols;

an application for delivering streamed data;

means for employing components of said processing means and memory containing software instructions for using Internet Key Exchange (IKE) to establish an IKE security association (SA) between the first and second nodes;

means for using the IKE SA to establish an IPSec SA between the first and second nodes, the IKE SA comprising a shared secret;

means for encrypting the streamed data with a cipher using the shared secret;

means for constructing IP datagrams containing in their payload segments of the encrypted streamed data, the datagrams not including an IPSec header or headers; and

transmission means for sending the IP datagrams from the first node to the second node.

6. Apparatus according to claim 5, the apparatus being an end user terminal such as a telephone, communicator, PDA or palmtop computer, or a personal computer (PC).

7. Apparatus according to claim 6, the apparatus being a firewall or gateway coupled to an end point which is the source of the streamed data.