Establishing secure communication sessions in a communication network

• US 20080133761A1
• Filed: 12/01/2006
• Published: 06/05/2008
• Est. Priority Date: 12/01/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Polk, James M.
• Granted Patent: US 8,156,536 B2
• Time in Patent Office: Days
• US Class Current: 709/228
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]

Abstract

In one embodiment, a method for establishing a session between a first party and a second party in a communication network comprises issuing a request to establish the session with the second party, the request containing a first security level associated with the first party. A response is received to the request from the second party, the response containing a second security level associated with the second party. A security level for the session is identified from the first security level and the second security level and the session established at the identified security level.

Claims

1. A method for establishing a session between a first party and a second party in a communication network, the method comprising:

issuing a request to establish the session with the second party, the request containing a first security level associated with the first party;

receiving a response to the request from the second party, the response containing a second security level associated with the second party;

identifying a security level for the session from the first security level and the second security level; and

establishing the session at the identified security level.

2. A method as defined in claim 1 wherein identifying a security level comprises:

identifying the first security level as the security level for the session if the second security level matches the first security level.

3. A method as defined in claim 1 wherein identifying a security level comprises:

identifying the first security level as the security level for the session if the second security level is a higher security level than the first security level.

4. A method as defined in claim 1 wherein identifying a security level comprises:

identifying the second security level as the security level for the session if the second security level is a lower security level than the first security level.

5. A method as defined in claim 1 further comprising:

providing an indication of the identified security level.

6. A method as defined in claim 5 wherein the indication is an audio indication.

7. A method as defined in claim 5 wherein the indication is a visual indication.

8. A method as defined in claim 1 wherein the response contains an assertion that indicates the second party is entitled to establish a session at the second security level.

9. A method as defined in claim 8 further comprising:

determining if the assertion is true.

10. A method as defined in claim 9 further comprising:

abandoning establishment of the session if the assertion contained in the response is determined to be not true.

11. A method as defined in claim 9 wherein determining comprises:

generating a request to verify the assertion; and

forwarding the request to a node in the communication network to verify the assertion.

12. A method as defined in claim 11 wherein determining further comprises:

receiving a response from the node indicating results of the verification of the assertion.

13. A method as defined in claim 12 wherein determining further comprises:

abandoning establishment of the session if the results indicate the assertion is not true.

14. A node in a communication network comprising:

a network interface configured to;

receive a response to a request to establish a session in the communication network from a second party, the request containing a first security level associated with a first party and the response containing a second security level associated with the second party; and

processing circuitry configured to;

identify a security level for the session from the first security level and second security level, and

establish the session at the identified security level.

15. A node as defined in claim 14 wherein the processing circuitry is further configured to:

identify the first security level as the security level for the session if the second security level matches the first security level.

16. A node as defined in claim 14 wherein the processing circuitry is further configured to:

identify the first security level as the security level for the session if the second security level is a higher security level than the first security level.

17. A node as defined in claim 14 wherein the processing circuitry is further configured to:

identify the second security level as the security level for the session if the second security level is a lower security level than the first security level.

18. A node as defined in claim 14 wherein the processing circuitry is further configured to:

provide an indication of the identified security level.

19. A node as defined in claim 18 wherein the indication is an audio indication.

20. A node as defined in claim 18 wherein the indication is a visual indication.

21. A node as defined in claim 14 wherein the response contains an assertion that indicates the second party is entitled to establish a session at the second security level.

22. A node as defined in claim 21 wherein the processing circuitry is further configured to:

determine if the assertion is true.

23. A node as defined in claim 22 further comprising:

abandon establishment of the session if the assertion contained in the response is determined to be not true.

24. An apparatus for establishing a session between a first party and a second party in a communication network, the method comprising:

means for issuing a request to establish the session with the second party, the request containing a first security level associated with the first party;

means for receiving a response to the request from the second party, the response containing a second security level associated with the second party;

means for identifying a security level for the session from the first security level and second security level; and

means for establishing the session at the identified security level.

25. A method for allowing a third party to join an established session between two or more parties in a communication network, the method comprising:

receiving a request from the third party to join the established session, the request comprising a security level associated with the third party;

determining if the third party may join the session based on the security level; and

allowing the third party to join the session if it is determined that the third party may join the session.

26. A method as defined in claim 25 wherein determining further comprises determining if the third party may join the session based on the security level and the security level of the established session.

27. A method as defined in claim 25 further comprising broadcasting the identity of the third party.

28. A method comprising upgrading a session established at a lower security level to a higher security level if all remaining participants of the session have access to that higher security level.

29. A method as defined in claim 28 further comprising providing an audio indication of the higher security level to the participants.

30. A method as defined in claim 28 further comprising providing a visual indication of the higher security level to the participants.