Securing Uniform Resource Identifier Information for Multimedia Calls

• US 20110142035A1
• Filed: 12/15/2009
• Published: 06/16/2011
• Est. Priority Date: 12/15/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Soo, Armstrong, Ku, Bernard
• Granted Patent: US 8,948,057 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 28/0247 based on conditions of the access network or the infrastructure network central resource management H04W28/16
• CPC Class Codes: H04W 80/10 adapted for application session management, e.g. SIP [Session Initiation Protocol] connection management H04W76/00; arrangements for session management H04L67/14

Abstract

A session request from a first subscriber is received at a first network component of a packet-based network. The session request comprises a request to establish a communications session between the first subscriber and a second subscriber. In the event the session request originated in a trusted network, the first network component permits access to unique resource identifier (URI) information associated with the second subscriber for use in establishing the communications session via the packet-based network. In the event the session request did not originate in a trusted network and in response to determining a security configuration associated with the second subscriber allows the first subscriber to access the URI information under the circumstances, the first network component permits access to the URI information for use in establishing the communications session via the packet-based network. In response to determining the security configuration prohibits access to the URI information by the first subscriber under the circumstances, the first network component forwards the session request to a second network component so as to establish the communications session via a public switched telephone network.

Claims

1. A method comprising:

receiving, at a first network component of a packet-based network, a session request from a first subscriber, the session request comprising a request to establish a communications session between the first subscriber and a second subscriber via the packet-based network;

determining whether the session request originated in a trusted network; and

in response to determining that the session request did not originate in a trusted network, selectively permitting access to unique resource identifier (URI) information associated with the second subscriber for use in establishing the communications session based on a security configuration associated with the second subscriber.

2. The method of claim 1, wherein:

the security configuration identifies one or more time spans during which communications sessions with the second subscriber are permitted or prohibited; and

selectively permitting access to the URI information comprises selectively permitting access to the URI information responsive to a correspondence between the one or more time spans and a time of origination of the session request.

3. The method of claim 1, wherein:

the security configuration identifies a group of one or more subscribers permitted to establish a communications session with the second subscriber or one or more subscribers prohibited from establishing a communications session with the second subscriber; and

selectively permitting access to the URI information comprises selectively permitting access to the URI information responsive to determining whether the group includes the first subscriber.

4. The method of claim 1, wherein:

the security configuration identifies one or more service types as permitted or prohibited; and

selectively permitting access to the URI information comprises selectively permitting access to the URI information responsive to a service type of the communications session associated with the session request.

5. The method of claim 1, further comprising:

permitting access to the URI information via the first network component responsive to determining the session request originated in a trusted network.

6. The method of claim 1, wherein determining whether the session request originated in a trusted network comprises determining whether the session request originated in a network of the second subscriber.

7. The method of claim 1, further comprising:

responsive to determining the first subscriber is not permitted to access the URI information based on the security configuration, routing the session request to a second component of the packet-based network to establish the communications session via a public switched telephone network.

8. The method of claim 7, wherein:

the first network comprises an Internet Protocol Multimedia Subsystem;

the first network component comprises a communications session control function component; and

the second component comprises a border gateway control function component.

9. The method of claim 1, wherein:

the URI information is stored at a server;

the session request includes an E.164 telephone number associated with the second subscriber; and

selectively permitting access to the URI information via the first network component comprises selectively permitting a query to the server based on the E.164 telephone number.

10. A network component for implementation in a packet-based network, the network component comprising:

means to receive a session request from a first subscriber, the session request comprising a request to establish a communications session between the first subscriber and a second subscriber via the packet-based network;

means to determine whether the session request originated in a trusted network, and in response to determining the session request did not originate in a trusted network, to selectively permit access to unique resource identifier (URI) information associated with the second subscriber for use in establishing the communications session based on a security configuration associated with the second subscriber.

11. The network component of claim 10, wherein:

the security configuration identifies one or more time spans during which communications sessions with the second subscriber are permitted or prohibited; and

the network component is to selectively permit access to the URI information responsive to a correspondence between the one or more time spans and a time of origination of the session request.

12. The network component of claim 10, wherein:

the security configuration identifies a group of one or more subscribers permitted to establish a communications session with the second subscriber or one or more subscribers prohibited from establishing a communications session with the second subscriber; and

the network component is to selectively permit access to the URI information responsive to determining whether the group includes the first subscriber.

13. The network component of claim 10, wherein:

the security configuration identifies one or more permitted or prohibited service types; and

the network component is to selectively permit access to the URI information responsive to a service type of the communications session associated with the session request.

14. The network component of claim 10, wherein the network component further is to permit access to the URI information responsive to determining the session request originated in a trusted network.

15. The network component of claim 14, wherein the network component is to determine whether the session request originated in a trusted network by determining whether the session request originated in a network of the second subscriber.

16. The network component of claim 15, further comprising a communications session control function component.

17. The network component of claim 10, wherein:

the URI information is stored in association with a server;

the session request includes an E.164 telephone number associated with the second subscriber; and

the network component selectively permits access to the URI information by selectively permitting a query to the server based on the E.164 telephone number.

18. A method comprising:

receiving, at a first network component of a packet-based network, a first session request from a first subscriber, the first session request comprising a request to establish a first communications session between the first subscriber and a second subscriber;

receiving, at the first network component, a second session request from a third subscriber, the second session request comprising a request to establish a second communications session between the third subscriber and the second subscriber;

permitting access to unique resource identifier (URI) information associated with the second subscriber for use in establishing the first communications session in response to determining that the first subscriber is located in the same network as the second subscriber; and

responsive to determining that the third subscriber is not located in the same network as the second subscriber;

accessing a security configuration associated with the second subscriber from a second network component of the packet-based network; and

selectively permitting access to the URI information associated with the second subscriber for use in establishing the second communications session based on the security configuration.

19. The method of claim 18, wherein selectively permitting access to the URI information comprises:

permitting access to the URI information in response to determining access is permitted based the security configuration; and

denying access to the URI information and initiating the second communications session via a public switched telephone network in response to determining access is prohibited based on the security configuration.