Usage authentication via intercept and challege for network services

• US 20130212646A1
• Filed: 04/18/2012
• Published: 08/15/2013
• Est. Priority Date: 06/24/2011
• Status: Abandoned Application

• Current Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Original Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Inventors: McFarland, Keith A., Kesser, Doug, Burton, Victor, Sathyanarayanan, Amar, Raman, Baby
• Application Number:
  US13/506,418
• Publication Number:
  US 20130212646A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/104 in the network
• CPC Class Codes: H04L 65/1045 Proxies, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]

Abstract

A security broker (SB) that provides network based authorization of secure VoIP services, triggered upon attempted user access. The security broker (SB) intercepts a SIP transaction during session setup to transmit a network based security challenge to a SIP application attempting to access (secure) IP based services. A network based security challenge is transmitted to a participating SIP application on both the origination and termination legs of a SIP transaction. The network based security challenge prompts a SIP application to return subscriber authorization/authentication credentials (e.g. a username/password combination). If credentials returned by the SIP application are valid, the security broker (SB) authorizes the network to permit session completion, and access to secure IP services is granted. Alternatively, if credentials returned by the VoIP application are invalid, the security broker (SB) terminates the corresponding session attempt, hence preventing unauthorized access to (secure) IP based services.

Claims

1. A security broker to authorize use of a secure IP service, comprising:

intercepting a Session Initiation Protocol (SIP) or Secure Session Initiated Protocol (SIPS) transaction during session setup;

transmitting a network based security challenge to a secure SIP device attempting to access a IP service associated with said SIP transaction;

prompting said secure SIP application to return an authorized subscriber authentication credential in only SIPS format;

forcing a SIP client to switch between Session Initiation Protocol (SIP) to Secure Session Initiated Protocol (SIPS) transaction;

receiving a returned subscriber authentication credential in response to said prompting using SIPS when previous transaction was in SIP format; and

switching a SIPS transaction back to SIP if appropriate for the remainder of a SIP transaction. authorizing an associated network to permit completion of an associated SIP session if said returned subscriber authentication credential is valid.

2. The security broker to authorize use of a secure IP service in accordance with claim 1, wherein said subscriber authorization/authentication credential, separate credential from SIP/S registration process, comprises:

a username and password combination

b and/or a personal identification number

c and/or biometric information.

3. The security broker to authorize use of a IP service in accordance with claim 1, wherein:

said security broker authorizes access to said IP network service on both an origination leg and a termination leg of said SIP transaction.

4. Apparatus to authorize use of a secure IP service, comprising:

means for intercepting a Session Initiation Protocol (SIP) or Secure Session Initiated Protocol (SIPS) transaction during session setup;

means for transmitting a network based security challenge to a secure SIP device attempting to access a IP based service associated with said IP call;

means for prompting said secure SIP application to return an authorized subscriber authentication credential in only SIPS format;

means for forcing a SIP client to switch between Session Initiation Protocol (SIP) to Secure Session Initiated Protocol (SIPS) transaction;

means for receiving a returned subscriber authentication credential in response to said prompting; and

means for switching a SIPS transaction back to SIP if appropriate for the remainder of a SIP transaction.

means for authorizing an associated network to permit completion of an associated SIP session if said returned subscriber authentication credential is valid.

5. The apparatus to authorize use of a secure IP service in accordance with claim 4, wherein said subscriber authorization/authentication credential, separate credential from SIP/S registration process, comprises:

a username and password combination

b and/or a personal identification number

c and/or biometric information.

6. The apparatus to authorize use of a IP service in accordance with claim 4, wherein:

said security broker authorizes access to said IP network service on both an origination leg and a termination leg of said IP call.