SECURE CALL INDICATOR MECHANISM FOR ENTERPRISE NETWORKS

• US 20140096198A1
• Filed: 09/28/2012
• Published: 04/03/2014
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Brunson, Gordon R., Shekh-Yusef, Rifaat
• Granted Patent: US 9,398,055 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 65/103 in the network
• CPC Class Codes: H04L 65/104 in the network
• CPC Class Codes: H04L 65/1063 Application servers providing network services systems providing special services to telephonic subscribers H04M3/42
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]

Abstract

The concept of a secure call indicator is introduced. In general, the secure call indicator is capable of inspecting the security of signaling associated with Session Initiation Protocol (SIP) messages and comparing the security with media descriptions of the actual media path of the SIP messages. Furthermore, the secure call indicator may be configured to indicate the security associated with a communication session via a physical or virtual notification system.

Claims

1. A secure call indicator method, comprising:

receiving a Session Initiation Protocol (“

SIP”

) message, wherein the SIP message corresponds to a communication session between at least a first communication device associated with a first user and second communication device associated with a second user;

applying a security check to the received SIP message, wherein the security check is configured to inspect at least one of a communication session management trust, a signaling link security protocol, a message destination address, a media, and a media stream destination and a security protocol, associated with the received SIP message;

determining, based on the security check, a security classification associated with the communication session; and

controlling a secure call indicator on at least one of the second communication device associated with the second user and the at least one first communication device associated with the first user, wherein the secure call indicator is configured to indicate the security classification associated with the communication session, wherein the security classification indicates to at least one of the first or second user whether the communication session is secure or unsecure.

2. The method of claim 1, wherein the security check is applied by at least one of a Back-to-Back User Agent (“

B2BUA”

) and a proxy, and wherein the at least one of the B2BUA and the proxy comprises rules used for inspection of the received SIP message.

3. The method of claim 1, wherein the secure call indicator is configured to output a first state when the security check indicates that the communication session is secure.

4. The method of claim 1, wherein applying the security check to the received SIP message further comprises:

applying a first security check to the received SIP message, wherein the first security check is configured to inspect for trust comprising;

determining at least one of an Internet protocol (“

IP”

) address and an identification of one or more endpoints;

determining an identification of a communication server managing the communication session; and

comparing the identification of the communication server with at least one trusted communication server identification.

5. The method of claim 4, wherein the identification of the communication server managing the communication session is determined from at least one of a hostname, IP address, and a certificate associated with the communication server.

6. The method of claim 4, wherein applying the security check to the received SIP message further comprises:

applying a second security check to the received SIP message, wherein the second security check is configured to inspect the signaling link security protocol of the communication session comprising;

determining, whether the communication session signaling is end-to-end secure when at least one transport security protocol is used for all signaling links of the communication session.

7. The method of claim 6, wherein the communication session signaling is determined as secure when Transport Layer Security (“

TLS”

) is used by all SIP entities involved in the communication session.

8. The method of claim 7, wherein the use of TLS is determined by inspecting a Request-Uniform Resource Identifier (“

Request-URI”

) of the received SIP message for a Secure SIP (“

SIPS”

) transmission scheme.

9. The method of claim 8, wherein a security header is written to a tamper-protected header of the received SIP message indicating that the communication session is secure.

10. The method of claim 6, wherein applying the security check to the received SIP message further comprises:

applying a third security check to the received SIP message, wherein the third security check is configured to inspect a secure-media header of the received SIP message, wherein the secure-media header is configured to cryptographically protect information of one or more Endpoint-View (“

EPV”

) header, Session Description Protocol (“

SDP”

) body, and current partial results of a secure-media marking, comprising;

determining a media stream security associated with at least one media stream of the received SIP message, wherein the at least one media stream is directed to a terminal IP address; and

determining that the destination IP address matches the terminal IP address of the at least one media stream.

11. The method of claim 10, wherein the media stream security is provided by a secure protocol.

12. The method of claim 10, wherein the secure protocol is at least one of Secure Real-time Transport Protocol (“

SRTP”

), TLS, and Datagram Transport Layer Security (DTLS).

13. The method of claim 10, wherein the secure call indicator is controlled only when all security checks indicate that the communication session is secure.

14. A non-transitory computer readable medium having stored thereon instructions that, when executed by a processor, perform a method comprising:

receiving a Session Initiation Protocol (“

SIP”

) message, wherein the SIP message corresponds to a communication session between at least a first communication device associated with a first user and second communication device associated with a second user;

applying a security check to the received SIP message, wherein the security check is configured to inspect at least one of a communication session management trust, a signaling link security protocol, a message destination address, a media, and a media stream destination and a security protocol, associated with the received SIP message;

determining, based on the security check, a security classification associated with the communication session; and

controlling a secure call indicator on at least one of the second communication device associated with the second user and the at least one first communication device associated with the first user, wherein the secure call indicator is configured to indicate the security classification associated with the communication session, wherein the security classification indicates to at least one of the first or second user whether the communication session is secure or unsecure.

15. The non-transitory computer readable medium of claim 14, wherein applying the security check further comprises:

applying a first security check to the received SIP message, wherein the first security check is configured to inspect for trust comprising;

determining at least one of an Internet protocol (“

IP”

) address and an identification of one or more endpoints;

determining an identification of a communication server managing the communication session; and

comparing the identification of the communication server with at least one trusted communication server identification.

16. The non-transitory computer readable medium of claim 15, wherein applying the security check further comprises:

applying a second security check to the received SIP message, wherein the second security check is configured to inspect the signaling link security protocol of the communication session comprising;

determining, whether the communication session signaling is end-to-end secure when at least one transport security protocol is used for all signaling links of the communication session.

17. The non-transitory computer readable medium of claim 16, wherein applying the security check further comprises:

applying a third security check to the initial received message, wherein the third security check is configured to inspect a secure-media header of the received SIP message, wherein the secure-media header is configured to cryptographically protect information of one or more Endpoint-View (“

EPV”

) header, Session Description Protocol (“

SDP”

) body, and current partial results of a secure-media marking, comprising;

determining a media stream security associated with at least one media stream of the received SIP message, wherein the at least one media stream is directed to a terminal IP address; and

determining that the destination IP address matches the terminal IP address of the at least one media stream.

18. A system, comprising:

a first communication device associated with a first user;

a second communication device associated with a second user; and

a communication server including a secure call indicator mechanism configured to receive a Session Initiation Protocol (“

SIP”

) message, wherein the SIP message corresponds to a communication session between at least the first communication device and the second communication device;

apply a security check to the received SIP message, wherein the security check is configured to inspect at least one of a communication session management trust, a signaling link security protocol, a message destination address, a media, and a media stream destination and a security protocol, associated with the received SIP message;

determine, based on the security check, a security classification associated with the communication session; and

control a secure call indicator on at least one of the second communication device associated with the second user and the at least one first communication device associated with the first user, wherein the secure call indicator is configured to indicate the security classification associated with the communication session, wherein the security classification indicates to at least one of the first or second user whether the communication session is secure or unsecure.

19. The system of claim 18, wherein the communication server is at least one of a Back-to-Back User Agent (“

B2BUA”

) and a proxy, and wherein the at least one of the B2BUA and the proxy comprises rules used for inspection of the received SIP message.

20. The system of claim 18, wherein the secure call indicator includes at least one physical component configured to, upon control, produce at least one of light output, sound output, and tactile output.

21. The system of claim 18, wherein the secure call indicator is configured to provide a description of a security associated with the communication session, wherein the description includes information about the security check.