Method and system for registering and automatically retrieving digital-certificates in voice over internet protocol (VOIP) communications

• US 6,842,449 B2
• Filed: 07/09/2002
• Issued: 01/11/2005
• Est. Priority Date: 07/09/2002
• Status: Expired due to Fees

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: VeriSign, Inc.
• Inventors: Hardjono, Thomas
• Primary Examiner(s): NGUYEN, BRIAN D
• Application Number:
  US10/190,849
• Publication Number:
  US 20040008666A1
• Time in Patent Office: 917 Days
• Field of Search: 370/352, 370/389, 370/392, 370/395.5, 370/395.52, 370/395.2, 370/401, 370/465, 370/466, 709/203, 709/227, 709/230, 709/217, 709/218, 709/219, 713/151, 713/156, 713/180, 713/200, 713/201, 713/155, 379/88.13, 379/88.17
• US Class Current: 370/352
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment

Abstract

A method and system for registering and automatically retrieving digital-certificates in voice over Internet protocol (VOIP) communications. In accordance with an embodiment of the present invention, the method includes receiving a digital voice call setup request with an associated caller certificate from a caller and determining a location of a called party identified in the digital voice call setup request. The method also includes transmitting the digital voice call setup request with the caller certificate to the called party and receiving a called party acceptance message. The method further includes verifying the called party acceptance message and transmitting the called party acceptance message and a called party certificate to the caller.

Claims

1. A method of communicating over a network comprising:

receiving a digital voice call setup request associated with a caller certificate from a caller;

determining a location of a called party identified in said digital voice call setup request by;

transmitting a request to a location server for said location, said request including an identifier of the called party and a signature of the caller; and

receiving a location response from said location server, said location response including said location for said called party called party certificate and said caller certificate;

transmitting said digital voice call setup request with said caller certificate to said called party;

receiving a called party acceptance message;

verifying said called party acceptance message; and

transmitting said called party acceptance message and said called party certificate to said caller.

2. The method of claim 1 wherein said receiving a digital voice call setup request comprises:

receiving a voice over Internet protocol (VOIP) call setup request that is associated with said caller certificate from said caller.

3. The method of claim 1 wherein said digital voice call setup request comprises:

a caller Internet protocol (IP) address; and

a called party IP address.

4. The method of claim 1 wherein said digital voice call setup is associated with a caller signature.

5. The method of claim 1 wherein said location response comprises a signature of said location server.

6. The method of claim 1 wherein said digital voice call setup request further comprises a signature of said caller.

7. The method of claim 1 wherein said called party acceptance message comprises a called party signature.

8. The method of claim 1 wherein said verifying said called party acceptance message comprises at least one of:

verifying said called party certificate attached to said acceptance message; and

verifying a previously received called party certificate.

9. The method of claim 8 wherein said previously received called party certificate was received with said location for said called party.

10. The method of claim 1 further comprising:

transmitting a called party signature to said caller.

11. The method of claim 1 further comprising registering said caller and said called party with a digital voice communications system on the network.

12. The method of claim 11 wherein registering said caller and said called party comprises receiving:

a user name;

a user IP address;

a user public-key certificate; and

a user digital signature.

13. The method of claim 12, further comprising:

verifying said user name is the same as a user name in said user public-key certificate;

verifying said user digital signature; and

verifying that said user public-key certificate is valid.

14. The method of claim 13, further comprising:

binding said received user name to said user IP address; and

binding said validated user public-key certificate to said bound user name and user IP address.

15. The method of claim 14, comprising:

returning an OK message if the caller registration is successful.

16. The method of claim 11, wherein said registering occurs prior to receipt of said digital voice call setup request.

17. The method of claim 16 wherein said registering comprises:

transmitting a separate digital voice call setup request with said caller certificate to said called party;

receiving a separate acceptance message from said called party;

verifying said separate called party acceptance message; and

transmitting said separate called party acceptance message and a separate called party certificate to said caller.

18. The method of claim 11, wherein said registering occurs after said digital voice call setup request is received.

19. A medium storing instructions adapted to be executed by a processor, when executed, the instructions to configure the processor to:

receive a digital voice call setup request being associated with a caller certificate from a caller;

determine a location of a called party identified in said-digital voice call setup request by;

transmit a request to a location server for said location, said request including an identifier of the called party and a signature; and

receive a location response from said location server, said location response including said location for said called party, a called party certificate and said caller certificate;

transmit said digital voice call setup request with said caller certificate to said called party;

receive a called party acceptance message;

verify said called party acceptance message; and

transmit said called party acceptance message and said called party certificate to said caller.

20. The medium as defined in claim 19 wherein said receive a digital voice call setup request configures the processor to:

receive a voice over Internet protocol (VOIP) call setup request that is associated with said caller certificate from said caller.

21. The medium as defined in claim 19 wherein said receive a digital voice call setup request configures the processor to:

receive said digital voice call setup request from a caller Internet protocol (IP) address, said digital voice call setup request having said caller certificate associated therewith and being directed to a called party IP address.

22. The medium as defined in claim 19 wherein said receive a digital voice call setup request further configures the processor to:

receive said digital voice call setup request with a caller signature.

23. The medium as defined in claim 19 wherein said receive said location response further configures the processor to receive a signature of said location server.

24. The medium as defined in claim 19 wherein said transmit said digital voice call setup request configures the processor to:

transmit said digital voice call setup request with a signature.

25. The medium as defined in claim 19 wherein said receive said called party acceptance message configures the processor to receive a called party signature with said called party acceptance message.

26. The medium as defined in claim 19 wherein said verify said called party acceptance message configures the processor to verify a called party signature received with said called party acceptance message using one of:

said called party certificate attached to said acceptance message; and

a previously received called party certificate.

27. The medium as defined in claim 26 wherein said previously received called party certificate was received with said location for said called party.

28. The medium as defined in claim 19 wherein the processor is further configured to:

transmit a called party signature to said caller.

29. The medium as defined in claim 19 wherein the processor is further configured to:

register said caller and said called party with a digital voice communications system.

30. The medium as defined in claim 29 wherein said register said caller and said called party configures the processor to:

receive a user name;

receive a user IP address;

receive a user public-key certificate; and

receive a user digital signature.

31. The medium as defined in claim 30 wherein said processor is further configured to:

verify said user name is the same as a user name in said user public-key certificate;

verify said user digital signature; and

verify that said user public-key certificate is valid.

32. The medium as defined in claim 31 wherein said processor is further configured to:

bind said received user name to said user IP address; and

bind said validated user public-key certificate to said bound user name and user IP address.

33. The medium as defined in claim 32 wherein said processor is further configured to:

return an OK message, if the caller registration is successful.

34. A system for providing digital certificate registration and automatic certificate retrieval in a voice over Internet protocol (VOIP) communications system, said system comprising:

a VOIP gateway, said VOIP gateway to;

receive a digital voice call setup request that is associated with a caller certificate from a caller;

determine a location of a called party identified in said digital voice call setup request by;

transmit a request to a location server for said location, said request including an identifier of the called party and a signature; and

receive a location response from said location server, said location response including said location for said called party, a called party certificate and said caller certificate;

transmit said digital voice call setup request with said caller certificate to said called party;

receive a called party acceptance message;

verify said called party acceptance message; and

transmit said called party acceptance message and said called party certificate to said caller.

35. The system as defined in claim 34 wherein said VOIP gateway comprises:

a session initiation protocol (SIP) proxy server in communication with said VOIP communication system, said SIP proxy server to enable communication between said caller and said called party.

36. The system as defined in claim 35 wherein said VOIP gateway further comprises at least one of:

a location server in communication with said SIP proxy server;

at least one alternative proxy server in communication with said SIP proxy server;

a certificate lookup facility, in communication with said SIP proxy server; and

an online certificate status protocol (OCSP) responder in communication with said SIP proxy server.

37. The system as defined in claim 35 wherein said VOIP gateway further comprises:

a location server in communication with said SIP proxy server;

a location database in communication with said location server, said location database including a current location for said called party, said called party certificate and said caller certificate; and

a certificate authority in communication with said location server and said SIP proxy server.

38. An apparatus for establishing communications over a network, comprising:

a processor; and

a memory coupled to said processor, said memory storing call setup instructions to be executed by said processor to perform steps including;

receiving a digital voice call setup request being associated with a caller certificate from a caller;

determining a location of a called party identified in said digital voice call setup request by;

transmitting a request to a location server for said location, said request including an identifier of the called party and a signature of the caller; and

receiving a location response from said location server, said location response including said location for said called party, a called party certificate and said caller certificate;

transmitting said digital voice call setup request with said caller certificate to said called party;

receiving a called party acceptance message;

verifying said called party acceptance message; and

transmitting said called party acceptance message and said called party certificate to said caller.

39. A system for providing digital certificate registration and automatic certificate retrieval in a voice over Internet protocol (VOIP) communications system, said system comprising:

a VOIP gateway, said VOIP gateway including;

means for receiving a digital voice call setup request being associated with a caller certificate from a caller;

means for determining a location of a called party identified in said digital voice call setup request, said means for determining including;

means for transmitting a request to a location server for said location, said request including an identifier of the called party and a signature; and

means for receiving a location response from said location server, said location response including said location for said called party, a called party certificate and said caller certificate;

means for transmitting said digital voice call setup request with said caller certificate to said called party;

means for receiving a called party acceptance message;

means for verifying said called party acceptance message; and

means for transmitting said called party acceptance message and said called party certificate to said caller.

40. An apparatus for establishing communications over a network, comprising:

means for processing; and

means for storing coupled to said processing means, said storing means storing call setup instructions to be executed by said processing means to perform steps including;

receiving a digital voice call setup request being associated with a caller certificate from a caller;

determining a location of a called party identified in said digital voice call setup request by;

transmitting a request to a location server for said location, said request including an identifier of the called party and a signature; and

receiving a location response from said location server, said location response including said location for said called party, a called party certificate and said caller certificate;

transmitting said digital voice call setup request with said caller certificate to said called party;

receiving a called party acceptance message;

verifying said called party acceptance message; and

transmitting said called party acceptance message and said called party certificate to said caller.