Mechanism to allow authentication of terminated SIP calls

• US 7,484,240 B2
• Filed: 07/13/2001
• Issued: 01/27/2009
• Est. Priority Date: 07/13/2001
• Status: Expired due to Fees

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Nokia Corporation
• Inventors: Le, Franck, Faccin, Stefano
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US09/905,463
• Publication Number:
  US 20030014668A1
• Time in Patent Office: 2,755 Days
• Field of Search: 713/201, 713/151, 713/160, 713/161, 713/168, 713/170, 379/93.32, 455/445, 455/432, 455/436, 455/435, 455/512, 726/4, 380/247, 380/248, 380/249, 709/227, 709/228, 709/229
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04M 7/00 Arrangements for interconnection between switching centres
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 48/08 Access restriction or access information delivery, e.g. discovery data delivery signalling during connection H04W76/00

Abstract

The invention proposes a method of performing authentication of a subscriber during a subscriber equipment terminated call, comprising the steps of sending a session invitation message (S4, S5) to the subscriber equipment, the session invitation message including authentication information (AuthData1), and performing an authentication procedure in the subscriber equipment by using the authentication information. The invention also proposes a corresponding network system, network control element and subscriber entity.

Claims

1. An apparatus, comprising:

a transmitter configured to send, during a subscriber equipment terminated call, a session invitation message to a subscriber equipment, the session invitation message comprising authentication information;

a determiner configured to determine whether a verification of the authentication is required;

a processor configured to,

if the verification is not required,

forward a scheduled result to a network control element by including the scheduled result into the session invitation message, and,

if the network control element has to perform the verification,

receive the scheduled result from another network control element, wherein the scheduled result is included in the session invitation message,

extract the scheduled result from the session invitation message,

forward the session invitation message without the scheduled result to the subscriber equipment,

verify an authentication result with the scheduled result, and

repeat the verification for a predetermined number of times, wherein different authentication information are used.

2. The apparatus according to claim 1, further comprising:

a receiver configured to receive a response message as a response to the session invitation message from the subscriber equipment, the response message including a result of an authentication procedure performed by the subscriber equipment.

3. The apparatus according to claim 2, further comprising:

a verifier configured to verify the authentication procedure result.

4. The apparatus according to claim 3, further comprising:

a forwarder configured to forward the response message of the subscriber equipment to an originating entity initiating the session invitation without the result of the authentication procedure in case of a positive verification.

5. The apparatus according to claim 3, further comprising:

a forwarder configured to forward a failure message to an originating entity initiating the session invitation in case of a negative verification.

6. The apparatus according to claim 1, wherein a session initiation protocol (SIP) protocol is adopted as a control protocol.

7. The apparatus according to claim 6, wherein the session invitation message is a SIP INVITE request comprising an authentication header field.

8. The apparatus according to claim 2, wherein the response message is a SIP response message comprising an authorization header field.

9. The apparatus according to claim 3, further comprising:

a server configured to serve an originating entity initiating the session invitation.

10. The apparatus according to claim 3, further comprising:

a server configured to serve the subscriber equipment.

11. The apparatus according to claim 1, further comprising:

a receiver configured to receive a response message from the subscriber equipment, the response message including the authentication result of the authentication procedure and network authentication information which is used by the subscriber equipment to perform an authentication of the network.

12. The apparatus according to claim 11, further comprising:

a determiner configured to determine a network authentication result in response to the network authentication information and to send the network authentication result to the subscriber equipment.

13. A method, comprising:

sending, during a subscriber equipment terminated call, a session invitation message from a network control element to the subscriber equipment, the session invitation message comprising authentication information;

determining, by the network control element, whether the network control element has to perform a verification of the authentication or not; and

,

in case the network control element does not have to perform the verification, forwarding a scheduled result to a second network control element by including the scheduled result into the session invitation message,

in case the network control element has to perform the verification,

receiving the scheduled result from another network control element, wherein the scheduled result is included in the session invitation message,

extracting the scheduled result from the session invitation message,

forwarding the session invitation message without the scheduled result to the subscriber equipment, and

verifying an authentication result with a scheduled result; and

repeating the verification for a predetermined number of times, wherein different authentication information are used.

14. The method according to claim 13, further comprising:

receiving a response message in the network control element as a response to the session invitation message from a subscriber equipment, the response message including a result of an authentication procedure performed by the subscriber equipment.

15. The method according to claim 14, further comprising:

verifying, by the network control element, the authentication procedure result.

16. The method according to claim 15, further comprising:

forwarding the response message of the subscriber equipment from the network control element to an originating entity initiating the session invitation without the result of the authentication procedure in case of a positive verification.

17. The method according to claim 15, further comprising:

forwarding a failure message from the network control element to an originating entity initiating the session invitation in case of a negative verification.

18. A computer program embodied on a computer-readable medium, the computer program comprising computer code for causing a processor to perform operations comprising:

sending a session invitation message from a network control element to the subscriber equipment, the session invitation message including authentication information;

determining, by the network control element, whether the network control element has to perform a verification of the authentication or not; and

,

in case the network control element does not have to perform the verification, forwarding a scheduled result to a second network control element by including the scheduled result into the session invitation message,

in case the network control element has to perform the verification,

receiving the scheduled result from another network control element, wherein the scheduled result is included in the session invitation message,

extracting the scheduled result from the session invitation message and forwarding the session invitation message without the scheduled result to the subscriber equipment,

verifying an authentication result with a scheduled result; and

repeating the verification for a predetermined number of times, wherein different authentication information are used.

19. An apparatus, comprising:

sending means for sending, during a subscriber equipment terminated call, a session invitation message to the subscriber equipment, the session invitation message including authentication information;

determining means for determining whether a verification of the authentication is required; and

,

transceiver means for forwarding a scheduled result to a second control network by including the scheduled result into the session invitation message, if the verification is not required,

wherein if the verification is required, the transceiver means is for receiving the scheduled result from another network control element, wherein the scheduled result is included in the session invitation message,

extracting means for extracting the scheduled result from the session invitation message and to forward the session invitation message without the scheduled result to the subscriber equipment,

verification means for verifying an authentication result with a scheduled result and

repeating means for repeating the verification for a predetermined number of times, wherein different authentication information are used.