Method and apparatus for token distribution in session for future polling or subscription

• US 7,764,945 B2
• Filed: 03/08/2006
• Issued: 07/27/2010
• Est. Priority Date: 03/08/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Jennings, Cullen F., Polk, James M.
• Primary Examiner(s): Kuntz; Curtis
• Assistant Examiner(s): El-Zoobi; Maria
• Application Number:
  US11/371,606
• Publication Number:
  US 20070211867A1
• Time in Patent Office: 1,602 Days
• Field of Search: 379 37- 52
• US Class Current: 455/404.1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A system and a method are disclosed for authenticating a subsequent callback from a public safety answering point (PSAP) in response to a user agent'"'"'s initial emergency call. In one embodiment, the user agent forwards a token to the PSAP during the initial call, and the PSAP returns the token during callback. The PSAP is authenticated when the forwarded and returned tokens match. In another embodiment, the user agent encrypts a token using a Public Key Infrastructure and forwards the encrypted token to the PSAP. The PSAP decrypts the token and, upon callback, includes a signed digital certificate based on the token. The user agent authenticates the PSAP when the decrypted digital certificate matches the originally sent token. In yet another embodiment, the user agent forwards a first token to the PSAP. Upon callback, the user agent forwards a second token to the PSAP. The PSAP performs a function on the pair of received tokens and forward the result to the user agent. The user agent performs the same function on the same tokens to obtain a local result. The user agent authenticates the PSAP when the local and forwarded results match.

Claims

1. In an electronic communication system for emergency 911 communications, a method of authenticating a party upon callback from the party, the method comprising:

sending a first communication to the party, the first communication initiating a first connection with the party and including a first token;

sending a second communication to the party, the second communication terminating the first connection with the party;

receiving a third communication from the party, the third communication initiating a second connection and including a second token; and

authenticating the party in accordance with a match between the first token of the first communication to the party and the second token of the third communication received from the party.

2. The method of claim 1, wherein the first and second tokens are random numbers.

3. The method of claim 1:

wherein the first token is encrypted before it is sent, the encryption performed in accordance with a public key of the party;

wherein the received second token is a signed second token determined in accordance with a private key of the party and further in accordance with a decryption of the sent first token; and

further comprising decrypting the received second token to yield the second token.

4. The method of claim 3, wherein the first and second tokens comprise a random number and a time.

5. In an electronic communication system for emergency 911 communications, a method of authenticating by a user agent a communication from a party, the method comprising:

sending a first communication to the party, the first communication initiating a first connection with the party and including a first token;

sending a second communication to the party, the second communication terminating the first connection with the party;

receiving a third communication from the party, the third communication initiating a second connection;

sending a fourth communication to the party, the fourth communication including a second token;

receiving a first result from the party, the first result determined by a function performed on the first and second tokens by the party;

performing the function on the first and second tokens by the user agent to produce a second result; and

authenticating the party when the first and second results match.

6. The method of claim 5, further comprising the step of sending a confirmation to the party when the first and second results match.

7. The method of claim 5, wherein the function is a hashed message authentication code function.

8. The method of claim 5, wherein the first token comprises a first random number and a time, and the second token comprises a second random number.

9. In an electronic communication system for emergency 911 communications, an apparatus for authenticating a party upon callback form the party, the apparatus comprising:

a transmitter module configured to;

send a first communication to the party, the first communication initiating a first connection with the party and including a first token, and

send a second communication to the party, the second communication terminating the first connection with the party;

a receiver module, configured to receive a third communication from the party, the third communication initiating a second connection and including a second token; and

a control module, configured to authenticate the party when the first and second tokens match.

10. The apparatus of claim 9, wherein the first and second tokens are random numbers.

11. The apparatus of claim 9, wherein the control module is further configured to:

encrypt the first token before it is sent, the encryption performed in accordance with a public key of the party, and

decrypt the received second token to yield the second token, the received second token being a signed second token determined in accordance with a private key of the party and further in accordance with a decryption of the sent first token.

12. The apparatus of claim 11, wherein the first and second tokens comprise a random number and a time.

13. In an electronic communication system for emergency 911 communications, an apparatus for authenticating a communication from a party, the apparatus comprising:

a transmitter module configured to;

send a first communication to the party, the first communication initiating a first connection with the party and including a first token,

send a second communication to the party, the second communication terminating the first connection with the party, and

send a third communication to the party, the third communication including a second token;

a receiver module, configured to;

receive a fourth communication from the party, the fourth communication initiating a second connection with the party;

receive a fifth communication from the party, the fifth communication including a first result determined by a function operating on the first and second tokens; and

a control module, configured to;

perform the function on the first and second tokens to produce a second result, and

authenticate the party in response to the first and second results matching.

14. The apparatus of claim 13, wherein the transmitter module is further configured to send a confirmation to the party when the first and second results match.

15. The apparatus of claim 13, wherein the function is a hashed message authentication code function.

16. The apparatus of claim 13, wherein the first token comprises a first random number and a time, and the second token comprises a second random number.

17. In an electronic communication system for emergency 911 communications, an apparatus for authenticating a party, the apparatus comprising:

means for sending a first communication to the party, the first communication initiating a first connection with the party and including a first token;

means for sending a second communication to the party, the second communication terminating the first connection with the party;

means for receiving a third communication from the party, the third communication initiating a second connection and including a second token; and

means for authenticating the party when the first and second tokens match.

18. The apparatus of claim 17, wherein the first and second tokens are random numbers.

19. The apparatus of claim 17, further comprising:

means for encrypting the first token before it is sent, the encryption performed in accordance with a public key of the party;

means for decrypting the received second token, which is a signed second token determined in accordance with a private key of the party and further in accordance with a decryption of the sent first token; and

means for decrypting the received second token to yield the second token.

20. The apparatus of claim 19, wherein the first and second tokens comprise a random number and a time.

21. In an electronic communication system for emergency 911 communications, an apparatus for authenticating a party, the apparatus comprising:

means for sending a first communication to the party, the first communication initiating a first connection with the party and including a first token;

means for sending a second communication to the party, the second communication terminating the first connection with the party;

means for receiving a third communication from the party, the third communication initiating a second connection;

means for sending a fourth communication to the party, the fourth communication including a second token;

means for receiving a first result from the party, the first result determined by applying a function to the first and second tokens;

means for performing the function on the first and second tokens to produce a second result; and

means for authenticating the party when the first and second results match.

22. The apparatus of claim 21, further comprising means for sending a confirmation to the party when the first and second results match.

23. The apparatus of claim 21, wherein the function is a hashed message authentication code function.

24. The apparatus of claim 21, wherein the first token comprises a first random number and a time, and the second token comprises a second random number.