System and method for applying authentication and security policies in a SIP environment

• US 8,839,364 B2
• Filed: 04/05/2012
• Issued: 09/16/2014
• Est. Priority Date: 04/05/2011
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Kramarenko, Valentina Iqorevna, Rozinov, Boris, John Chuan, Mee Tchin Jane, Pang, Swee Tuan
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US13/440,070
• Publication Number:
  US 20120260310A1
• Time in Patent Office: 894 Days
• Field of Search: 726/3
• US Class Current: 726/3
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 2101/385 Uniform resource identifier for session initiation protocol [SIP URI]
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/4535 using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/143 Termination or inactivation of sessions, e.g. event-controlled end of session
• CPC Class Codes: H04L 67/147 Signalling methods or messages providing extensions to protocols defined by standardisation

Abstract

The present disclosure provides a system and method for applying authentication and security policies in a SIP environment. In accordance with one embodiment, there is provided a method for use on a SIP server, comprising: establishing a persistent connection with a user agent (UA); initiating an idle connection timeout countdown timer; performing authentication of an initial REGISTER request using a first level of authentication; and terminating the persistent connection when the initial REGISTER request is not validated before expiry of the idle connection timeout countdown timer.

Claims

1. A method for authenticating requests by a SIP (Session Initiation Protocol) server, comprising:

establishing a persistent connection between a user agent (UA) and the SIP server;

initiating an idle connection timeout countdown timer subsequent to establishing the persistent connection;

initiating authentication of an initial REGISTER request using a first level of authentication subsequent to initiating the idle connection timeout countdown timer;

terminating the persistent connection when the initial REGISTER request is not authenticated before expiry of the idle connection timeout countdown timer; and

cancelling the idle connection timeout countdown timer when the initial REGISTER request is authenticated before expiry of the idle connection timeout countdown timer.

2. The method of claim 1, further comprising:

receiving a subsequent request from the UA over the persistent connection;

performing authentication of the subsequent request using a second level of authentication, wherein the second level of authentication is lower than the first level of authentication.

3. The method of claim 2, wherein the second level of authentication comprises minor validation.

4. The method of claim 3, wherein the minor validation comprises validating the user name, password and/or parameters in the subsequent request.

5. The method of claim 2, wherein the second level of authentication comprises no authentication.

6. The method of claim 2 further comprising:

processing the subsequent request when the subsequent request is authenticated.

7. The method of claim 6, further comprising:

rejecting the subsequent request when the subsequent request is not authenticated.

8. The method of claim 1, further comprising:

storing a new binding for the UA in a registration repository when the initial REGISTER request is authenticated.

9. The method of claim 8, further comprising:

initiating a keep alive procedure for the persistent connection.

10. The method of claim 8 further comprising:

removing the binding when the persistent connection is dropped.

11. A method for authenticating requests by a SIP (Session Initiation Protocol) server, comprising:

establishing a persistent connection between a user agent (UA) and the SIP server;

initiating an idle connection timeout countdown timer subsequent to establishing the persistent connection;

initiating authentication of an initial REGISTER request using a first level of authentication subsequent to initiating the idle connection timeout countdown timer;

terminating the persistent connection when an initial REGISTER request is not authenticated before expiry of the idle connection timeout countdown timer; and

storing a new binding for the UA in a registration repository when the initial REGISTER request is authenticated and removing the binding when the persistent connection is dropped.

12. The method of claim 11, further comprising:

receiving a subsequent request from the UA over the persistent connection;

performing authentication of the subsequent request using a second level of authentication, wherein the second level of authentication is lower than the first level of authentication.

13. The method of claim 12, wherein the second level of authentication comprises minor validation.

14. The method of claim 13, wherein the minor validation comprises validating the user name, password and/or parameters in the subsequent request.

15. The method of claim 12, wherein the second level of authentication comprises no authentication.

16. The method of claim 12 further comprising:

processing the subsequent request when the subsequent request is authenticated.

17. The method of claim 16, further comprising:

rejecting the subsequent request when the subsequent request is not authenticated.

18. A SIP (Session Initiation Protocol) server, comprising:

a processor configured to establish a persistent connection between a user agent (UA) and the SIP server, initiate an idle connection timeout countdown timer subsequent to establishing the persistent connection, initiate authentication of an initial REGISTER request using a first level of authentication subsequent to initiating the idle connection timeout countdown timer, terminate the persistent connection when the initial REGISTER request is not authenticated before expiry of the idle connection timeout countdown timer, and cancel the idle connection timeout countdown timer when the initial REGISTER request is authenticated before expiry of the idle connection timeout countdown timer.

19. The SIP server of claim 18, wherein the SIP server is a SIP registration server.

20. A method for authenticating requests by a SIP (Session Initiation Protocol) server, comprising:

establishing a persistent connection between a user agent (UA) and the SIP server;

initiating an idle connection timeout countdown timer subsequent to establishing the persistent connection;

initiating authentication of an initial REGISTER request using a first level of authentication subsequent to initiating the idle connection timeout countdown timer;

terminating the persistent connection when an initial REGISTER request is not authenticated before expiry of the idle connection timeout countdown timer;

storing a new binding for the UA in a registration repository when the initial REGISTER request is authenticated; and

initiating a keep alive procedure for the persistent connection.