Securing uniform resource identifier information for multimedia calls

• US 8,948,057 B2
• Filed: 12/15/2009
• Issued: 02/03/2015
• Est. Priority Date: 12/15/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Ku, Bernard, Soo, Armstrong
• Primary Examiner(s): Nawaz, Asad
• Assistant Examiner(s): CHANG, KAI J
• Application Number:
  US12/638,388
• Publication Number:
  US 20110142035A1
• Time in Patent Office: 1,876 Days
• Field of Search: 370/260, 370352-356, 713/153, 713/154, 726/3, 726/4
• US Class Current: 370/260
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 28/0247 based on conditions of the access network or the infrastructure network central resource management H04W28/16
• CPC Class Codes: H04W 80/10 adapted for application session management, e.g. SIP [Session Initiation Protocol] connection management H04W76/00; arrangements for session management H04L67/14

Abstract

A session request from a first subscriber is received at a first network component of a packet-based network. The session request comprises a request to establish a communications session between the first subscriber and a second subscriber. In the event the session request originated in a trusted network, the first network component permits access to unique resource identifier (URI) information associated with the second subscriber for use in establishing the communications session via the packet-based network. In the event the session request did not originate in a trusted network and in response to determining a security configuration associated with the second subscriber allows the first subscriber to access the URI information under the circumstances, the first network component permits access to the URI information for use in establishing the communications session via the packet-based network. In response to determining the security configuration prohibits access to the URI information by the first subscriber under the circumstances, the first network component forwards the session request to a second network component so as to establish the communications session via a public switched telephone network.

Claims

1. A method comprising:

receiving, at a first network component of a packet-based network, a session request from a first subscriber, the session request comprising a request to establish a communications session between the first subscriber and a second subscriber via the packet-based network;

determining, by utilizing a processor that executes instructions stored in memory, whether the session request originated in a trusted network; and

in response to determining that the session request did not originate in the trusted network, selectively permitting access to unique resource identifier information associated with the second subscriber for use in establishing the communications session based on a security configuration in a profile associated with the second subscriber, wherein a scope of a query used in accessing the unique resource identifier information is limited based on the security configuration in the profile and is limited based on a type of the unique resource identifier information, and wherein the selectively permitting access to the unique resource identifier information is based on a security configuration identified time span during which communications sessions with the second subscriber are permitted and in response to a correspondence between the time span and a time of origination of the session request.

2. The method of claim 1, wherein selectively permitting access to unique resource identifier information further comprises:

selectively permitting access to the unique resource identifier information based on a security configuration identified group of subscribers permitted to establish a communication session with the second subscriber and in response to determining whether the group includes the first subscriber.

3. The method of claim 1, wherein selectively permitting access to unique resource identifier information further comprises:

selectively permitting access to the unique resource identifier information based on a security configuration identified permitted service type and in response to the service type of the communications session associated with the session request.

4. The method of claim 1, further comprising:

permitting access to the unique resource identifier information via the first network component responsive to determining the session request originated in the trusted network.

5. The method of claim 1, wherein determining whether the session request originated in the trusted network comprises determining whether the session request originated in a network of the second subscriber.

6. The method of claim 1, further comprising:

responsive to determining the first subscriber is not permitted to access the unique resource identifier information based on the security configuration, routing the session request to a second component of the packet-based network to establish the communications session via a public switched telephone network.

7. The method of claim 6, wherein:

the first network comprises an internet protocol multimedia subsystem;

the first network component comprises a communications session control function component; and

the second component comprises a border gateway control function component.

8. The method of claim 1, wherein:

the unique resource identifier information is stored at a server;

the session request includes an E.164 telephone number associated with the second subscriber; and

selectively permitting access to the unique resource identifier information via the first network component comprises selectively permitting the query to the server based on the E.164 telephone number.

9. A network component for implementation in a packet-based network, the network component comprising:

a memory that stores instructions;

a processor that executes the instructions to perform operations comprising;

receiving a session request from a first subscriber, the session request comprising a request to establish a communications session between the first subscriber and a second subscriber via the packet-based network;

determining whether the session request originated in a trusted network; and

in response to determining the session request did not originate in the trusted network, selectively permitting access to unique resource identifier information associated with the second subscriber for use in establishing the communications session based on a security configuration in a profile associated with the second subscriber, wherein a scope of a query used in accessing the unique resource identifier information is limited based on the security configuration in the profile and is limited based on a type of the unique resource identifier information, wherein the security configuration identifies a time span during which communications sessions with the second subscriber are permitted, and the network component selectively permits access to the unique resource identifier information responsive to a correspondence between time span and a time of origination of the session request.

10. The network component of claim 9, wherein:

the security configuration identifies a group of subscribers permitted to establish a communications session with the second subscriber; and

the network component selectively permits access to the unique resource identifier information responsive to determining whether the group includes the first subscriber.

11. The network component of claim 9, wherein:

the security configuration identifies a permitted service type; and

the network component selectively permits access to the unique resource identifier information responsive to the service type of the communications session associated with the session request.

12. The network component of claim 9, wherein the network component permits access to the unique resource identifier information responsive to determining the session request originated in the trusted network.

13. The network component of claim 12, wherein the network component determines whether the session request originated in the trusted network by determining whether the session request originated in a network of the second subscriber.

14. The network component of claim 13, further comprising a communications session control function component.

15. The network component of claim 9, wherein:

the unique resource identifier information is stored in association with a server;

the session request includes an E.164 telephone number associated with the second subscriber; and

the network component selectively permits access to the unique resource identifier information by selectively permitting the query to the server based on the E.164 telephone number.

16. A method comprising:

receiving, at a first network component of a packet-based network, a first session request from a first subscriber, the first session request comprising a request to establish a first communications session between the first subscriber and a second subscriber;

receiving, at the first network component, a second session request from a third subscriber, the second session request comprising a request to establish a second communications session between the third subscriber and the second subscriber;

permitting, by utilizing a processor that executes instructions stored in memory, access to unique resource identifier information associated with the second subscriber for use in establishing the first communications session in response to determining that the first subscriber is located in the same network as the second subscriber; and

responsive to determining that the third subscriber is not located in the same network as the second subscriber;

accessing a security configuration from a profile associated with the second subscriber from a second network component of the packet-based network; and

selectively permitting access to the unique resource identifier information associated with the second subscriber for use in establishing the second communications session based on the security configuration, wherein a scope of a query used in accessing the unique resource identifier information is limited based on the security configuration from the profile and is limited based on a type of the unique resource identifier information, and wherein the selectively permitting access to the unique resource identifier information is based on a security configuration identified time span during which communications sessions with the second subscriber are permitted and in response to a correspondence between the time span and a time of origination of the session request.

17. The method of claim 16, wherein selectively permitting access to the unique resource identifier information comprises:

permitting access to the unique resource identifier information in response to determining access is permitted based on the security configuration; and

denying access to the unique resource identifier information and initiating the second communications session via a public switched telephone network in response to determining access is prohibited based on the security configuration.