Apparatus, Method, System and Program for Secure Communication

• US 20110004757A1
• Filed: 04/07/2008
• Published: 01/06/2011
• Est. Priority Date: 04/07/2008
• Status: Active Grant

• Current Assignee: HMD Global Oy
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: Schneider, Peter, Horn, Guenther
• Granted Patent: US 8,924,722 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819

Abstract

Embodiments provide an apparatus, method, product and storage medium for secure communication, wherein a message is sent over a secure signalling path to a recipient, the message including a value indicating a key for encrypting or decrypting information for secure communication, or a key derivation value for deriving a key. The message further includes an indication indicating the type of usage of the value. The receiver of the message may return a message which also includes a key or key derivation value and an indication indicating the type of key or type of usage of the value.

Claims

1. A method for secure communication which comprises:

sending a message over a secure signalling path to a recipient, the message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the message further comprising an indication indicating the type of usage of the value.

3. The method of claim 1, wherein the indication indicates at least one of:

the value is to be used as key for protecting media traffic to be sent by the sender of the message, the value is to be used as key for protecting media traffic to be received by the sender of the message, the value is to be used as input to a key derivation function to derive a key for protecting media traffic to be sent by the sender of the message or to be received by the sender of the message, the value is to be used as input to a key derivation function to derive keys for protecting media in sending and receiving directions, no value is provided.

4. A method in accordance with claim 1, wherein a receiver of the message returns a return message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the return message further comprising an indication indicating the type of usage of the value comprised in the return message.

5. A method in accordance with claim 1, wherein a sender of the message receives a return message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the return message further comprising an indication indicating the type of usage of the value comprised in the return message.

6. A method in accordance with claim 1, wherein the indication comprised in the return message indicates at least one of:

the value is to be used as master key for protecting media traffic to be sent by the sender of the return message,

the value is to be used as master key for protecting media traffic to be received by the sender of the return message,

the value is to be used as input to a key derivation function to derive a master key for protecting media traffic to be sent by the sender of the return message or to be received by the sender of the return message,

the value is to be used as input to a key derivation function to derive master keys for protecting media in sending and receiving directions, no value is provided.

7. A method in accordance with claim 1, wherein

a first message is sent or received which comprises an indication indicating that the value is to be used as an input to a key derivation function to derive a key, and a second message which is a return message, is received or sent which return message comprises an indication indicating that the value transmitted in the return message is to be used as an additional input to the key derivation function, whereby the key derivation function is used to derive two different keys to protect traffic in both directions;

or

a first message is sent or received which comprises an indication indicating that the value transmitted in this message is to be used as an input to a key derivation function to derive a key, and a second message which is a return message is received or sent which comprises an indication indicating that the value transmitted in the second, return message is to be used on the one hand as an additional input to the key derivation function to derive a key to protect traffic sent to the sender of the second, return message, and on the other hand as a key to protect traffic sent by the sender of the return message, or

a first message is sent or received which comprises an indication indicating that no value is transmitted in this message, and a second, return message is received or sent which comprises an indication indicating that a value transmitted in the return message is to be used as an input to a key derivation function to derive two different keys to protect traffic in both directions, or

a first message is sent or received which comprises an indication indicating that the value transmitted in this message is to be used as an input to a key derivation function to derive keys to protect traffic in both directions, and a second, return message is received or sent which comprises an indication indicating that a value transmitted in the second, return message is to be used as a key to protect traffic sent by the sender of the second, return message, wherein this key replaces the previously derived key for this direction,

a first message is sent or received which comprises an indication indicating that the value transmitted in the first message is to be used as a key to protect traffic to be sent to the sender of the first message, and a second message which is a return message is received or sent which comprises an indication indicating that a value transmitted in the second, return message is to be used as an input to a key derivation function to derive keys to protect traffic in both directions, wherein one of these keys replaces the key transmitted in the first message.

8. Method according to claim 1, wherein at least one of early media, forking, retargeting, and multicast is supported in the secure communication.

9. Method according to claim 1, wherein the method is implemented in an Internet protocol based multimedia environment using a session initiation protocol.

10. Method according to claim 1, wherein a key for receiving early media provided in a signaling message or derived from a value provided in a signaling message is overwritten later by another key provided in an answering signaling message or derived from a value provided in an answering signaling message.

11. Method according to claim 1, wherein session description protocol security descriptions are used without change of protocol syntax.

23. Computer program product having computer-executable components configured to carry out or implement, when run on the computer, the features mentioned in claim 1.

24. Computer program product according to claim 23, wherein the product is a computer readable storage medium.

2. A method for secure communication, comprising receiving a message over a secure signalling path from a sender, the message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the message further comprising an indication indicating the type of usage of the value.

12. An apparatus for secure communication, comprising:

a sender configured to send a message over a secure signalling path to a recipient, the message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the message further comprising an indication indicating the type of usage of the value.

14. The apparatus of claim 12, wherein the indication indicates at least one of:

the value is to be used as master key for protecting media traffic to be sent by the sender of the message,

the value is to be used as master key for protecting media traffic to be received by the sender of the message,

the value is to be used as input to a key derivation function to derive a master key for protecting media traffic received

to be sent by the sender of the message or to be received by the sender of the message,

the value is to be used as input to a key derivation function to derive master keys for protecting media in sending and receiving directions, no value is provided.

15. An apparatus in accordance with claim 12, wherein a receiver of the message is configured to return a return message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the return message further comprising an indication indicating the type of usage of the value comprised in the return message.

16. An apparatus in accordance with claim 12, wherein a sender of the message is configured to receive a return message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the return message further comprising an indication indicating the type of usage of the value comprised in the return message.

17. An apparatus in accordance with claim 12, wherein the indication comprised in the return message indicates at least one of:

the value is to be used as master key for protecting media traffic to be sent by the sender of the return message, the value is to be used as master key for protecting media traffic to be received by the sender of the return message, the value is to be used as input to a key derivation function to derive a master key for protecting media traffic to be sent by the sender of the return message or to be received by the sender of the return message, the value is to be used as input to a key derivation function to derive master keys for protecting media in sending and receiving directions, no value is provided.

18. An apparatus in accordance with claim 12, wherein the apparatus is configured to send or receive a first message which comprises an indication indicating that the value is to be used as an input to a key derivation function to derive a key, and to receive or send a second message which is a return message, which return message comprises an indication indicating that the value transmitted in the return message is to be used as an additional input to the key derivation function, whereby the key derivation function is used to derive two different keys to protect traffic in both directions;

or the apparatus is configured to send or receive a first message which comprises an indication indicating that the value transmitted in this message is to be used as an input to a key derivation function to derive a key, and to receive or send a second message which is a return message which comprises an indication indicating that the value transmitted in the second return message is to be used on the one hand as an additional input to the key derivation function to derive a key to protect traffic received by the sender of the return message, and on the other hand as a key to protect traffic received from the sender of the return message, or the apparatus is configured to send or receive a first message which comprises an indication indicating that no value is transmitted in this message, and to receive or send a second, return message which comprises an indication indicating that a value transmitted in the return message is to be used as an input to a key derivation function to derive two different keys to protect traffic in both directions, or the apparatus is configured to send or receive a first message which comprises an indication indicating that the value transmitted in this message is to be used as an input to a key derivation function to derive keys to protect traffic in both directions, and to receive or send a second, return message which comprises an indication indicating that a value transmitted in the second, return message is to be used as a key to protect traffic sent by the sender of the second, return message, wherein this key is configured to replace the previously derived key for this direction, or the apparatus is configured to send or receive a first message which comprises an indication indicating that the value transmitted in the first message is to be used as a key to protect traffic to be sent to the sender of the first message, and to receive or send a second message which is a return message which comprises an indication indicating that a value transmitted in the second, return message is to be used as an input to a key derivation function to derive keys to protect traffic in both directions, wherein one of these keys is configured to replace the key transmitted in the first message.

19. An apparatus according to claim 12, wherein the apparatus is configured to support at least one of early media, forking, retargeting, and multicast in the secure communication.

20. An apparatus according to claim 12, wherein the apparatus is configured to be used in an Internet protocol based multimedia environment using a session initiation protocol.

21. An apparatus according to claim 12, wherein the apparatus is configured to overwrite a key for receiving early media provided in a signaling message or derived from a value provided in a signaling message, by another key provided in an answering signaling message or derived from a value provided in an answering signaling message.

22. Apparatus according to claim 12, wherein the apparatus is at least one of a terminal, mobile station, user equipment, module, chipset.

13. An apparatus for secure communication, comprising a receiver configured to receive a message over a secure signalling path from a sender, the message comprising a value indicating a key for protecting information for secure communication, or a key derivation value for deriving at least one key for protecting information for secure communication, the message further comprising an indication indicating the type of usage of the value.