TWI906082B - System and method for voip communication - Google Patents

Abstract

A system and a method for VoIP communication are provided, which utilize blockchain decentralized storage technology to achieve decentralized information sharing. The enterprises keep private keys by themselves for decryption. When SIP VoIP communication takes place between enterprises, the caller first sends a one-time password request (encrypted with the public key of the called enterprise) to the called enterprise, and the called enterprise replies with a one-time password (encrypted with the public key of the caller ) required for SIP call authentication to the caller. The aforementioned process combined with the time-sensitive username can be effectively used for SIP authentication to authenticate the called enterprise, thus ensuring that there will be no problem of impersonation.

Description

VoIP Communication Systems and Methods

This invention relates to a Voice over Internet Protocol (VoIP) communication system and method. It stores inter-enterprise communication information via blockchain and uses a public-private key encryption/decryption mechanism to ensure the identity of enterprises and the password used for transmitting one-time Session Initiation Protocol (SIP) communications. Furthermore, it significantly enhances VoIP call security by utilizing time-sensitive usernames, similar to those sent via inter-enterprise email, to conduct SIP VoIP calls using dynamic usernames and passwords.

With the widespread adoption of Internet Protocol (IP) networks, VoIP has become one of the communication channels between enterprises. However, the open nature of the internet makes VoIP communication fraught with risks such as unauthorized calls and impersonation. Furthermore, traditional methods such as changing SIP ports, account and password authentication, IP address locking, and credential verification are no longer sufficient to prevent malicious hacking.

While various technologies exist to improve VoIP security, current technologies are still imperfect. For example, they often fail to consider the risk of hackers imitating and spoofing SIP packets, resulting in insufficient security for verifying the called party's identity and inadequate authentication integrity. Alternatively, they may merely add a signature verification mechanism to the SIP communication process without considering the security enhancements of the SIP authentication process itself. If signature verification is compromised, impersonation communication could occur.

It is evident that the aforementioned practices still have many shortcomings and are not a sound design, thus requiring urgent improvement.

The rise of VoIP communication has increased the risk of enterprise communications being exposed to the public internet, creating a demand for secure communication. While enterprises currently employ firewalls to monitor network traffic and prevent unauthorized access and attacks, incidents of unauthorized and spoofed calls continue to occur. Therefore, VoIP communication security, particularly at the SIP signal layer, needs further enhancement in authentication to prevent illegal and malicious VoIP calls.

Therefore, the purpose of this invention is to establish a VoIP communication system and method that utilizes blockchain distributed storage technology to achieve decentralized information sharing. Combined with public and private key encryption and decryption to verify the other party's identity and obtain a one-time password for SIP call authentication, along with a time-limited username, this effectively leverages existing SIP call authentication mechanisms for VoIP communication, ensuring that there are no impersonation issues between enterprises.

In one implementation, time-sensitive usernames are used in conjunction with emails exchanged between businesses, effectively leveraging existing SIP call authentication mechanisms for VoIP communication.

One VoIP communication system and method aimed at achieving the aforementioned objectives involves strengthening identity verification and authorization between enterprise users during corporate communications. This is achieved by utilizing the enterprise's public and private keys to implement an identity verification mechanism, requiring a one-time password, and combining it with a time-limited username (two-factor authentication) to ensure that only authorized enterprise users can access the system, thereby preventing unauthorized access.

In one implementation, a time-sensitive username is sent via email to ensure that only authorized enterprise users can access the site.

According to a first aspect of the present invention, the present invention provides a VoIP communication system for conducting SIP-based VoIP communication, and is located at the calling end of the VoIP communication. The VoIP communication system includes a one-time password processing unit, a transceiver unit, and a call and authentication unit. The one-time password processing unit is used to send a one-time password request to the called end of the VoIP communication, and then receive a response to the one-time password request from the called end. The one-time password request is encrypted with the called end's public key, and the response includes a call identifier and a one-time password, and the response is encrypted with the calling end's public key. The transceiver unit is used to receive the username. The call and authentication unit is used to make outbound SIP calls to the called party, and then provides the call identifier, the one-time password, and the username to authenticate the SIP call.

In one embodiment, the transceiver unit is an email transceiver unit, which is used to receive emails from a mail server and then obtain the username from the emails.

This invention also provides a VoIP communication method for conducting SIP-based VoIP communication, performed by the calling end of the VoIP communication. The VoIP communication method includes: sending a one-time password request to the called end of the VoIP communication, wherein the one-time password request is encrypted with the called end's public key; receiving a response from the called end to the one-time password request, wherein the response includes a call identifier and a one-time password, and the response is encrypted with the calling end's public key; receiving a username; making an outgoing SIP call to the called end; and providing the call identifier, the one-time password, and the username to authenticate the SIP call.

In one embodiment, the email is received from a mail server, and the username is then obtained from that email.

The aforementioned system further includes a blockchain storage unit for storing the caller's and called party's preamble, Internet Protocol address, domain name, and public key on the blockchain.

In one embodiment, this is used to store the dialing preamble, Internet Protocol address, domain name, email address, and public key of the calling and called parties on the blockchain.

The aforementioned system further includes a blockchain access unit for querying the blockchain storage unit to obtain the called party's public key from the blockchain. The one-time password processing unit encrypts the one-time password request using the called party's public key before sending it, and decrypts the response using the calling party's private key after receiving the response.

In the aforementioned system and method, the username is sent from the called party to the calling party via email and email encryption technology.

In the aforementioned system and method, the username has a valid time period, and the username can only be authenticated via the SIP call within that valid time period.

In the aforementioned system and method, the called party sends the username to the calling party well before the start of the effective time period.

In one embodiment, an email containing the user's name is sent to the calling party.

According to a second aspect of the present invention, the present invention provides a VoIP communication system for conducting SIP-based VoIP communication, and is located at the called end of the VoIP communication. The VoIP communication system includes a one-time password processing unit, a transceiver unit, and a call and authentication unit. The one-time password processing unit is used to receive a one-time password request from the calling end of the VoIP communication, generate a one-time password corresponding to the call identification code in the one-time password request, and then send a response to the one-time password request to the calling end, wherein the response includes the call identification code and the one-time password, and the response is encrypted with the calling end's public key. The transceiver unit is used to send the username to the calling end. This call and authentication unit waits for a SIP call initiated by the calling party and then authenticates the SIP call based on the call identifier, the one-time password, and the username.

In one embodiment, the transceiver unit is an email transceiver unit, which is used to send an email containing a username to the calling client via a mail server.

This invention also provides a VoIP communication method for conducting SIP-based VoIP communication, performed by the called end of the VoIP communication. The VoIP communication method includes: receiving a one-time password request from the calling end of the VoIP communication; generating a one-time password corresponding to a call identifier in the one-time password request; sending a response to the one-time password request to the calling end, wherein the response includes the call identifier and the one-time password, and the response is encrypted with the calling end's public key; sending a username to the calling end; waiting for a SIP call initiated by the calling end; and authenticating the SIP call based on the call identifier, the one-time password, and the username.

In one embodiment, an email containing the user's name is sent to the calling client via a mail server.

The aforementioned system further includes a blockchain storage unit and a blockchain access unit. The blockchain storage unit is used to store the dialing preamble, Internet Protocol address, domain name, and public key of the calling and called parties on the blockchain.

In one embodiment, this is used to store the dialing preamble, Internet Protocol address, domain name, email address, and public key of the calling and called parties on the blockchain.

Furthermore, the blockchain access unit queries the blockchain storage unit to obtain the calling party's public key from the blockchain. The one-time password processing unit, upon receiving the one-time password request, decrypts the request using the called party's private key, and encrypts the response using the calling party's public key before sending it.

This invention utilizes blockchain networks to store information needed for inter-enterprise communication, eliminating the need for centralized database management and maintenance. In this technical solution, each enterprise stores its own private key and accesses the blockchain to obtain public keys from other enterprises. A public-key encryption and private-key decryption mechanism, along with call identification codes, one-time passwords, and time-limited usernames, enhances the security of SIP authentication, effectively preventing unauthorized and impersonated calls.

In one implementation, time-sensitive usernames transmitted via email are used to further enhance the security of SIP authentication.

110: Cross-enterprise certified VoIP communication module

111: One-time password processing unit

112: Blockchain Access Unit

113: Call and Authentication Unit

114: Receiving and Dispatching Unit

115: Blockchain Storage Unit

116: Mail Server

117: External Enterprises

201~209, 301~311: Steps

Figure 1 is an architecture diagram of a VoIP communication system according to the present invention.

Figure 2 is a flowchart of the enterprise calling party process according to a VoIP communication method of this invention.

Figure 3 is a flowchart of the enterprise called party in a VoIP communication method according to the present invention.

To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention.

Figure 1 is an architecture diagram of a VoIP communication system according to the present invention. The system includes a cross-enterprise authentication VoIP communication module 110, a blockchain storage unit 115, and a mail server 116.

In one embodiment, the cross-enterprise authentication VoIP communication module 110, the blockchain storage unit 115, and the external enterprise 117 are interconnected, while the mail server 116 communicates between the cross-enterprise authentication VoIP communication module 110 and the external enterprise 117.

In one embodiment, the cross-enterprise authentication VoIP communication module 110 and the external enterprise 117 access information such as dialing prefixes, IP addresses/domains, and public keys for corporate emails and encrypted messages through blockchain storage unit 115.

The cross-enterprise authentication VoIP communication module 110 comprises four units: a one-time password processing unit 111, a blockchain access unit 112, a call and authentication unit 113, and a transceiver unit 114.

In one embodiment, the transceiver unit 114 is an email transceiver unit.

The modules and units 111-115 shown in Figure 1 can be software, hardware, or firmware. If hardware, they can be processing units, processors, computers, or servers with data processing and computing capabilities. If software or firmware, they can include instructions executable by processing units, processors, computers, or servers, and can be installed on the same hardware device or distributed across multiple different hardware devices.

The one-time password processing unit 111 is used, when processing outbound calls, to send a one-time password request (encrypted with the called party's public key) to the called party requesting the necessary one-time password for this SIP call, or to process received one-time password requests (decrypted with the enterprise's own private key), and to respond to the calling party with the SIP call identifier (Call-ID) and the one-time password (encrypted with the calling party's public key).

Blockchain access unit 112 accesses blockchain storage unit 115 on an external network to obtain information such as the dialing prefix, IP address/domain, email address, and public key for encrypted messages of the called party company. This information is then used to upload to the blockchain storage unit 115. Blockchain storage unit 115 uses distributed blockchain storage technology to store the aforementioned information of both the called and called parties on the blockchain.

In addition, the blockchain storage unit 115 can also store information about various enterprise VoIP communications on the blockchain, such as whether video conferencing is supported, whether low-bandwidth voice calls are supported, and whether certain special voice or video codecs are supported. This information can affect the audio and video specifications or quality of SIP calls.

The call and authentication unit 113 initiates a SIP call to the called party enterprise based on the call ID and one-time password provided by the one-time password processing unit 111 and the username provided by the transceiver unit 114. It also authenticates the received SIP messages based on the call ID and one-time password provided by the one-time password processing unit 111 and the username provided by the transceiver unit 114.

The transceiver unit 114 (such as an email transceiver unit) is used to receive emails sent by the called party (containing a valid time period and a username required for the called party's SIP authentication), and to obtain the email address of the external company 117 from the blockchain access unit 112 and send an email (containing a valid time period and a username required for the company's SIP authentication) to the external company 117 that wants to call this company. Both receiving and sending emails are done through the mail server 116.

Figure 2 is a flowchart of one VoIP communication method according to the present invention, wherein the enterprise end is the initiating end, i.e., the calling end. This method can be executed by the cross-enterprise authenticated VoIP communication module 110.

In step 201, the call and authentication unit 113 initiates a SIP call.

In step 202, blockchain access unit 112 queries blockchain storage unit 115 to obtain the called party's public key.

In step 203, the one-time password processing unit 111 sends a one-time password request for the call, which includes a call identifier and is encrypted with the called party's public key.

In step 204, the one-time password processing unit 111 receives a response from the called party regarding the one-time password request. This response includes the call identifier and the one-time password, and decrypts it using the calling party's private key.

In step 205, the one-time password processing unit 111 determines whether the one-time password corresponding to the call identification code has been obtained. If it cannot be obtained, the call and authentication unit 113 executes step 209 to terminate the call. If the one-time password is successfully obtained, the transceiver unit 114 (such as an email transceiver unit) executes step 206 to query the email sent by the called party.

In step 207, the transceiver unit 114 (e.g., an email transceiver unit) obtains the username permitted during the aforementioned valid time period via email. If the username has been obtained, the process proceeds to step 208. If the username cannot be obtained, the call and authentication unit 113 executes step 209 to terminate the call.

The aforementioned emails are sent from the called party to the calling party, and the email content contains different usernames used at different times. For example, the called party can send an email every hour, listing one username used by the SIP call every 5 minutes within that hour. Thus, each username has a valid 5-minute period, and each username can only be authenticated by the SIP call within its valid period. Furthermore, the called party can use email encryption technology when sending the email to increase the complexity of cracking it.

When the validity period of the current username ends, the username becomes invalid, and the validity period of the next username begins. When sending an email, the called party can, according to the aforementioned validity period plan, send an email containing the username a certain amount of time before the start of a particular username's validity period (e.g., 10 minutes in advance) to avoid email delays that could affect SIP authentication.

In addition to transmitting the username required for SIP authentication via email, another embodiment may also transmit the username using other methods such as SMS. Furthermore, besides transmitting the username through an intermediary server such as a mail server, another embodiment may also transmit it directly between the calling and called parties without using an intermediary server.

In step 208, the call and authentication unit 113 makes an outbound SIP call to the called party and uses the call identifier, username, and one-time password obtained in the preceding steps as the relevant authentication parameters for SIP authentication. This authentication process follows standard SIP authentication procedures.

Figure 3 is a flowchart of one VoIP communication method of the present invention, in which the enterprise end is the called end.

In step 301, the call and authentication unit 113 receives a SIP call.

In step 302, the one-time password processing unit 111 receives a one-time password request containing the call identifier that will be used in the SIP call.

In step 303, the one-time password processing unit 111 decrypts the one-time password request using the enterprise's private key. If decryption fails, the call and authentication unit 113 executes step 311 to terminate the call. If decryption succeeds, the one-time password processing unit 111 executes step 304 to generate a one-time password corresponding to this call identification code.

In step 305, blockchain access unit 112 queries blockchain storage unit 115 to obtain the calling party's public key.

In step 306, the one-time password processing unit 111 sends a response containing the call identifier and the one-time password to acknowledge the one-time password request. This response is encrypted with the caller's public key.

In step 307, the transceiver unit 114 (such as an email transceiver unit) checks the emails sent to the calling party to obtain the calling party's username permitted during the aforementioned valid time period.

In step 308, the call and authentication unit 113 awaits a SIP call.

In step 309, the call and authentication unit 113 performs SIP authentication using the call identifier, username, and one-time password from the previous steps. If authentication fails, the call and authentication unit 113 executes step 311 to terminate the call; if authentication succeeds, the call and authentication unit 113 executes step 310 to accept the SIP call.

The VoIP communication system and method provided by this invention have the following advantages compared with other conventional technologies:

First, this invention provides a VoIP communication system and method that utilizes the characteristics of blockchain networks to allow enterprises to store VoIP communication-related information in a decentralized manner, such as dialing prefixes, IP/Domains, enterprise email addresses, and public keys for encrypted messages. This eliminates the need for building and maintaining a centralized database and improves the ease with which other enterprises can join VoIP communication.

Secondly, the VoIP communication system and method of this invention, through a public-private key encryption and decryption mechanism, securely protects one-time password requests transmitted between enterprises and ensures that the enterprise that truly possesses the private key receives the messages addressed to it.

Third, this invention provides a VoIP communication system and method that transmits emails to businesses wishing to communicate via blockchain email messages. The email content includes a valid time period and the username required for SIP authentication on the business side. Using different SIP authentication usernames at different times effectively prevents the risk of account compromise.

Fourth, the VoIP communication system and method of this invention utilizes the existing SIP authentication mechanism, combined with one-time password negotiation and a time-varying SIP authentication username. This constitutes a two-factor authentication mechanism combining public and private keys with email, effectively increasing the difficulty of hacking during VoIP communication.

The above detailed description is a specific illustration of one feasible embodiment of the present invention. However, this embodiment is not intended to limit the scope of the patent. All equivalent embodiments or modifications that do not depart from the spirit and technique of the present invention should be included within the scope of this patent.

In conclusion, this invention is not only innovative in its technical concept but also possesses numerous benefits that conventional methods cannot achieve. It fully meets the statutory requirements for novelty and progress in an invention patent. Therefore, this application is filed in accordance with the law, and we earnestly request your authority to approve this invention patent application to encourage further invention. We are deeply grateful for your assistance.

110: Cross-enterprise certified VoIP communication module

111: One-time password processing unit

112: Blockchain Access Unit

113: Call and Authentication Unit

114: Receiving and Dispatching Unit

115: Blockchain Storage Unit

116: Mail Server

117: External Enterprises

Claims (9)

A Voice over Internet Protocol (VoIP) communication system is used for VoIP communication based on the Session Initiation Protocol (SIP) and is located at the calling end of the VoIP communication. The VoIP communication system includes: a blockchain storage unit for storing the dialing preamble, Internet Protocol address, domain name, and public key of the calling end and the called end of the VoIP communication on the blockchain; and a one-time password processing unit for sending a one-time password request to the called end and receiving the one-time password from the called end. The response to a one-time password request is encrypted with the called party's public key. The response includes a call identifier and a one-time password, and is encrypted with the calling party's public key. A transceiver unit is used to receive the username. A call and authentication unit is used to make an outgoing SIP call to the called party, providing the call identifier, the one-time password, and the username to authenticate the SIP call. The VoIP communication system as described in claim 1 further includes: a blockchain access unit for querying the blockchain storage unit to obtain the called party's public key from the blockchain, wherein the one-time password processing unit encrypts the one-time password request using the called party's public key before sending the request, and decrypts the response using the calling party's private key after receiving the response. In the VoIP communication system described in claim 1, the username is sent from the called party to the calling party via email and email encryption technology. The VoIP communication system as described in claim 1, wherein the username has a validity period, and the username can only be authenticated by the SIP call within that validity period. In the VoIP communication system described in claim 4, the called party sends the username to the calling party before the start of the effective time period. A Voice over Internet Protocol (VoIP) communication system is provided for conducting VoIP communication based on the Session Initiation Protocol (SIP) and is located at the called end of the VoIP communication. The VoIP communication system includes: a blockchain storage unit for storing the dialing preamble, Internet Protocol address, domain name, and public key of the calling and called ends of the VoIP communication on the blockchain; and a one-time password processing unit for receiving one-time password requests from the calling end and generating a call identifier corresponding to the one-time password request. The system includes a call identifier and a one-time password, and then sends a response to the caller requesting the one-time password to the calling end. The response includes the call identifier and the one-time password, and is encrypted with the calling end's public key. A transceiver unit is used to send the username to the calling end. A call and authentication unit is used to wait for SIP calls initiated by the calling end and then authenticate the SIP call based on the call identifier, the one-time password, and the username. The VoIP communication system as described in claim 6 further includes: a blockchain access unit for querying the blockchain storage unit to obtain the calling party's public key from the blockchain, wherein the one-time password processing unit, after receiving the one-time password request, decrypts the one-time password request using the called party's private key, and encrypts the response using the calling party's public key before sending the response. A Voice over Internet Protocol (VoIP) communication method for conducting sessions based on a meeting initiation protocol. This VoIP communication method, executed by the calling end of the VoIP communication (SIP Protocol), includes: storing the dialing preamble, Internet Protocol address, domain name, and public key of both the calling end and the called end on a blockchain; sending a one-time password request to the called end, wherein the one-time password request is encrypted with the called end's public key; receiving a response from the called end to the one-time password request, wherein the response includes a call identifier and a one-time password, and the response is encrypted with the calling end's public key; receiving a username; making an outgoing SIP call to the called end; and providing the call identifier, the one-time password, and the username to authenticate the SIP call. A Voice over Internet Protocol (VoIP) communication method for conducting sessions based on a meeting initiation protocol. The VoIP communication method, which is performed by the called party in the VoIP communication (SIP Protocol), includes: storing the dialing preamble, Internet Protocol address, domain name, and public key of the calling and called parties in the VoIP communication on a blockchain; receiving a one-time password request from the calling party; generating a one-time password corresponding to the call identifier in the one-time password request; sending a response to the one-time password request to the calling party, wherein the response includes the call identifier and the one-time password, and the response is encrypted with the calling party's public key; sending a username to the calling party; waiting for a SIP call initiated by the calling party; and authenticating the SIP call based on the call identifier, the one-time password, and the username.