WO2008020015A1

WO2008020015A1 - Secure transport of messages in the ip multimedia subsystem

Info

Publication number: WO2008020015A1
Application number: PCT/EP2007/058395
Authority: WO
Inventors: Peter Leis
Original assignee: Nokia Siemens Networks Gmbh & Co. Kg
Priority date: 2006-08-17
Filing date: 2007-08-14
Publication date: 2008-02-21

Abstract

The invention relates to a method and application server for the encryption of data for transmission by way of an IP multimedia subsystem. According to the invention a terminal (UE) is registered with an S-CSCF unit of the IP multimedia subsystem, with at least one key being generated. This key is transmitted to the one application server of the IP multimedia subsystem and used there to encrypt data to secure its transmission between the terminal (UE) and the application server. Using the key material generated during registration allows the transport of data between the terminal (UE) and the application server to be secured with little outlay.

Description

Secure transport of messages in the IP multimedia subsystem

The invention relates to a method and application server for the encryption of data for transmission by way of an IP multimedia subsystem.

Current developments in the field of networks tend towards offering the widest possible range of services, where possible independently of the technology or network used.

The so-called IP multimedia subsystem (IMS) was designed with the aim of providing the entire range of services that can be offered by way of the internet. It is a standardized Next

Generation Network (NGN) architecture for network operators to provide mobile and line-based multimedia services. This system uses a voice-over-IP (VoIP) implementation, based on a SIP (Session Initiation Protocol) implementation standardized by the 3GPP (3rd generation partnership project) standardization committee and using the conventional IP protocol (Internet Protocol). Already existing telephone networks (both line-switched and packet-based) are supported. IMS was originally designed for mobile networks. In the meantime however it has also come to support line-based operation and fixed network services. IMS allows network operators to provide multimedia services independently of the location of the user, the access technology and the terminal used.

The IMS core network is an accumulation of different functions, connected by standardized interfaces. A function here should not be understood to be a node (hardware node) but depending on the implementation a plurality of functions can also be combined in one physical node. On the other hand it is also possible to realize a function in a physically distributed manner. A user of the IMS network can use different methods to connect to the IMS. All these methods use the conventional IP protocol. So-called IMS terminals (e.g. mobile telephones, PDAs, computers) can register directly with the IMS network, regardless of their respective location. The only requirement is that they have SIP user agents.

The IMS core network has a database, which stores user- related data. This database, also referred to as the HSS (Home Subscriber Server) , supports the IMS network elements, which support calls or sessions. It comprises user profiles, assists user authentication and authorization and can supply information relating to the location of the user. For call or session control, a number of roles are defined for SIP servers or SIP proxies, referred to collectively as CSCF (Call Session Control Function) . These are used to handle SIP signaling messages within the IMS. A so-called P-CSCF (Proxy CSCF) is a SIP proxy, which represents the first contact for an IMS terminal. This function can be located either in the visited network or in the home network. A so-called I-CSCF (Interrogating-CSCF) is a SIP proxy, located at the edge of an administrative domain. It is used as the access point for all SIP packets to this domain. One S-CSCF (Serving CSCF) is the central node of the signaling level. This is a SIP server, which is also responsible for session monitoring. It is disposed in the home network. In addition to these network elements for monitoring calls and sessions there are also so- called application servers, which provide services and are connected to the S-CSCF by way of SIP by means of standardized interfaces. This allows independent service providers to provide services in a simple manner within the IMS network. There are also what are known as MRF (Media Resource Function) functions, which provide a source for media in the home network, and different types of gateways.

Multimedia sessions can be set up and implemented between users using the IMS. Multimedia messages are exchanged in the context of such sessions. We will look at the secured transport of such messages below. In the IMS network messages can be transported for example by means of what is known as MSRP (Message Session Relay Protocol), which is described in the IETF (Internet Engineering Task Force) draft draft-ietf-simple-message- session. While messages are being transported in the IMS network by means of this protocol or other transport protocols, security criteria, such as authentication of the communication partner, in other words the guarantee that the communication partner is actually who they claim to be, have to be satisfied for the subscriber or user. The integrity of the messages must also be granted, in other words it must be ensured that messages are not manipulated. Finally the confidentiality of messages must be guaranteed, in other words protection must be provided to prevent third parties reading messages. Security can be ensured for example by using cryptographic methods or protocols. Such a protocol, which is designed for the transport of messages, is the TLS (Transport Layer Security) protocol. In the above-mentioned draft ietf-simple-message-session it is recommended that TLS be used in conjunction with the MSRP protocol.

Since cryptographic methods operate with data encryption, there is a need to carry out encryption for the transmission of multimedia messages by means of transport protocols by way of the IMS and to provide suitable key material for this purpose .

The object of this invention is therefore to allow low-outlay encryption for the transport of multimedia messages by way of the IMS.

This object is achieved by a method as claimed in claim 1 and an application server as claimed in claim 11.

The invention is based on the concept of using key material generated for IMS registration to secure the transmission of data between a terminal and an IMS application server. The following steps are implemented in this process:

• A terminal is registered with an S-CSCF unit of the IMS. During this registration an AKA (Authentication and Key

Agreement) procedure is used to authenticate a terminal in an IMS network.

• During registration at least one key is generated. The key material is for example a cipher key and an integrity key.

• The key material is transmitted to an application server. This is identified for example by means of information transmitted from an HSS and relating to a service subscribed to by the subscriber. Transmission is preferably effected by the S-CSCF unit by way of an interface secured by IPSec (IP Security) . A SIP REGISTER message can be used for this purpose. Other solutions are however also possible ..

• The key material is used to encrypt data to secure its transmission (e.g. transmission of MSRP messages) between the terminal and the application server. This is preferably PKS (pre-shared-key) encryption. The TLS (transport layer security) protocol can be used for securing by encryption.

The inventive method allows PSK encryption to be realized in a simple manner with little outlay. It is not necessary - as with many conventional methods - to provide an additional PKI infrastructure to secure the communication of key material required between terminal and application server. Instead key material generated during IMS registration is used, with which a PKI-based key distribution can in turn be carried out. The same key material can thus be used to send messages by means of different protocols (e.g. signaling protocols such as SIP and transport protocols such as MSRP) . If during IMS registration a plurality of keys is generated so that different keys can be used in different sessions, it is also possible to provide part of the keys exclusively for use by the application server.

The invention therefore ensures not only the securing of SIP- based communication (further to IMS registration) but also cryptographic protection for sending messages by means of a transport protocol (e.g. MSRP).

According to a development of the subject matter of the invention the application server is informed when new key material is available for a subscriber (e.g. due to a new authentication in the IMS) . This can be done automatically by (the S-CSCF unit for example) sending a REGISTER message with new key material to the application server.

The invention also comprises an application server with means (e.g. software, hardware or firmware) for implementing an inventive encryption. The application server is therefore embodied for example to establish a secured connection to a terminal by means of the TLS protocol. PSK encryption for example takes place as described above for securing purposes.

The subject matter of the invention is described in more detail below with reference to an exemplary embodiment based on figures, in which:

Figure 1 shows an AKA (Authentication and Key Agreement) procedure during the registration of a terminal in an IMS network

Figure 2 shows an inventive distribution and use of key material created during registration in the IMS network for the secured transmission of multimedia data by means of the MSRP protocol Figure 3 shows a secured transmission of data, which is secured section by section according to the invention .

It is set out below how key material, which was generated during the registration of a subscriber in the IMS by means of the IMS AKA (Authentication and Key Agreement) procedure according to RFC 3310 (RFC: request for comments) and 3GPP TS 33.203 for use for securing purposes and confidentiality protection during the transmission of SIP signaling messages, is used as key material for a TCP connection (TCP: transmission control protocol) secured by means of pre- shared-key TLS between a terminal UE and an application server - hereafter referred to according to the application as an MSRP server - to ensure the securing of an MSRP connection between the terminal UE and the MSRP server.

Figure 1 shows parts of the IMS-AKA procedure. The following device elements are shown: a terminal UE, an S-CSCF (Serving Call Session Control Function) and an HSS (Home Subscriber Server) . For registration the terminal UE sends a SIP REGISTER message to a P-CSCF (Proxy Call Session Control Function) in the serving network. This registration request is then transmitted by way of an I-CSCF to the S-CSCF. Let us assume that the S-CSCF has no authentication vector for the terminal UE. The S-CSCF then sends a request to the HSS to provide authentication data (request for authentication data; step 1 in Figure 1) . This request contains the user-related number IMSI (international Mobile Subscriber Identity) , by means of which the HSS can identify the user or subscriber to be registered. The HSS then accesses the subscriber profile and generates a matrix from n authentication vectors (step 2) . These authentication vectors are also referred to as quintets or quintuples, as they consist of five inputs. These include a random number RAND, an expected response XRES, a cipher key CK, an integrity key IK and an authentication character AUTN. Each of these vectors can only be used for one AKA (Authentication and Key) transaction between the IMS subscriber and the S-CSCF.

Once the S-CSCF has received the authentication vectors (step 3) , it stores these (step 4) and selects one for registration (step 5) . A request for authentication of the subscriber is then sent to the terminal UE, with the random number RAND and the authentication character AUTN being transmitted as parameters (step 6) . The parameter AUTN is then verified and a response RES is calculated, which is sent back to the S- CSCF (steps 7 to 9) . The response RES sent back is then compared with the expected response XRES and if the result is positive, the corresponding keys CK and IK are used for communication (steps 10 and 12) . The corresponding keys are also calculated by the terminal (step 11), so that a secured transmission can then take place between the terminal UE and the P-CSCF (which receives the keys from the S-CSCF) .

The above AKA procedure is only one example of a registration procedure, further to which key material (in this instance the keys CK and IK) is generated. According to the invention key material, which has been generated in the context of am IMS registration to secure SIP messages, is used to secure the transport of data by means of a transport protocol.

The keys generated for the secured exchange of SIP messages between the terminal UE and the P-CSCF are used for a pre- shared-key TLS securing of an MSRP connection between the terminal UE and an MSRP server. To this end, after successful authentication or authorization, the S-CSCF downloads the user profile and so-called initial filter criteria (iFC) for the registered subscriber or terminal UE from the HSS by way of the Cx interface. The user profile and initial filter criteria contain the information that this subscriber has registered for MSRP-based messaging (or has subscribed for this) and which MSRP server provides the messaging service and also the corresponding security function for this. Provision of the security function on an application server or MSRP server is part of the invention.

As shown in Figure 2, the key material, in other words the keys CK and IK, are transmitted from the S-CSCF to the corresponding MSRP server by way of the ISC interface. This transmission takes place by means of a SIP register message; the mechanism for this is described in the specifications 3GPP TS 23.228 and 3GPP TS 24.229. In this process the generated keys are transmitted either as part of the so- called service information element in the payload data field of the 3rd party REGISTER message or as the SIP header. In the latter instance prior definition and insertion of a SIP header is required for key transmission. Since the ISC interface can be protected by means of IP-Sec (IP

Security) (as described in 3GPP TS 33.210), transmission of the key material can be protected from the S-CSCF to the MSRP server .

In a further step the terminal UE and the MSRP server initiate Transport Layer Security (TLS) based on the pre- shared key material (in other words the keys CK and IK) before the actual MSRP messaging. The procedures described in the RFC 4279 "pre-shared key TLS" are used here. Secure messaging communication by means of MSRP then takes place by way of the TCP connection thus secured.

Figure 3 shows how the method can be used to realize a secure connection between two terminals UEl and UE2. In this process security on the individual connection sections is established as follows. Between UEl and an MSRP server the connection is protected by means of the inventive method based on TLS. Between the two MSRP servers there is a secured connection within the core network. And between the second MSRP server and the terminal UE2 the connection is again secured by means of TLS, as described in the invention.

Claims

1. A method for the encryption of data, representing messages exchanged in the context of a session, for transmission by way of an IP multimedia subsystem, wherein

- a terminal (UE) is registered with an S-CSCF unit of the IP multimedia subsystem,

- at least one key is generated further to registration,

- the key is transmitted to an application server of the IP multimedia subsystem, and

- data are encrypted by means of the key to secure its transmission between the terminal (UE) and the application server .

2. The method as claimed in claim 1, characterized in that a pre-shared-key encryption is carried out.

3. The method as claimed in one of claims 1 or 2, characterized in that transmission of the data is secured by means of the TLS protocol .

4. The method as claimed in one of the preceding claims, characterized in that the data is transmitted by means of the MSRP protocol.

5. The method as claimed in one of the preceding claims, characterized in that during registration an IMS AKA procedure is used for authentication.

6. The method as claimed in one of the preceding claims, characterized in that the key is transmitted from the S-CSCF unit to the application server of the IP multimedia subsystem by means of a SIP REGISTER message.

7. The method as claimed in one of the preceding claims, characterized in that transmission of the key from the S-CSCF unit to the application server is protected by means of IPSec.

8. The method as claimed in one of the preceding claims, characterized in that a cipher key and/or an integrity key are provided for encryption and used for encryption by means of the method.

9. The method as claimed in one of the preceding claims, characterized in that the application server is notified when new key material is available at the S-CSFC.

10. The method as claimed in one of the preceding claims, characterized in that the application server, to which the key is to be transmitted, is identified by information requested from an

HSS.

11. An application server with means for implementing a method as claimed in one of claims 1 to 10.

12. The application server as claimed in claim 11 with means for establishing a secured connection to a terminal (UE) .

13. The application server as claimed in claim 12, characterized in that means are provided for securing the connection by means of the TLS protocol.

14. The application server as claimed in one of the preceding claims, characterized in that means are provided for a pre-shared-key authentication.