公开(公告)号：US09178696B2

公开(公告)日：2015-11-03

申请号：US12744986

申请日：2007-11-30

申请人： Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

发明人： Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04L9/08 ,  H04L29/06

CPC分类号： H04L9/0838 ,  H04L9/083 ,  H04L9/0861 ,  H04L63/061 ,  H04L63/062 ,  H04L63/0884 ,  H04L65/1016

摘要： A method and arrangement is disclosed for managing session keys for secure communication between a first and at least a second user device in a communications network. The method is characterized being independent of what type of credential each user device implements for security operations. A first user receives from a first key management server keying information and a voucher and generates a first session key. The voucher is forwarded to at least a responding user device that, with support from a second key management server communicating with the first key management server, resolves the voucher and determines a second session keys. First and second session keys are, thereafter, used for secure communication. In one embodiment the communication traverses an intermediary whereby first and second session keys protect communication with respective leg to intermediary.

摘要翻译： 公开了一种用于管理用于通信网络中的第一和第二用户设备之间的安全通信的会话密钥的方法和装置。 该方法的特征在于独立于每个用户设备为安全操作实现什么类型的凭证。 第一用户从第一密钥管理服务器接收密钥信息和凭证并生成第一会话密钥。 该凭证被转发到至少一个响应用户设备，在来自与第一密钥管理服务器通信的第二密钥管理服务器的支持下，解决凭证并确定第二会话密钥。 此后，第一和第二会话密钥用于安全通信。 在一个实施例中，通信遍及中间体，由此第一和第二会话密钥保护与相应的腿到中间的通信。

公开(公告)号：US20100268937A1

公开(公告)日：2010-10-21

申请号：US12744986

申请日：2007-11-30

申请人： Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

发明人： Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04L9/32 ,  H04L29/06 ,  H04L9/08

CPC分类号： H04L9/0838 ,  H04L9/083 ,  H04L9/0861 ,  H04L63/061 ,  H04L63/062 ,  H04L63/0884 ,  H04L65/1016

摘要： A method and arrangement is disclosed for managing session keys for secure communication between a first and at least a second user device in a communications network. The method is characterized being independent of what type of credential each user device implements for security operations. A first user receives from a first key management server keying information and a voucher and generates a first session key. The voucher is forwarded to at least a responding user device that, with support from a second key management server communicating with the first key management server, resolves the voucher and determines a second session keys. First and second session keys are, thereafter, used for secure communication. In one embodiment the communication traverses an intermediary whereby first and second session keys protect communication with respective leg to intermediary.

摘要翻译： 公开了一种用于管理用于通信网络中的第一和第二用户设备之间的安全通信的会话密钥的方法和装置。 该方法的特征在于独立于每个用户设备为安全操作实现什么类型的凭证。 第一用户从第一密钥管理服务器接收密钥信息和凭证并生成第一会话密钥。 该凭证被转发到至少一个响应用户设备，在来自与第一密钥管理服务器通信的第二密钥管理服务器的支持下，解决凭证并确定第二会话密钥。 此后，第一和第二会话密钥用于安全通信。 在一个实施例中，通信遍及中间体，由此第一和第二会话密钥保护与相应的腿到中间的通信。

公开(公告)号：US20130268681A1

公开(公告)日：2013-10-10

申请号：US13800129

申请日：2013-03-13

申请人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

发明人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04W76/02

CPC分类号： H04W76/02 ,  H04L63/0428 ,  H04L65/1016 ,  H04L65/1069 ,  H04W12/02 ,  H04W12/04 ,  H04W76/10

摘要： An IMS system includes an IMS initiator user entity. The system includes an IMS responder user entity that is called by the initiator user entity. The system includes a calling side S-CSCF in communication with the caller entity which receives an INVITE having a first protection offer and parameters for key establishment from the caller entity, removes the first protection offer from the INVITE and forwards the INVITE without the first protection offer. The system includes a receiving end S-CSCF in communication with the responder user entity and the calling side S-CSCF which receives the INVITE without the first protection offer and checks that the responder user entity supports the protection, inserts a second protection offer into the INVITE and forwards the INVITE to the responder user entity, wherein the responder user entity accepts the INVITE including the second protection offer and answers with an acknowledgment having a first protection accept. A method for supporting a call by a telecommunications node.

摘要翻译： IMS系统包括IMS发起者用户实体。 该系统包括由发起者用户实体调用的IMS应答器用户实体。 该系统包括与主叫实体进行通信的主叫侧S-CSCF，其从呼叫方实体接收具有第一保护报价的INVITE和用于密钥建立的参数，从INVITE中移除第一保护报价并转发INVITE而没有第一保护 提供。 该系统包括与响应者用户实体通信的接收端S-CSCF，以及在没有第一保护提供的情况下接收INVITE的主叫侧S-CSCF，并检查响应者用户实体是否支持保护，将第二保护请求插入到 INVITE并将INVITE转发到响应者用户实体，其中响应者用户实体接受包括第二保护请求的INVITE和具有第一保护接受的确认的应答。 一种用于支持电信节点的呼叫的方法。

公开(公告)号：US08429737B2

公开(公告)日：2013-04-23

申请号：US12744720

申请日：2008-12-01

申请人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

发明人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04L29/06 ,  G06F15/16

摘要： An IMS system includes an IMS initiator user entity. The system includes an IMS responder user entity that is called by the initiator user entity. The system includes a calling side S-CSCF in communication with the caller entity which receives an INVITE having a first protection offer and parameters for key establishment from the caller entity, removes the first protection offer from the INVITE and forwards the INVITE without the first protection offer. The system includes a receiving end S-CSCF in communication with the responder user entity and the calling side S-CSCF which receives the INVITE without the first protection offer and checks that the responder user entity supports the protection, inserts a second protection offer into the INVITE and forwards the INVITE to the responder user entity, wherein the responder user entity accepts the INVITE including the second protection offer and answers with an acknowledgment having a first protection accept. A method for supporting a call by a telecommunications node.

公开(公告)号：US08549615B2

公开(公告)日：2013-10-01

申请号：US12744720

申请日：2008-12-01

申请人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

发明人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04L29/06 ,  G06F15/16

CPC分类号： H04W76/02 ,  H04L63/0428 ,  H04L65/1016 ,  H04L65/1069 ,  H04W12/02 ,  H04W12/04 ,  H04W76/10

摘要： An IMS system includes an IMS initiator user entity. The system includes an IMS responder user entity that is called by the initiator user entity. The system includes a calling side S-CSCF in communication with the caller entity which receives an INVITE having a first protection offer and parameters for key establishment from the caller entity, removes the first protection offer from the INVITE and forwards the INVITE without the first protection offer. The system includes a receiving end S-CSCF in communication with the responder user entity and the calling side S-CSCF which receives the INVITE without the first protection offer and checks that the responder user entity supports the protection, inserts a second protection offer into the INVITE and forwards the INVITE to the responder user entity, wherein the responder user entity accepts the INVITE including the second protection offer and answers with an acknowledgment having a first protection accept. A method for supporting a call by a telecommunications node.

摘要翻译： IMS系统包括IMS发起者用户实体。 该系统包括由发起者用户实体调用的IMS应答器用户实体。 该系统包括与主叫实体进行通信的主叫侧S-CSCF，其从呼叫方实体接收具有第一保护报价的INVITE和用于密钥建立的参数，从INVITE中移除第一保护报价并转发INVITE而没有第一保护 提供。 该系统包括与响应者用户实体通信的接收端S-CSCF，以及在没有第一保护提供的情况下接收INVITE的主叫侧S-CSCF，并检查响应者用户实体是否支持保护，将第二保护请求插入到 INVITE并将INVITE转发到响应者用户实体，其中响应者用户实体接受包括第二保护请求的INVITE和具有第一保护接受的确认的应答。 一种用于支持电信节点的呼叫的方法。

公开(公告)号：US08832821B2

公开(公告)日：2014-09-09

申请号：US13800129

申请日：2013-03-13

申请人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

发明人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04L29/06 ,  G06F15/16 ,  H04W76/02 ,  H04W12/04 ,  H04W12/02

CPC分类号： H04W76/02 ,  H04L63/0428 ,  H04L65/1016 ,  H04L65/1069 ,  H04W12/02 ,  H04W12/04 ,  H04W76/10

摘要： An IMS system includes an IMS initiator user entity. The system includes an IMS responder user entity that is called by the initiator user entity. The system includes a calling side S-CSCF in communication with the caller entity which receives an INVITE having a first protection offer and parameters for key establishment from the caller entity, removes the first protection offer from the INVITE and forwards the INVITE without the first protection offer. The system includes a receiving end S-CSCF in communication with the responder user entity and the calling side S-CSCF which receives the INVITE without the first protection offer and checks that the responder user entity supports the protection, inserts a second protection offer into the INVITE and forwards the INVITE to the responder user entity, wherein the responder user entity accepts the INVITE including the second protection offer and answers with an acknowledgment having a first protection accept. A method for supporting a call by a telecommunications node.

摘要翻译： IMS系统包括IMS发起者用户实体。 该系统包括由发起者用户实体调用的IMS应答器用户实体。 该系统包括与主叫实体进行通信的主叫侧S-CSCF，其从呼叫方实体接收具有第一保护报价的INVITE和用于密钥建立的参数，从INVITE中移除第一保护报价并转发INVITE而没有第一保护 提供。 该系统包括与响应者用户实体通信的接收端S-CSCF，以及在没有第一保护提供的情况下接收INVITE的主叫侧S-CSCF，并检查响应者用户实体是否支持保护，将第二保护请求插入到 INVITE并将INVITE转发到响应者用户实体，其中响应者用户实体接受包括第二保护请求的INVITE和具有第一保护接受的确认的应答。 一种用于支持电信节点的呼叫的方法。

公开(公告)号：US20110010768A1

公开(公告)日：2011-01-13

申请号：US12744720

申请日：2008-12-01

申请人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

发明人： Luis Barriga ,  Rolf Blom ,  Yi Cheng ,  Fredrik Lindholm ,  Mats Naslund ,  Karl Norrman

IPC分类号： G06F21/00

CPC分类号： H04W76/02 ,  H04L63/0428 ,  H04L65/1016 ,  H04L65/1069 ,  H04W12/02 ,  H04W12/04 ,  H04W76/10

摘要： An IMS system includes an IMS initiator user entity. The system includes an IMS responder user entity that is called by the initiator user entity. The system includes a calling side S-CSCF in communication with the caller entity which receives an INVITE having a first protection offer and parameters for key establishment from the caller entity, removes the first protection offer from the INVITE and forwards the INVITE without the first protection offer. The system includes a receiving end S-CSCF in communication with the responder user entity and the calling side S-CSCF which receives the INVITE without the first protection offer and checks that the responder user entity supports the protection, inserts a second protection offer into the INVITE and forwards the INVITE to the responder user entity, wherein the responder user entity accepts the INVITE including the second protection offer and answers with an acknowledgment having a first protection accept. A method for supporting a call by a telecommunications node.

摘要翻译： IMS系统包括IMS发起者用户实体。 该系统包括由发起者用户实体调用的IMS应答器用户实体。 该系统包括与主叫实体进行通信的主叫侧S-CSCF，其从呼叫方实体接收具有第一保护报价的INVITE和用于密钥建立的参数，从INVITE中移除第一保护报价并转发INVITE而没有第一保护 提供。 该系统包括与响应者用户实体通信的接收端S-CSCF，以及在没有第一保护提供的情况下接收INVITE的主叫侧S-CSCF，并检查响应者用户实体是否支持保护，将第二保护请求插入到 INVITE并将INVITE转发到响应者用户实体，其中响应者用户实体接受包括第二保护请求的INVITE和具有第一保护接受的确认的应答。 一种用于支持电信节点的呼叫的方法。

公开(公告)号：US08645680B2

公开(公告)日：2014-02-04

申请号：US12997913

申请日：2009-05-06

申请人： Rolf Blom ,  Yi Cheng ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

发明人： Rolf Blom ,  Yi Cheng ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04L29/06

CPC分类号： H04L65/601 ,  H04L63/0464 ,  H04L63/0478 ,  H04L63/06 ,  H04L63/123

摘要： A method and apparatus for sending protected media data from a data source node to a client node via an intermediate node. The data source node establishes a first hop-by-hop key to be shared with the intermediate node and an end-to-end key to be shared with the client node. A single security protocol instance is configured and used to trans-protocol form data from a media stream into transformed data using the keys. The transformed data is then sent to the intermediate node. The intermediate node uses the first hop-by-hop key to apply a security processing to the transformed data, and establishes a second hop-by-hop key with the client node. A second transformation is performed on the transformed data using the second hop-by-hop key to produce further transformed media data, which is then sent to the client node. At the client node a single security protocol instance is configured with the second hop-by-hop key and the end-to-end key, which are used to apply further security processing to the transformed media data.

摘要翻译： 一种用于经由中间节点将受保护媒体数据从数据源节点发送到客户端节点的方法和装置。 数据源节点建立与中间节点共享的第一个逐跳密钥和要与客户机节点共享的端对端密钥。 单个安全协议实例被配置并用于使用密钥将媒体流中的数据转换为变换数据。 然后将变换的数据发送到中间节点。 中间节点使用第一个逐跳密钥对转换的数据应用安全处理，并与客户端节点建立第二个逐跳密钥。 使用第二逐跳密钥对经变换的数据执行第二变换以产生进一步转换的媒体数据，然后将其转发到客户端节点。 在客户端节点，单个安全协议实例配置有第二个逐跳密钥和端对端密钥，用于对转换的媒体数据应用进一步的安全处理。

公开(公告)号：US20110093698A1

公开(公告)日：2011-04-21

申请号：US12997913

申请日：2009-05-06

申请人： Rolf Blom ,  Yi Cheng ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

发明人： Rolf Blom ,  Yi Cheng ,  John Mattsson ,  Mats Naslund ,  Karl Norrman

IPC分类号： H04L9/12

CPC分类号： H04L65/601 ,  H04L63/0464 ,  H04L63/0478 ,  H04L63/06 ,  H04L63/123

摘要： A method and apparatus for sending protected media data from a data source node to a client node via an intermediate node. The data source node establishes a first hop-by-hop key to be shared with the intermediate node and an end-to-end key to be shared with the client node. A single security protocol instance is configured and used to trans-protocol form data from a media stream into transformed data using the keys. The transformed data is then sent to the intermediate node. The intermediate node uses the first hop-by-hop key to apply a security processing to the transformed data, and establishes a second hop-by-hop key with the client node. A second transformation is performed on the transformed data using the second hop-by-hop key to produce further transformed media data, which is then sent to the client node. At the client node a single security protocol instance is configured with the second hop-by-hop key and the end-to-end key, which are used to apply further security processing to the transformed media data.

摘要翻译： 一种用于经由中间节点将受保护媒体数据从数据源节点发送到客户端节点的方法和装置。 数据源节点建立与中间节点共享的第一个逐跳密钥和要与客户机节点共享的端对端密钥。 单个安全协议实例被配置并用于使用密钥将媒体流中的数据转换为变换数据。 然后将变换的数据发送到中间节点。 中间节点使用第一个逐跳密钥对转换的数据应用安全处理，并与客户端节点建立第二个逐跳密钥。 使用第二逐跳密钥对经变换的数据执行第二变换以产生进一步转换的媒体数据，然后将其转发到客户端节点。 在客户端节点，单个安全协议实例配置有第二个逐跳密钥和端对端密钥，用于对转换的媒体数据应用进一步的安全处理。

公开(公告)号：US20070160201A1

公开(公告)日：2007-07-12

申请号：US10597864

申请日：2004-02-11

申请人： Rolf Blom ,  Mats Naslund ,  Elisabetta Carrara ,  Fredrik Lindholm ,  Karl Norrman

发明人： Rolf Blom ,  Mats Naslund ,  Elisabetta Carrara ,  Fredrik Lindholm ,  Karl Norrman

IPC分类号： H04L9/30

CPC分类号： H04L9/0844 ,  H04L9/0891 ,  H04L2209/80

摘要： The invention provides an establishment of a secret session key shared Between two network elements (NEa, NEb) belonging to different network domains (NDa, NDb). A first network element (NEa) of a first network domain (NDa) requests security parameters from an associated key management center (KMC) (AAAa). Upon reception of the request, the KMC (AAAa) generates a freshness token (FRESH) and calculates the session key (K) based on this token (FRESH) and a master key (KAB) shared with a second network domain (NDb). The security parameters are (securely) provided to the network element (NEa), which extracts the session key (K) and forwards the freshness token (FRESH) to the KMC (AAAb) of the second domain (NDb) through a second network element (NEb). Based on the token (FRESH) and the shared master key (KAB), the KMC (AAAb) generates a copy of the session key (K), which is (securely) provided to the second network element (NEb). The two network elements (NEa, NEb) now have shares the session key (K), enabling them to securely communicate with each other.

摘要翻译： 本发明提供了属于不同网络域（NDa，NDb）的两个网元（NEa，NEb）之间共享的秘密会话密钥的建立。 第一网络域（NDa）的第一网元（NEa）从相关联的密钥管理中心（AAAa）请求安全参数。 在接收到请求时，KMC（AAAa）生成新鲜令牌（FRESH），并且基于该令牌（FRESH）和与第二网络域（NDb）共享的主密钥（KAB）来计算会话密钥（K）。 安全参数（安全地）被提供给提取会话密钥（K）的网元（NEa），并通过第二网络元件将新鲜度令牌（FRESH）转发到第二域（NDb）的KMC（AAAb） （鼻）。 基于令牌（FRESH）和共享主密钥（KAB），KMC（AAAb）生成（安全地）提供给第二网元（NEb）的会话密钥（K）的副本。 两个网元（NEa，NEb）现在已经共享了会话密钥（K），使得它们能够彼此安全地通信。