Internet protocol telephony security architecture

Abstract

A system is provided in which a client/server/network can implement a key management session when the server initiates the key management session utilizing a nonce. The nonce allows a wakeup or trigger message to be conveyed to the client such that a service attack on the server can be avoided when a false nonce is received by the server with an AP request message. Thus the server can disregard AP request messages that are not accompanied by a nonce stored by the server. The method can be implemented through circuitry, electrical signals and code to accomplish the acts described in the method.

1 . A method of providing key management comprising: 
 providing a server;    providing a client configured to be coupled with said server;    providing a trusted third party configured to be coupled with said client;    allowing said server to initiate a key management session with said client by conveying a server key management message comprising a server_nonce to said client;    receiving at said server via said client a client key management response message comprising a cryptographic message comprising a returned_nonce and a ticket;    determining if said client key management response message should be accepted by said server by determining whether said returned_nonce matches said server_nonce and whether said ticket is validated.    
   
   
       2 . The method as described in  claim 1  wherein said allowing said server to initiate said key management session with said client comprises: 
 providing said server_nonce at said server;    generating said server key management message at said server;    conveying said server key management message to said client.    
   
   
       3 . The method as described in  claim 2  and further comprising: 
 receiving said server key management message comprising said server_nonce at said client;    providing said returned_nonce at said client;    generating said key management response message at said client comprising said returned_nonce;    conveying said key management response message comprising said returned_nonce to said server.    
   
   
       4 . The method as described in  claim 3  and further comprising: 
 predetermining an out-of-bounds value for said returned_nonce to prevent an attacker from simulating a server initiated key management session;    checking said returned_nonce to determine whether the value of said returned_nonce is said out-of-bounds value.    
   
   
       5 . The method as described in  claim 3  and further comprising: 
 confirming the value of said returned_nonce at said server; and    conveying a reply message from said server to said client.    
   
   
       6 . The method as described in  claim 1  and further comprising: 
 receiving from said client an attacker induced response message comprising a false_nonce at said server;    determining that said false_nonce is not equivalent to any valid nonce sent by said server to said client;    disregarding said client response message as not being sent in response to a message sent by said server.    
   
   
       7 . A method of providing key management in a Kerberos based system, said method comprising: 
 providing a server;    providing a client configured to be coupled with said server;    providing a key distribution center configured to act as a trusted third party for said client and said server;    generating a server_nonce at said server;    generating a trigger message to trigger said key management;    coupling said trigger message with said server_nonce;    conveying said trigger message and said server_nonce to said client;    initiating a key management session by said server with said client by utilizing said server_nonce coupled with said trigger message;    receiving at said server a client key management response message comprising a returned_nonce and a ticket issued to said client by said key distribution center.    
   
   
       8 . (canceled)  
   
   
       9 . The method as described in  claim 7  and further comprising: 
 receiving said trigger message and said server_nonce at said client;    generating said client key management response message to said trigger message at said client;    conveying said client key management response message comprising said returned_nonce to said server from said client.    
   
   
       10 . The method as described in  claim 9  and further comprising: 
 confirming the value of said returned_nonce at said server; and then    continuing with said key management session.    
   
   
       11 . The method as described in  claim 7  and further comprising: 
 receiving at said server said client key management response message comprising a false_nonce from said client;    determining that said false_nonce does not match said server_nonce;    determining that said server did not initiate said key management session since said false_nonce does not match said server_nonce.    
   
   
       12 . A method of initiating a key management session for a cable telephony adapter (CTA) and a Signaling Controller in an IP Telephony network, the method comprising: 
 providing said Signaling Controller;    providing said CTA configured to be coupled with said Signaling Controller;    providing a key distribution center (KDC) configured to be coupled with said signaling controller and coupled with said KDC;    issuing a ticket to said CTA by said KDC;    generating a trigger message at said Signaling Controller;    generating a nonce at said Signaling Controller;    coupling said nonce with said trigger message;    transmitting said nonce coupled with said trigger message from said Signaling Controller to said CTA so as to initiate said key management session by said Signaling Controller;    generating a response message to said trigger message comprising said ticket;    using the value of said nonce as the value of a returned_nonce;    coupling said response message with said returned_nonce;    transmitting said returned_nonce and said response message to said Signaling Controller;    comparing said returned_nonce to said nonce so as to confirm that said response message is in response to said trigger message and not in response to a message sent to said client by an attacker;    transmitting an AP reply from said Signaling Controller in reply to said response message;    transmitting an SA recovered message from said CTA to said Signaling Controller.    
   
   
       13 . (canceled)  
   
   
       14 . A method of confirming that a message received by a server from a client was triggered by the server: 
 receiving an AP request message from said client;    receiving a client_nonce from said client wherein said client_nonce is associated with said AP request;    determining whether said client_nonce matches a server_nonce previously conveyed from said server to said client.    
   
   
       15 . The method as described in  claim 14  and further comprising: 
 determining that said client_nonce does not match said server_nonce conveyed from said server; and then    disregarding said AP request.    
   
   
       16 . The method as described in  claim 15  and further comprising: 
 awaiting at said client for a reply from said server to said AP request;    aborting said AP request session after a predetermined time period if no reply is received from said server.    
   
   
       17 . The method as described in  claim 14  and further comprising: 
 determining that said client_nonce does match said server_nonce conveyed from said server; and    generating an AP reply at said server in response to said AP request.    
   
   
       18 . A system for providing key management in a Kerberos based system, said system comprising: 
 a server;    a client configured to be coupled with said server;    a key distribution center configured to act as a trusted third party for said client and said server;    computer code coupled with said server operable to initiate a key management session by said server with said client;    computer code coupled with said server operable to generate a server_nonce at said server;    computer code coupled with said server operable to convey said trigger message and said server_nonce to said client.    
   
   
       19 . (canceled)  
   
   
       20 . The system as described in  claim 18  and further comprising: 
 computer code coupled with said client operable to generate a response message to said trigger message;    computer code coupled with said client operable to convey said response message and a returned_nonce to said server.    
   
   
       21 . The system as described in  claim 20  and further comprising: 
 computer code coupled with said server operable to confirm the value of said returned_nonce at said server.