Turn authentication using SIP channel discovery

Patent metadata

Field	Value
Publication number	US-11533179-B2
Application number	US-202016992349-A
Country	US
Kind code	B2
Filing date	Aug 13, 2020
Priority date	Aug 13, 2020
Publication date	Dec 20, 2022
Grant date	Dec 20, 2022

Abstract

In one embodiment, an endpoint in a network sends a Session Initiation Protocol (SIP) registration request to a device. The device generates a first key using information included in the SIP registration request. The device also writes the first key to a storage location accessible by a Traversal Using Relays around Network address translators (TURN) server. The endpoint generates a second key based on the information included in the SIP registration request. The endpoint sends an allocate request to the TURN server that includes the second key. The TURN server authenticates the endpoint based in part by comparing the second key to the first key. The endpoint receives an allocate response from the TURN server, after the TURN server authenticates the endpoint.

First claim

What is claimed is:

1. A method comprising:
sending, by an endpoint in a network, a Session Initiation Protocol (SIP) registration request to a device, wherein the device generates a first key using information included in the SIP registration request, and wherein the device writes the first key to a storage location accessible by a Traversal Using Relays around Network address translators (TURN) server;
generating, by the endpoint, a second key based on the information included in the SIP registration request;
sending, by the endpoint, an allocate request to the TURN server that includes the second key, wherein the TURN server authenticates the endpoint based in part by comparing the second key to the first key; and
receiving, at the endpoint, an allocate response from the TURN server, after the TURN server authenticates the endpoint.

2. The method as in claim 1 , wherein the device comprises a session border controller.

3. The method as in claim 1 , wherein generating the second key based on the information included in the SIP registration request comprises:
applying a hash to the information included in the SIP registration request.

4. The method as in claim 1 , wherein the endpoint is located behind a network address translator (NAT) in the network.

5. The method as in claim 1 , wherein the information included in the SIP registration request comprises a local network address and port of the endpoint.

6. The method as in claim 1 , wherein the information included in the SIP registration request comprises a registration identifier.

7. The method as in claim 1 , wherein the information included in the SIP registration request comprises a local session identifier.

8. The method as in claim 1 , wherein the second key is used as a password in the allocate request.

9. A method comprising:
receiving, at a device, a Session Initiation Protocol (SIP) registration request from an endpoint in a network;
generating, by the device, a first key using information included in the SIP registration request; and
writing, by the device, the first key to a storage location accessible by a Traversal Using Relays around Network address translators (TURN) server for use as credential information for the endpoint with the TURN server,
wherein the endpoint generates a second key using the information included in the SIP registration request,
wherein the endpoint sends an allocate request to the TURN server that includes the second key, and
wherein the endpoint receives an allocate response from the TURN server after the TURN server authenticates the endpoint based in part by comparing the second key to the first key.

10. The method as in claim 9 , wherein the device comprises a session border controller.

11. The method as in claim 9 , wherein generating the first key based on the information included in the SIP registration request comprises:
applying a hash to the information included in the SIP registration request.

12. The method as in claim 9 , wherein the information included in the SIP registration request comprises a local network address and port of the endpoint.

13. The method as in claim 9 , wherein the information included in the SIP registration request comprises a registration identifier or local session identifier.

14. An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
send a Session Initiation Protocol (SIP) registration request to a device, wherein the device generates a first key using information included in the SIP registration request, and wherein the device writes the first key to a storage location accessible by a Traversal Using Relays around Network address translators (TURN) server;
generate a second key based on the information included in the SIP registration request;
send an allocate request to the TURN server that includes the second key, wherein the TURN server authenticates the apparatus based in part by comparing the second key to the first key; and
receive an allocate response from the TURN server, after the TURN server authenticates the apparatus.

15. The apparatus as in claim 14 , wherein the apparatus device comprises a session border controller.

16. The apparatus as in claim 14 , wherein the apparatus is located behind a network address translator (NAT) in the network.

17. The apparatus as in claim 14 , wherein the information included in the SIP registration request comprises a local network address and port of the apparatus.

18. The apparatus as in claim 14 , wherein the information included in the SIP registration request comprises a registration identifier or local session identifier.

19. The apparatus as in claim 14 , wherein the second key is used as a password in the allocate request.

Assignees

• Cisco Tech Inc

Inventors

• Fagan Ollie
• Costello John
• Friel Owen
• West Andrew

Classifications

• H04L61/2589

  over a relay server, e.g. traversal using relay for network address translation [TURN] · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L61/2514

  between local and global IP addresses · CPC title

• H04L65/1073 Primary

  Registration or de-registration · CPC title

• H04L61/5007

  Internet protocol [IP] addresses · CPC title