Methods and apparatus for synchronizing decryption state with remote encryption state

Patent metadata

Field	Value
Publication number	US-9900291-B2
Application number	US-201715608832-A
Country	US
Kind code	B2
Filing date	May 30, 2017
Priority date	Feb 26, 2015
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

Methods and apparatus for supporting secure packet communications, e.g., SRTP, which use implicit index numbers for synchronization and sequencing of received packets. The secure communications methods and apparatus having an adaptive index learning mode of operation and a non-adaptive index learning mode of operation. The adaptive index learning mode of operation being used to determine a correct estimated sequence number roll over counter number and the implicit index number for one of a plurality of secure packets received when an adaptive index learning process condition is satisfied.

First claim

What is claimed is:

1. A secure communications method, the method comprising:
receiving signaling information corresponding to a secure real time packet stream;
receiving a plurality of encrypted secure real time packets, said plurality of packets being a part of said secure real time packet stream, said secure real time packet stream using an implicit packet index for sequencing of packets in said secure real time packet stream, said implicit packet index being generated from a sequence number and a sequence number roll over counter number, said sequence number for each of said plurality of packets being included in each of said packets, said roll over counter number for each of said plurality of packets not being included with said packets;
determining, based at least in part on the received signaling information, whether an adaptive index learning process condition is satisfied for the secure real time packet stream; and
storing in memory an indication that the adaptive index learning process condition is satisfied when said determination is that said condition is satisfied; and
when said adaptive index learning process condition is satisfied using an adaptive index learning process to determine a correct estimated sequence number roll over counter number for one of said plurality of received packets, and

after determining said correct estimated sequence number roll over counter number for one of said plurality of received packets storing in said memory an indication that said adaptive index learning process condition is no longer satisfied; and
wherein said adaptive index learning process includes:
setting an estimated sequence number roll over counter number to zero after a determination that said adaptive index learning process condition is satisfied for the secure real time packet stream;
performing an authentication test on one or more of the received packets received using said estimated sequence number roll over counter number; and
when said authentication test fails discarding each packet which fails the authentication test and incrementing said estimated sequence number roll over counter number after a predetermined number of received packets fail said authentication test, and
when said authentication test passes accepting said packet as being valid.

2. The method of claim 1 wherein said predetermined number of received packets is one, said method further including:
generating a first packet index sequence number using a first sequence number and said estimated sequence number roll over counter number set to zero when it is determined that said adaptive index learning process condition exists, said first sequence number being included in a first packet received after determining that said adaptive index learning process condition exists; and
wherein said performing an authentication test on one or more of the received packets using said estimated sequence number roll over counter number includes performing an authentication test on said first packet using said estimated sequence number roll over counter number and authentication information included in said first received packet; and
when said authentication test on said first packet fails generating a second packet index sequence number using a second sequence number and said incremented estimated sequence number roll over counter number, said second sequence number being included in a second packet received after said first packet.

3. The method of claim 2 further including performing an authentication test on said second packet using said incremented estimated sequence number roll over counter number and authentication information included in said second received packet and discarding said second packet and incrementing said estimated sequence number roll over counter number when said authentication test fails.

4. The method of claim 1 , wherein said signaling information includes at least one of the following: session control signaling information, call flow signaling information or decryption device status signaling information.

5. The method of claim 4 , wherein said plurality of encrypted secure real time packets are part of a Voice Over Internet Protocol (VOIP) call and wherein determining, based at least in part on the received signaling information, whether an adaptive index learning process condition is satisfied for the secure real time packet stream includes determining that said adaptive index learning process condition is satisfied for the secure real time packet stream when said signaling information is call flow signaling information indicating that said VOIP call is resuming after having been placed on hold.

6. The method of claim 4 , wherein said plurality of encrypted secure real time packets are part of a Voice Over Internet Protocol (VOIP) call received at a standby Session Border Controller and wherein determining, based at least in part on the received signaling information, whether an adaptive index learning process condition is satisfied for the secure real time packet stream includes determining that said adaptive index learning process condition is satisfied for the secure real time packet stream when said signaling information includes status information indicating that the processing of said VOIP call is to be switched from an active Session Border Controller servicing said VOIP call to said standby Session Border Controller.

7. The method of claim 4 , wherein said plurality of encrypted secure real time packets are part of a Voice Over Internet Protocol call received at a Session Border Controller and wherein determining, based at least in part on the received signaling information, whether an adaptive index learning process condition is satisfied for the secure real time packet stream includes determining that said adaptive index learning process condition is satisfied for the secure real time packet stream when said signaling information is session information indicating a change in encryption keys.

8. The method of claim 1 , wherein said adaptive index learning process further includes:
not performing anti-replay packet testing when said adaptive index learning process condition is satisfied.

9. A secure communications method, the method comprising:
receiving signaling information corresponding to a secure real time packet stream;
receiving a plurality of encrypted secure real time packets, said plurality of packets being a part of said secure real time packet stream, said secure real time packet stream using an implicit packet index for sequencing of packets in said secure real time packet stream, said implicit packet index being generated from a sequence number and a sequence number roll over counter number, said sequence number for each of said plurality of packets being included in each of said packets, said roll over counter number for each of said plurality of packets not being included with said packets;
determining, based at least in part on the received signaling information, whether an adaptive index learning process condition is satisfied for the secure real time packet stream; and
storing in memory an indication that the adaptive index learning process condition is satisfied when said determination is that said condition is satisfied; and
when said adaptive index learning process condition is satisfied using an adaptive index learning process to determine a correct estimated sequence number roll over counter number for one of said plurality of received packets, and

after determining said correct estimated sequence number roll over counter number for one of said plurality of received packets storing in said memory an indication that said adaptive index learning process condition is no longer satisfied; a

Assignees

• Sonus Networks Inc

Inventors

• Li Shiping
• Motagi Prashant
• Khederian Gregory Paul

Classifications

• H04W12/08

  Access security · CPC title

• H04M7/006

  Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer (H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42) · CPC title

• H04L65/60

  Network streaming of media packets · CPC title

• G06N99/005

  Physics · mapped topic

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title