Handling trust in an IP multimedia subsystem communication network

Patent metadata

Field	Value
Publication number	US-9900347-B2
Application number	US-89871807-A
Country	US
Kind code	B2
Filing date	Sep 14, 2007
Priority date	Sep 14, 2007
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

A method and apparatus for handling trust in an IP Multimedia Subsystem network. A node in the IP Multimedia Subsystem network receives a Session Initiation Protocol message from a remote node. The message includes an indicator indicating the level of trust of a communication sent from the remote node to the IP Multimedia Subsystem node. The node can then apply a security policy to the message, the security policy being determined by the indicator.

First claim

The invention claimed is:

1. A method of handling trust in an IP Multimedia Subsystem network, the method comprising:
at a node in the IP Multimedia Subsystem network, receiving a Session Initiation Protocol (SIP) message from a remote node, the SIP message including a standardized description of factors that affect a level of trust that is to be accorded to a communication sent from the remote node to the node;
accessing a database to look up a security policy mapped to the standardized description of factors included in the SIP message, wherein the database maps each of a plurality of predetermined possible combinations of factors that affect the level of trust to a security policy; and
applying the security policy to the SIP message,
wherein the standardized description of factors that affect the level of trust is determined in accordance with information selected from any of user terminal type, encryption type, network type, node type, end user authentication mechanism, and intra-domain security mechanism, and
wherein the security policy is selected from any of removing a P-Asserted Identity header, applying topology hiding, disallowing the communication, allowing the communication with no modification, filtering the SIP message in accordance with a database of allowable message sources, and applying malware detection on incoming signalling relating to the SIP message.

2. The method of handling trust in the IP Multimedia Subsystem network according to claim 1 , where the remote node is disposed in another network.

3. The method of handling trust in the IP Multimedia Subsystem network according to claim 1 , further comprising applying the security policy to all signalling associated with the SIP message.

4. The method of handling trust in the IP Multimedia Subsystem network according to claim 1 , the method further comprising mapping the standardized description of factors to the security policy.

5. The method of handling trust in the IP Multimedia Subsystem network according to claim 4 , wherein the standardized description of factors that affect the level of trust comprises a plurality of indicator elements, each indicator element relating to a level of trust of a different node in a signalling path between the remote node and the node.

6. The method of handling trust in the IP Multimedia Subsystem network according to claim 4 , wherein the standardized description of factors that affect the level of trust comprises a plurality of indicator elements, each indicator element relating to a level of trust of a different node in a signalling path between the remote node and the node, and at least one of the indicator elements comprising an indication of a network from which the SIP message was received.

7. The method of handling trust in the IP Multimedia Subsystem network according to claim 1 , wherein the security policy is applied at one of a border element, an Application Server, User Equipment, and a Call Session Control Function.

8. A node for use in an IP Multimedia subsystem network, the node comprising:
a receiver configured to receive a Session Initiation Protocol (SIP) message from a remote node, the SIP message including a standardized description of factors that affect a level of trust that is to be accorded to a communication sent from the remote node to the node; and
a processor configured to:
access a database to look up a security policy mapped to the standardized description of factors included in the SIP message, wherein the database maps each of a plurality of predetermined possible combinations of factors that affect the level of trust to a security policy; and
apply the security policy to the SIP message,

wherein the standardized description of factors that affect the level of trust is determined in accordance with information selected from any of user terminal type, encryption type, network type, node type, end user authentication mechanism, and intra-domain security mechanism, and
wherein the security policy is selected from any of removing a P-Asserted Identity header, applying topology hiding, disallowing the communication, allowing the communication with no modification, filtering the SIP message in accordance with a database of allowable message sources, and applying malware detection on incoming signalling relating to the SIP message.

9. The node according to claim 8 , wherein the node is selected from one of User Equipment, a Call Session Control Function, a border element, and an Application Server.

10. A node for use in a communications network, the node comprising:
a processor configured to collect trust level information relating to factors that affect a level of trust that is to be accorded to a communication sent from the node,
the processor being further configured to:
generate a standardized description of factors that affect the level of trust, the standardized description of factors being one of a plurality of predetermined possible combinations of factors that affect the level of trust and mapped to a security policy; and
modify a Session Initiation Protocol message such that the Session Initiation Protocol message includes the standardized description of factors that affect the level of trust; and

a transmitter configured to send the Session Initiation Protocol message,
wherein the standardized description of factors that affect the level of trust is determined in accordance with information selected from any of user terminal type, encryption type, network type, node type, end user authentication mechanism, and intra-domain security mechanism, and
wherein the security policy is selected from any of removing a P-Asserted Identity header, applying topology hiding, disallowing the communication, allowing the communication with no modification, filtering the SIP message in accordance with a database of allowable message sources, and applying malware detection on incoming signalling relating to the SIP message.

11. The node according to claim 10 , wherein the processor is arranged to modify an existing standardized description of factors that affect the level of trust in a Session Initiation Protocol message by adding a trust level indicator element to the existing standardized description of factors that affect the level of trust, the trust level indicator element relating to a trust level of the node or a network in which the node is disposed.

12. The node according to claim 10 , wherein the node is selected from one of User Equipment, a Call Session Control Function, a border element, and an Application Server.

13. A method of handling trust in an IP Multimedia Subsystem network, the method comprising:
at a node, collecting trust level information relating to factors that affect a level of trust that is to be accorded to a communication sent from the node;
from the trust level information, creating a standardized description of factors that affect the level of trust, the standardized description of factors being one of a plurality of predetermined possible combinations of factors that affect the level of trust and mapped to a security policy; and
adding the standardized description of factors that affect the level of trust to a Session Initiation Protocol message,
wherein the trust level information is based on any of database information, user terminal type, encryption type, network type, node type, end user authentication mechanism, and intra-domain security mechanism
wherein the security policy is selected from any of removing a P-Asserted Identity header, applying topology hiding, disallowing the communication, allowing the communication with no modification, filtering the SIP message in accordance

Assignees

• Lindholm Fredrik
• Hedman Peter
• Wifvesson Monica
• Ericsson Telefon Ab L M

Inventors

• Lindholm Fredrik
• Hedman Peter
• Wifvesson Monica

Classifications

• H04L65/1016

  IP multimedia subsystem [IMS] · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L65/1006

  Electricity · mapped topic

• H04L65/1079

  of unsolicited session attempts, e.g. SPIT · CPC title

• H04L65/1104

  Session initiation protocol [SIP] · CPC title