Secure key management in conferencing system

<u>Field of the Invention</u>

0001The present invention relates generally to communication security and, more particularly, to a secure key management protocol for use in communication environments such as a media plane of a multimedia communication system and a call conferencing system.

<u>Background of the Invention</u>

0002Existing multimedia applications offered in a multimedia communication system do not support security in the media plane. Concern over media plane security is a relatively new problem.

0003Existing proposals in a multimedia communication system such as the Internet Protocol (IP) Multimedia Subsystem (IMS) are based on some kind of token based symmetric key methods, managed using a key management server that potentially creates and distributes keys. 3GPP (3^rd Generation Partnership Project) Technical Report (TR) 33.828, the disclosure of which is incorporated by reference herein, discusses existing proposals for IMS media plane encryption. However, these existing solutions are not scalable (since the server should be highly available and online all the time), do not provide authentication of entities, and, in addition, escrow keys at the server.

0004Conversely, non-IMS applications such as SKYPE (tradename of Skype Technologies S.A. of Luxembourg) and other client-to-client multimedia applications provide end-to-end privacy with authentication and no key-escrow. However, the solution relies of the use of certificates which require a highly available public key infrastructure (PKI) which is extremely expensive to manage. Moreover, the solution does not scale well for group conferencing applications, nor does it provide for lawful intercept of communications in the absence of a PKI.

0005The document titled "<nplcit id="ncit0001" npl-type="b"><text>Identity-based Fault-Tolerant Conference Key Agreement" (IEEE Transactions on dependable and secure computing, IEEE Service Center, New York, NY, US, (2004-03-01), pages 170-178</text></nplcit>, XP011123191) discloses an identity-based key agreement, built on elliptic curve cryptography. It is resistant to the different key attack from malicious conferees and needs little communication costs.

0006Furthermore, similar key management security concerns exist in conferencing systems where parties participate in call sessions through a conference server.

0007Thus, a need exists for a secure key management solution for use in communication environments such as a media plane of a multimedia communication system and a call conferencing system.

<u>Summary of the Invention</u>

0008Principles of the invention provide one or more secure key management protocols for use in a communication environment such as a conferencing system.

0009For example, in one aspect, a method for managing a conference between two or more parties in a communication system comprises the following steps. An identity based authenticated key exchange operation is performed between a conference management element of the communication system and each of the two or more parties seeking to participate in the conference, wherein messages exchanged between the conference management element and the two or more parties are encrypted based on respective identities of recipients of the messages, and further wherein the conference management element receives from each party during the key authentication operation a random key component that is computed based on a random number selected by the party.

0010The conference management element sends to each party a set comprising the random key components computed by the parties. The conference management element receives from each party a random group key component, wherein the random group key component is computed by each party via a computation based on the random number used by the party during the key authentication operation and the random key components computed by a subset of others of the two or more parties seeking to participate in the conference.

0011The conference management element sends to each party a set comprising the random group key components computed by the parties such that each party can compute the same group key for use in communicating with each other party through the conference management element.

0012In one embodiment, the conference management element is not a participating party in the conference and thereby is unable to compute the group key. In another embodiment, the conference management element is a participating party in the conference call and thereby is able to compute the group key.

0013In one embodiment, the group key computed by each party is represented as: N<i>a</i>_i (Z_i-1) + (N-1)X_i + (N-2)X_i+1 + ...+ X_i-2, where N represents the total number of parties seeking to participate in the conference, <i>a</i>_i represents the random number selected by the given party, Z_i represents the random key component computed by the given party, X_i represents the random group key component computed by the given party, and i represents a number of a conference ordering for the given party in the N-party conference with i-1=N when i=1 and i+1=1 when i=N.

0014In one embodiment, the random key component for a given party is computed by a computation represented as: <i>a</i>_iP, where <i>a</i>_i is the random number selected by the given party and P is a point selected from a group associated with the identity encryption-based key authentication operation.

0015In one embodiment, the random group key component for a given party is computed by a computation represented as: <i>a</i>_i(<i>a</i>_i+1P <i>- a</i>_i-1P), where <i>a</i>_i is the random number selected by the given party, <i>a</i>_i+1P is the random key component sent to the conference management element by the party immediately following the given party in the conference ordering, <i>a</i>_i-1P is the random key component sent to the conference management element by the party immediately preceding the given party in the conference ordering, and P is a point selected from a group associated with a cryptographic key exchange protocol.

0016It is to be appreciated that while principles of the invention are particularly suitable to an Internet Protocol (IP) Multimedia Subsystem (IMS) environment, the invention is not intended to be so limited. That is, principles of the invention are generally applicable to any suitable communication system in which it is desirable to provide secure key management features.

0017These and other objects, features and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings.

<u>Brief Description of the Drawings</u>

0018<ul id="ul0001" list-style="none" compact="compact"><li><figref idref="f0001">FIG. 1A</figref> illustrates a private key acquisition methodology according to an embodiment of the invention;</li><li><figref idref="f0002">FIG. 1B</figref> illustrates an identity based authenticated key exchange methodology according to an embodiment of the invention;</li><li><figref idref="f0003">FIG. 2</figref> illustrates a key forking methodology according to an embodiment of the invention;</li><li><figref idref="f0004">FIG. 3</figref> illustrates a call redirection methodology according to an embodiment of the invention;</li><li><figref idref="f0005">FIG. 4A</figref> illustrates a deferred delivery methodology according to an embodiment of the invention;</li><li><figref idref="f0006">FIG. 4B</figref> illustrates a deferred delivery methodology according to another embodiment of the invention;</li><li><figref idref="f0007">FIG. 5</figref> illustrates a lawful intercept methodology according to an embodiment of the invention;</li><li><figref idref="f0008">FIG. 6A</figref> illustrates a conferencing management methodology according to an embodiment of the invention;</li><li><figref idref="f0009">FIG. 6B</figref> illustrates addition of a participant in a conferencing management methodology according to an embodiment of the invention;</li><li><figref idref="f0010">FIG. 6C</figref> illustrates deletion of a participant in a conferencing management methodology according to an embodiment of the invention;</li><li><figref idref="f0011">FIG. 7</figref> illustrates network architecture for a secure key management protocol according to an IMS-based embodiment of the invention;</li><li><figref idref="f0012">FIG. 8</figref> illustrates a key forking methodology according to an IMS-based embodiment of the invention;</li><li><figref idref="f0013">FIG. 9</figref> illustrates a redirection methodology according to an IMS-based embodiment of the invention;</li><li><figref idref="f0014">FIG. 10</figref> illustrates a conferencing methodology with three participants according to an IMS-based embodiment of the invention; and</li><li><figref idref="f0015">FIG. 11</figref> illustrates a generalized hardware architecture of a data network and communication (computing) devices suitable for implementing one or more of the protocols according to embodiments of the present invention.</li></ul>

<u>Detailed Description of Preferred Embodiments</u>

0019The phrase "multimedia communication system" as used herein is generally defined as any communication system capable of transporting two of more types of media involving, but not limited to, text-based data, graphics-based data, voice-based data and video-based data.

0020The phrase "media plane" as used herein is generally defined as the functional portion of the multimedia communication system in accordance with which the one or more types of media are exchanged between two or more parties in a call session. This is in contrast with a "control plane" which is the functional portion of the multimedia communication system in accordance with which call negotiation/scheduling is performed in order to establish the call session. Examples of media plane applications with which the inventive techniques can be used include, but are not limited to, Voice-over-IP (VoIP), Instant Messaging (IM), Video/Audio IM, and Video Share. It is understood that the media plane contains application layer traffic.

0021The term "key" as used herein is generally defined as an input to a cryptographic protocol, for purposes such as, but not limited to, entity authentication, privacy, message integrity, etc.

0022For ease of reference, the detailed description is divided as follows. Section I describes general principles of identity based encryption and identity based authenticated key exchange operations. Section II describes secure key management solutions according to illustrative principles of the invention in a general communication environment context. Section III describes secure key management solutions according to illustrative principles of the invention in an Internet Protocol (IP) Multimedia Subsystem (IMS) environment context. Section IV describes an illustrative computing system for implementing one or more secure key management protocols according to the invention.

I. Identity Based Encryption (IBE) and Identity Based Authenticated Key Exchange (IBAKE)

0023Prior to an explanation of illustrative embodiments of secure key management techniques of the invention, general principles of IBE and IBAKE are provided.

A. Identity Based Encryption

0024An Identity Based Encryption (IBE) protocol was presented by Boneh and Franklin, see<nplcit id="ncit0002" npl-type="s"><text> Dan Boneh, Matthew K. Franklin, "Identity-Based Encryption from the Weil Pairing" Advances in Cryptology - Proceedings of CRYPTO 2001 (2001</text></nplcit>), the disclosure of which is incorporated by reference herein. This asymmetric cryptographic encryption protocol allows participants to use an 'identity' (example: email-id, or domain name) as the public key and eliminates the need for large scale public key infrastructure which is often associated with public key encryption methods such as RSA (Rivest, Shamir and Adleman). Boneh and Franklin's approach to the problem uses bilinear maps on an elliptic curve over a finite field, and relies on the bilinear decisional Diffie-Hellman problem.

0025IBE involves the following mathematical tools and parameters: <ul id="ul0002" list-style="none" compact="compact"><li>Let E be an elliptic curve over a finite field F, and let P be a point of large prime order.</li><li>Let e: E x E - → G be a bi-linear map on E. The typical example is the Weil pairing, and hence G will be the group of n-th roots of unity where n is a function of the number of points on E over F.</li><li>Let s be a non-zero positive integer and be a secret stored in a Key Generation Function (KGF). This is a system-wide secret and not revealed outside the KGF.</li><li>Let P_pub = sP be the public key of the system that is known to all participants. Recall sP denotes a point in E, since E is a group.</li><li>Let H₁ be a known hash function that takes a string and assigns it to a point on the elliptic curve, i.e., H₁(A) = Q_A on E, where A is usually the identity, and is also the public key of A.</li><li>Let d_A = sQ_A be the private key computed by the KGF and delivered only to A.</li><li>Let H₂ be a known hash function that takes an element of G and assigns it to a string.</li><li>Let m be a message that has to be encrypted and sent to A. The encryption function described by Boneh and Franklin is as follows:</li><li>Let g_A = e(Q_A, P_pub), and let r be a random number.</li></ul>

0026Encryption_A(m) = (rP, m xor H₂(g_A^r)); in other words the encryption output of m has two coordinates u and v where u = rP and v = m xor H₂(g_A^r). Note that "xor" refers to the exclusive OR logic function.

0027In order to decrypt (u,v), A recovers m using the following formula: <maths id="math0001"><math display="block"><mi mathvariant="normal">m</mi><mo mathvariant="normal">=</mo><mi>v xor</mi><mspace width="1em" /><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">2</mn></msub><mfenced><mi mathvariant="normal">e</mi><mfenced><msub><mi mathvariant="normal">d</mi><mi mathvariant="normal">A</mi></msub><mi mathvariant="normal">u</mi></mfenced></mfenced><mn mathvariant="normal">.</mn></math><img file="EP2471211B1_D0001.tif" /></maths>

0028The proof of the formula is a straight forward exercise in bilinear maps, and the fact A has the secret d_A (private key known only to A but not other participants). Also observe that the KGF, which computed d_A in the first place, can also decrypt the message resulting in the KGF being a de-facto key escrow server.

B. Identity Based Authenticated Key Exchange

0029Identity Based Authenticated Key Exchange (IBAKE) is described in the <patcit id="pcit0001" dnum="US37224209A" dnum-type="L"><text>U.S. patent application identified by Serial No. 12/372,242, filed on February 17, 2009</text></patcit>, the disclosure of which is incorporated by reference herein. The IBAKE protocol allows devices to mutually authenticate each other, and derive a key that provides perfect forwards and backwards secrecy.

0030In the IBAKE embodiment described here, the basic set up for this protocol involves the mathematical constructs and parameters discussed above in subsection A. Recall that this protocol is asymmetric but does not require any PKI support; instead the protocol employs an offline server which serves as a Key Generation Function. The details of the protocol are outlined below:

0031Suppose A, B are the two entities (or parties, where A represents a computer system of a first party and B represents a computer system of a second party) that are attempting to authenticate and agree on a key.

0032We will use A and B to represent their corresponding identities, which by definition also represent their public keys.

0033Let H₁(A)=Q_A and H₁(B)=Q_B be the respective points on the elliptic curve corresponding to the public keys. In effect, one could refer to Q_A and Q_B as the public keys as well, since there is a one-to-one correspondence between the identities and the points on the curve obtained by applying H₁.

0034Let x be a random number chosen by A, and let y be a random number chosen by B.

0035The protocol exchanges between A and B comprises of the following steps:

0036A computes xP (i.e., P added to itself x times as a point on E, using the addition law on E) encrypts it using B's public key, and transmits it to B in a first step. In this step, encryption refers to identity based encryption described in subsection A above.

0037Upon receipt of the encrypted message, B decrypts the message and obtains xP. Subsequently B computes yP, and encrypts the pair {xP, yP} using A's public key and then transmits it to A in a second step.

0038Upon receipt of this message, A decrypts the message and obtains yP. Subsequently, A encrypts yP using B's public key and sends it back to B in a third step.

0039Following this, both A and B compute xyP as the session key.

0040Observe that A chose x randomly, and received yP in the second step of the protocol exchange. This allows A to compute xyP by adding yP to itself x times. Conversely, B chose y randomly, and received xP in the first step of the protocol exchange. This allows B to compute xyP by adding xP to itself y times. Note that any application of the protocol may utilize header data with the identities to ensure proper functioning of the protocol. This is relatively standard and applicable to almost any protocol exchange for key agreement.

0041Note also that x is random but xP provides no information about x. Therefore, xP is a component of a key based on a random secret chosen by A. Likewise, y is random but yP provides no information about y. Hence, yP is a component of a key based on a random secret known only to B.

0042Note further that xyP can serve as a session key. Also, the session key could be any known function of xyP. That is, the session key could equal f(xyP), where f is known to both parties and is not required to be secret (i.e., known to the world). One practical requirement on f should be that f is hard to compute without knowledge of x or y, and the output is of a satisfactory length from a cryptographic perspective, e.g., around 128 bits or more.

0043Some of the properties of the IBAKE protocol include: <ul id="ul0003" list-style="dash" compact="compact"><li>Immunity from key escrow: Observe that all the steps in the protocol exchange are encrypted using IBE. So clearly the KGF can decrypt all the exchanges. However, the KGF can not compute the session key. This is because of the hardness of the elliptic curve Diffie-Hellman problem. In other words, given xP and yP, it is computationally hard to compute xyP.</li><li>Mutually Authenticated Key Agreement: Observe that all the steps in the protocol exchange are encrypted using IBE. In particular, only B can decrypt the contents of the message sent by A in the first and third steps, and similarly only A can decrypt the contents of the message sent by B in the second step. Moreover, at the end of the second step, A can verify B's authenticity since xP could have been sent in the second step only after decryption of the contents in the first step by B. Similarly, at the end of the third step, B can verify A's authenticity since yP could have been sent back in the third step only after correctly decrypting the contents of the second step and this is possible only by A. Finally, both A and B can agree on the same session key. In other words, the protocol is a mutually authenticated key agreement protocol based on IBE. While the above description provides the motivation for the security of the protocol, a cryptographic proof of security can be easily provided. The hardness of the protocol relies on the hardness of the Elliptic curve Diffie-Hellman problem, which is influenced by the choice of elliptic curve.</li><li>Perfect forward and backwards secrecy: Since x and y are random, xyP is always fresh and unrelated to any past or future sessions between A and B.</li><li>No passwords: the IBAKE protocol does not require any offline exchange of passwords or secret keys between A and B. In fact, the method is clearly applicable to any two parties communicating for the first time through any communication network. The only requirement is to ensure that both A and B are aware of each other's public keys, for example, through a directory service.</li></ul>

II. Secure Key Management and Illustrative Extensions

0044It has been realized that the Internet has rapidly evolved from a best effort data network into a multi-service IP (Internet Protocol) network with support for various classes of traffic including multimedia. This coupled with the rapid growth of mobile wireless networks, has created technology challenges. From the technology perspective, a central challenge that has been addressed reasonably well is the separation of call control functions, consisting of signaling to setup calls, from application layer traffic often referred to as the "media plane." Call control protocols such as H323 (see, e.g., International Telecommunications Union Standardization Section (ITU-T) Recommendation H.323, the disclosure of which is incorporated by reference herein), Session Initiation Protocol or SIP (see, e.g., Internet Engineering Task Force IETF RFC 3261, the disclosure of which is incorporated by reference herein), and IMS (see, e.g., 3GPP Technical Specifications TS 23.218, TS 23.228, TS 24.228, TS 24.229, and TS 24.930, the disclosures of which are incorporated by reference herein) have been standardized by various organizations such as IETF and 3GPP and are in various stages of adoption across fixed and mobile networks.

0045Simultaneously, elaborate mechanisms to secure signaling at various levels have been incorporated. However, in the media plane, while protocols such as Transport Layer Security or TLS (see, e.g., IETF RFC 2246, the disclosure is incorporated by reference herein), Secure Real-time Transport Protocol or SRTP (see, e.g., IETF RFC 3711, the disclosure is incorporated by reference herein), and Secure Multi-Purpose Internet Mail Extensions or SMIME (see, e.g., IETF RFC 2633, the disclosure is incorporated by reference herein) provide container formats for various applications, the security solutions in the media plane lack coherent and standardized methods to support end-to-end secure key management in the application layer.

0046Principles of the invention primarily address this issue. In particular, principles of the invention provide a scalable application and protocol agnostic secure key management framework for the media plane. In an illustrative framework, the inventive solutions utilize the asymmetric (hence public key) Identity Based Authenticated Key Exchange (IBAKE) protocol described above in section I.B. Illustrative embodiments describe key exchange mechanisms to support various features such as, for example, secure two party media plane communications, secure multi-party conferencing, secure call forking, secure call re-direct, and secure deferred delivery applications. In addition to providing a scalable framework for secure key management, some exemplary aspects of the design and framework include: <ul id="ul0004" list-style="dash" compact="compact"><li>The use of offline key management servers (KMS) that dramatically reduce the complexity of network support required. Recall that asymmetric protocols in a public key setting require elaborate always on Public Key Infrastructure (PKI) support for certificate management including revocation. Symmetric key based Key Management Servers are by definition "always on" servers, with constant synching and updates. By eliminating the "always on" requirement, our framework dramatically reduces costs and abets scalability.</li><li>The elimination of any passive key escrow that is inherent in identity based protocols. Recall that symmetric key protocols with a Key Management Server can not eliminate this problem. Also, recall that existing Identity Based Encryption (described above in section I.A.) protocols suffer from key escrow problems; a problem that is solved using IBAKE (described above in section I.B.).</li><li>The protocol framework inherently supports mutual authentication of entities involved in the key exchange, coupled with perfect secrecy.</li><li>Illustrative embodiments of the invention re-use existing network element architectures, and as much as possible, re-use existing protocol container formats. As an example, in conferencing applications, illustrative embodiments re-use the conference server to enable conferencing but ensure that the conference server does not learn the group key used for communication (unless it is also a party to the conference as will be explained below).</li><li>While principles of the invention eliminate passive key escrow, the inventive protocols also provide seamless support for discovering keys when there is a legal requirement for law enforcement to intercept calls.</li></ul>

0047In illustrative embodiments based on an identity based asymmetric cryptographic framework, each participant has a public key and a private key. The public key is identity based. The private key corresponds to the public key and is issued by a key management server or service (KMS). Participants can obtain private keys from the KMS offline. By way of example only, participants contact their KMS once a month (more generally, for the length of a subscription) to obtain private keys. Private keys may also be obtained as a function of frequency of use. A security association is assumed to exist between the KMS and the participant. Encryption and decryption of messages during the key exchange are based on IBE. Note that public parameters of the KMS are assumed to be publicly available (e.g., online on a website).

0048In general, a secure key management methodology according to an illustrative embodiment of the invention comprises two main stages. In a first stage, participants (parties) obtain private keys from a key service such as a KMS. In the second stage, an identity based authenticated key exchange is performed between two or more parties seeking to communicate in a multimedia based call session. Messages exchanged between the two or more parties are encrypted based on respective identities of recipients of the messages. Also, the encrypted messages exchanged between the parties contain identities associated with parties.

0049<figref idref="f0001">FIG. 1A</figref> shows the first stage of the secure key management methodology, i.e., private key acquisition. As shown, communication devices (more generally, computing devices) 102 of two parties each request and obtain private (or secret) keys from a respective KMS 104. The private key exchange 106 is performed according to a secure communication protocol. Examples of secure communications protocol include, but are not limited to, Internet Protocol Security or IPSec (see, e.g., IETF RFC 2406, IETF RFC 2409, IETF RFC 4306, and IETF RFC 4308, the disclosures of which are incorporated by reference herein) and Transport Layer Security or TLS (see, e.g., IETF RFC 2246, the disclosure is incorporated by reference herein). Generalized Bootstrap Architecture or GBA (see, e.g., 3GPP Technical Specification (TS) 33.220, the disclosure of which is incorporated by reference herein) may be used to determine a key to use in the secure communications protocol between each party and the KMS. In one example, one could have an application running in the client device that connects to the KMS server and uses TLS in the application layer (above Transport Control Protocol or TCP, see, e.g., <nplcit id="ncit0003" npl-type="s"><text>W. Richard Stevens. TCP/IP Illustrated, Volume 1: The Protocols, ISBN 0-201-63346-9</text></nplcit>; <nplcit id="ncit0004" npl-type="s"><text>W. Richard Stevens and Gary R. Wright. TCP/IP Illustrated, Volume 2: The Implementation, ISBN 0-201-63354-X</text></nplcit>; <nplcit id="ncit0005" npl-type="s"><text>W. Richard Stevens. TCP/IP Illustrated, Volume 3: TCP for Transactions, HTTP, NNTP, and the UNIX Domain Protocols, ISBN 0-201-63495-3</text></nplcit>, the disclosures of which are incorporated by reference herein) which uses the GBA key or IPSec at the network layer with the GBA key as the pre-shared key.

0050Note that the device on the left is considered the initiator (I) and the one on the right is the responder (R). This designation comes from the fact that the device on the left seeks to initiate a multimedia call session with the device on the right.

0051As shown, each device provides an identifier with its request to the KMS to which the KMS responds with a private (secret) key. In the case of the initiator device 102-1, one identifier is provided to the KMS 104-I, and one private key I-SK is provided to the device in response. In the case of the responder device 102-R, two separate identifiers are sent to the KMS 104-R, i.e., R and R1. In response, the KMS provides the responding party with two private keys R_SK and R1_SK. Of course, each party may request and obtain more or less private keys based on some private key acquisition schedule. This may be a time-based schedule (e.g., one month period), a call session frequency-based schedule (e.g., when needed to make a call), and a subscription-based schedule (e.g., the party subscribes to the key service of the KMS for some length of time or based on an occurrence of a subscription ending condition).

0052Also, it is to be appreciated that a given party may have multiple public identities. For example, party B ("Bob") may have two identities: bob@work.com and bob@home.com. For these two identities, there can be two different public keys and thus two different private keys.

0053<figref idref="f0002">FIG. 1B</figref> shows the second stage of the secure key management methodology, i.e., authenticated key exchange. In this embodiment, the authenticated key exchange is based on IBAKE (described above in section I.B.). Since a preferred format of the messages exchange between the first party and the second party is based on a Multimedia Internet Keying (MIKEY) format, the overall secure key exchange protocol of <figref idref="f0001">FIGs. 1A</figref> and <figref idref="f0002">1B</figref> is therefore referred to herein as a MIKEY-IBAKE protocol.

0054Again, it is assumed that the device on the left is the initiating party or initiator, 102-I, and the device on the right is the responding party or responder, 102-R. The steps of the authenticated key exchange follow steps similar to the IBAKE protocol.

0055It is assumed that the initiator's public key I_PK is computed by using a hash function as described above in section I. Likewise, the responder's public key R_PK is computed in a similar manner. Recall that the private keys of the initiator and responder are I_SK and R_SK, respectively. That is, let H₁(Initiator_ID)=I_PK and H₁(Responder_ID)=R_PK be the respective points on the elliptic curve corresponding to the public keys.

0056Let <i>a</i> be a random number chosen by initiator 102-I, and let b be a random number chosen by responder 102-R.

0057The protocol exchanges between 102-I and 102-R comprise of the following steps: <ul id="ul0005" list-style="none" compact="compact"><li>Initiator 102-I computes a first random key component <i>a</i>P (i.e., P added to itself <i>a</i> times as a point on E, using the addition law on E), encrypts the first random key component using the responder's public key (R_PK), and transmits it to the responder 102-R in step 110. In this step, encryption refers to identity based encryption described in subsection I.A. above. Note that also included in the encrypted message in step 110 are the identities of the initiator and the responder (I_ID and R_ID, respectively).</li></ul>

0058Upon receipt of the encrypted message, the responder decrypts the message using its private key (obtained in <figref idref="f0001">FIG. 1A</figref>) and obtains <i>a</i>P. Subsequently, the responder computes a second random key component <i>b</i>P, and encrypts the pair {<i>a</i>P, <i>b</i>P} using the initiator's public key and then transmits the pair to the initiator in step 112. Again, the encrypted message in step 112 includes the identities of the initiator and the responder (I_ID and R ID, respectively).

0059Upon receipt of the message from step 112, the initiator decrypts the message using its private key (obtained in <figref idref="f0001">FIG. 1A</figref>) and obtains <i>b</i>P. Subsequently, the initiator encrypts <i>b</i>P using the responder's public key and sends it back to the responder in step 114. Again, the encrypted message in step 114 includes the identities of the initiator and the responder (I_ID and R_ID, respectively).

0060In step 116, the responder sends a verification message to the initiator encrypted using the public key of the initiator.

0061Following this, both initiator and responder compute <i>ab</i>P as the secure call session key to be used for secure communicating with each other during the call session via the media plane (application layer) of the multimedia communication system.

0062Observe that the initiator 102-I chose <i>a</i> randomly, and received <i>b</i>P in the second step of the protocol exchange. This allows the initiator to compute <i>ab</i>P by adding <i>b</i>P to itself <i>a</i> times. Conversely, the responder 102-R chose <i>b</i> randomly, and received <i>a</i>P in the first step of the protocol exchange. This allows the responder to compute <i>ab</i>P by adding <i>a</i>P to <b>itself <i>b</i></b> times. Note also that <i>a</i> is random but <i>a</i>P provides no information about <i>a</i>. Therefore, <i>a</i>P is considered a component of a key based on a random secret chosen by the initiator. Likewise, <i>b</i> is random but <i>b</i>P provides no information about <i>b.</i> Hence, <i>b</i>P is considered a component of a key based on a random secret known only to the responder.

0063Referring now to <figref idref="f0003">FIG. 2</figref>, an extension of the MIKEY-IBAKE protocol is illustrated. It is to be understood that since this is an extension of the MIKEY-IBAKE protocol described above, for the sake of simplicity, not all features of the MIKEY_IBAKE protocol are repeated. In this particular embodiment, <figref idref="f0003">FIG. 2</figref> illustrates forking. Forking is the delivery of a request to multiple locations. This may happen, for example, when the responder has more than one communication (computing) device on which he/she can participate in a multimedia call session. One example of forking is when a party has a desk phone, a personal computer (PC) client, and mobile handset, all configured to participate in the MIKEY-IBAKE protocol. In general, forking is a feature of a multi-media session initiation protocol than enables an incoming call to simultaneously ring several extensions. The first telephone to answer will then take control of the call.

0064Thus, as depicted in <figref idref="f0003">FIG. 2</figref>, the responding party has two devices 102-R1 and 102-R2 associated therewith. Thus, as shown, device 102-R1 has a public key R1_PK and a secret key R1_SK. Also, device 102-R1 knows the responding party's public and private keys, R_PK and R_SK. Likewise, device 102-R2 has a public key R2_PK and a secret key R2_SK. Also, device 102-R2 knows the responding party's public and private keys, R_PK and R_SK.

0065The MIKEY-IBAKE protocol steps 210, 212, 214 and 216 in the forking scenario are essentially the same as the MIKEY-IBAKE protocol steps 110, 112, 114 and 116 in the general context of <figref idref="f0002">FIG. 1B</figref>, with the following exceptions. Note that because the message sent by device 102-I in step 210 is encrypted with R_PK, both devices R1 and R2 can decrypt the message (since they both have R_SK). However, assuming that the responding party is currently associated with device R2 rather than device R1, then the return message in step 212 includes random key component b2P, computed by R2 in accordance with IBAKE (where b2 is the random number selected by R2). Also, the encrypted messages in step 212 includes the identities of the initiator, responder, and device R2 (I_ID, R_ID and R2_ID, respectively).

0066Device 102-I decrypts the message received from R2 using its private key to obtain the b2P and the identities included in the message. The initiator thus identifies that the message in step 212 came from R2. In accordance with the MIKEY-IBAKE protocol, the initiator then sends a message in step 214 including b2P, I_ID, and R2_ID. The message is encrypted using the public key of R2. Note that this can not be decrypted by R1 since R1 only has R_SK and R1_SK, but not R2_SK. Step 216 is the verification message similar to step 116 in <figref idref="f0002">FIG. 1B</figref>. The call session key can then be computed at device 102-I and at device 102-R2 as ab2P.

0067<figref idref="f0004">FIG. 3</figref> illustrates an extension of the MIKEY-IBAKE protocol to a retargeting feature. It is to be understood that since this is an extension of the MIKEY-IBAKE protocol described above, for the sake of simplicity, not all features of the MIKEY_IBAKE protocol are repeated. Retargeting or redirection is a scenario in which one or more functional elements in the communication system decide to redirect the call to a different destination. This decision to redirect a session may be made for different reasons by a number of different functional elements, and at different points in the establishment of the session. This is also known as call forwarding.

0068The example of <figref idref="f0004">FIG. 3</figref> shows an application server 302 making the redirect determination. The MIKEY-IBAKE protocol steps 310, 312, 314 and 316 in the forking scenario are essentially the same as the MIKEY-IBAKE protocol steps 110, 112, 114 and 116 in the general context of <figref idref="f0002">FIG. 1B</figref>, with the following exceptions.

0069Device 102-I sends the first message in the protocol in step 310 with the intention of it going to device 102-R1 (the message encrypted with R1's public key). However, the functional element 302 made a decision that the message in 310 should be redirected to device R2, see step 310'. Prior thereto, or in conjunction therewith, it is assumed that R2 received R1's private key in a message sent in step 308 via the functional element. The message sent from R1 to R2 is encrypted using R2's public key. Thus, functional element 302 can not decrypt the message in 308 but R2 can decrypt the message in 310' and respond to the initiator in step 312. From this point, steps 312, 314 and 316 are identical to steps 212, 214 and 216 in the forking scenario of <figref idref="f0003">FIG. 2</figref>.

0070<figref idref="f0005">FIG. 4A</figref> shows a deferred delivery extension of the MIKEY-IBAKE protocol. It is to be understood that since this is an extension of the MIKEY-IBAKE protocol described above, for the sake of simplicity, not all features of the MIKEY_IBAKE protocol are repeated. Deferred delivery is type of service such that the session content can not be delivered to the destination at the time that it is being sent (e.g., the destination user is not currently online). Nevertheless, the sender expects the network to deliver the message as soon as the recipient becomes available. One example of deferred delivery is voicemail.

0071In <figref idref="f0005">FIG. 4A</figref>, assume A is device 102-I, B is 102-R, device 402 is a functional element such as an application server, and MB is a mailbox 102-MB (more generally, a temporary destination) associated with B.

0072In step 401, A sends a first message comprising an encrypted first random key component (xP) to B. The first random key component was computed at A, and the first message was encrypted using a public key of B. The functional element 402 determines that B is unavailable, and forwards the first message to MB in step 402.

0073In step 403, MB sends to A a second message comprising an encrypted second random key component (yP) which was computed by MB. The message in step 403 was encrypted at MB using a public key of A. In step 404, functional element 402 sends the message on to A.

0074A decrypts the message from MB using the private key obtained by A from the key service to obtain the second random key component. A identifies that the message received in step 404 came from MB (due to MB's identity being included in the message).

0075In step 405, A sends a third message (via the functional element in step 406) to MB including an encrypted random key component pair, the random key component pair having been formed from the first random key component (xP) and a second random key component (yP) and encrypted at A using the public key of MB. This third message also includes an encrypted random secret key (sK) computed at A and encrypted at A using the public key of B. MB acknowledges receipt to A via steps 407 and 408. MB can not decrypt that latter part of the message (since it is encrypted using B's public key and MB does not have B's private key), and thus can not learn sK.

0076MB provides the encrypted random secret key (sK) to B upon request by B, after a mutual authentication operation between B and MB. This is shown in steps 409 and 410. This secret key is then used by B to obtain the content (e.g., voice message) left by A in B's mailbox.

0077In a variation to the deferred delivery of <figref idref="f0005">FIG. 4A</figref>, depicted in <figref idref="f0006">FIG. 4B</figref>, assume that an authenticated key agreement protocol is not performed but rather, in the first message, A sends an encrypted random secret key (sK) computed at A and encrypted at A using a public key of B (step 411). The functional element 402, having determined that B is unavailable, forwards the first message to MB (step 412), which confirms it (steps 413 and 414). Later, B can retrieve the secret key from MB in the same manner as described above (steps 415 and 416).

0078<figref idref="f0007">FIG. 5</figref> shows yet another extension of the MIKEY-IBAKE protocol. Again, it is to be understood that since this is an extension of the MIKEY-IBAKE protocol described above, for the sake of simplicity, not all features of the MIKEY_IBAKE protocol are repeated. The extension in <figref idref="f0007">FIG. 5</figref> relates to the concept of lawful interception of messages exchanged in the multimedia communication system. The concept of lawful intercept is based on a situation when a law enforcement authority needs to be able to "listen in" on communications of one or more parties.

0079In one approach, the law enforcement authority can simply obtain the private keys of 102-I and 102-R through a search warrant, and play active "man-in-the-middle" during the key agreement protocol and then tap into the traffic.

0080In another approach, shown in <figref idref="f0007">FIG. 5</figref>, a law enforcement server (LI server) 502 functions with the initiator's KMS (KMS_I) and the responder's KMS (KMS_R) to lawfully intercept messages sent between device 102-I and device 102-R. While <figref idref="f0007">FIG. 5</figref> shows separate servers for the LI server, KMS_I, and KMS_R, it is to be appreciated that one functional element (e.g., an intercept server) in the multimedia communication system may be used to perform KMS and intercept functions.

0081Accordingly, the MIKEY_IBAKE protocol as described above in the context of <figref idref="f0001">FIGs. 1A</figref> and <figref idref="f0002">1B</figref> is performed. However, the LI server imitates the initiator for messages sent to the responder, and imitates the responder for messages sent to the initiator.

0082For example, consider the message flow when the LI server imitates the responder. Assume 102-I sends a first message including an encrypted first random key component for intended receipt by 102-R. The first message is intercepted by the LI server. The LI server then computes a second random key component and sends a second message including an encrypted random key component pair to 102-I. The random key component pair is formed from the first random key component and the second random key component computed at the LI server. The second message is encrypted at the LI server using the public key of 102-I.

0083The second message is decrypted using the private key obtained by 102-I from the key service to obtain the second random key component. Device 102-I then sends a third message including the second random key component for intended receipt by 102-R, but which is intercepted by the LI server. Thus, the LI server is able to compute the same secure key that device 102-I computes.

0084It is to be understood that the LI server also imitates the initiator (102-I) in sending and receiving messages during the authenticated key agreement operation such that the responder (102-R) establishes a secure key with the LI server that the responder believes was agreed upon by the initiator (but, in fact, was agreed upon with the LI server).

0085It is to be appreciated that one or more of the MIKEY-IBAKE protocol features described above can be extended to a conferencing system scenario. Such an extension is depicted in <figref idref="f0008 f0009 f0010">FIGs. 6A through 6C</figref>.

0086The general assumption is that the conference server (more generally, the conference management element) relaying multiparty communication (e.g., a conference bridge) does not know the group key, while all the users have access to the same group key. There is an exception to this assumption, i.e., in peer-to-peer conferencing, when the computing device serving as the conference bridge is also a party substantively participating in the conference.

0087As shown in <figref idref="f0008">FIG. 6A</figref>, a multiparty conference 600 is assumed including a conference server and users (parties) 1 through N, where the user number is assigned in the order that the user seeks to join the conference, i.e., sequentially 1, 2, 3, ... N.

0088In step 602, each user individually executes the IBAKE protocol with the conference server. Let Z_i = a_iP be the value sent by user "I" to the conference server during authentication with server. Recall that a_iP is the random key component computed by the party in accordance with IBAKE.

0089After authentication success, in step 604, the conference server sends the set {a_iP} to every user (either broadcast or individual unicast). Set {a_iP} is thus a set which includes the random key components computed by each of the parties.

0090In step 606, every user individually sends back Xi = a_i{a_i+1P - a_i-1P} to the conference server. Note that a_i{a_i+1P - a_i-1P} is a random group key component, wherein the random group key component is computed by each party via a computation based on the random number used by the party during the key authentication operation and the random key components computed by a subset of others of the two or more parties seeking to participate in the conference. In this embodiment, the random group key component for a given party a_i{a_i+1P - a_i-1P} is computed such that a_i is the random number selected by the given party, a_i+1P is the random key component sent to the server by the party immediately following the given party in the conference ordering, a_i-1P is the random key component sent by the party immediately preceding the given party in the conference ordering, and P is a point selected from a group associated with the identity encryption-based key authentication operation (e.g., point selected from an elliptic curve as described above).

0091In step 608, the conference server then shares the set {X_i} with everybody (either broadcast or individual unicast). That is, set {X_i} is a set including the random group key components computed by the parties.

0092In step 610, each party can compute the same group key for use in communicating with each other party through the conference server. The group key is computed as follows Na_i(Z_i-1) + (N-1)X_i + (N-2)X_i+1 + .... + X_i-2, where N represents the total number of parties seeking to participate in the conference, <i>a</i>_i represents the random number selected by the given party, Z_i represents the random key component computed by the given party, X_i represents the random group key component computed by the given party, and i represents a number of a conference ordering for the given party in the N-party conference with i-1=N when i=1 and i+1=1 when i=N.

0093As mentioned above, the conference server is not a participating party in the conference and thereby is unable to compute the group key. However, in a peer-to-peer scenario, the conference server is a participating party in the conference call and thereby needs to be able to compute the group key.

0094It is understood that the conference server performs a mutual authentication operation with each party seeking to participate in the conference. The conference server also only admits a given party to the conference when at least two conditions are met: (i) the given party is authenticated by the conference management element; and (ii) the given party is confirmed to belong to a conference authorization list. Also, in accordance with the above MIKEY-IBAKE protocol, the parties seeking to participate in the conference, and the conference server, obtain respective private keys from one or more key management services (KMS).

0095<figref idref="f0009">FIG. 6B</figref> illustrates how a new conference participant (user N+1) is added to an ongoing conference, thus resulting in modified conference 600'.

0096In step 612, user N+1 executes IBAKE with the conference server. Let Z_N+1 = a_N+1P be the value sent by user "N+1" to server during authentication with server. After user N+1's authentication success, in step 614, the conference server announces admission of new user N+1 and sends the set {a_iP} to everybody (either broadcast or individual unicast) including Z_N+1.

0097In step 616, users 1, N, N+1 send back Xi = a_i(a_i+1P - a_i-1P} to the server; alternatively all of them could execute this step. In step 618, the conference server then shares the set {X_i} with everybody (either broadcast or individual unicast) including X_N+1. The group key (N+1)a_i(Z_i-1) + (N)X_i + (N-1)X_i+1 + .... +X_i-2 is then recomputed in step 620. Observe that the group key changes after the new user is admitted.

0098<figref idref="f0010">FIG. 6C</figref> illustrates how a conference participant exits an ongoing conference, thus resulting in modified conference 600".

0099Assume that user 3 exits the call (it is to be understood that choice of user 3 is just an example). In step 622, the conference server announces which user exited the call (either broadcast or individual unicast). User ordering changes in step 624. Users 1 and 2 remain the same. User i becomes user i-1 for all i greater than or equal to 4. In step 626, user 4 (who is now user 3) re-computes X_i and shares this contribution with the conference server. In step 628, the conference shares the set {X_i} with all participants. In step 630, the participants recompute group key (N-1)a_i(Z_i-1) + (N-2)X_i + (N-3)X_i+1 + .... + X_i-2. Again, observe that the group key changes after a participant exits the call.

0100Principles of the invention also provide an extension to the conferencing management techniques described above. The extension involves lawful interception of conference messages.

0101Suppose there are N participants in the conferencing system. Assume that participant N is "tainted" and law enforcement authorities have obtained a warrant to tap into calls to and from participant N. The choice of declaring participant N as tainted is just for illustration and makes the description easier to follow, and the solution is in no way limiting to declaring the N-th user as the tainted user.

0102Prior to the conference call, the LI server (recall in <figref idref="f0007">FIG. 5</figref>) approaches the KMS corresponding to participant N and obtains the private key of participant N. This will allow the LI server to pretend to be participant N during the group key exchange process and execute all the steps in <figref idref="f0008">FIG. 6A</figref> except participant N's contributions are replaced with contributions from the LI server. In particular, the LI server will substitute Z_LI and X_LI in place of Z_N and X_N. The rest of the participants will not know the difference, and will compute a group key, call it GK'.

0103Next, the LI server works with the conference server, and replaces Z₁ and X₁ with Z_LI and X_LI in all communications with participant N. This will imply participant N will compute a group key different from GK'. Call this new key GK".

0104Note that in the step above, the LI server could have replaced Z_i and X_i with Z_LI and X_LI for any participant, and the choice of i=1 is only for illustration.

0105After the call is set up, any communication from participants 1 through N-1 will be encrypted using GK'. Since the LI server knows GK', it can then intercept the communication, decrypt it, following which it will re-encrypt it with GK" and send it to participant N. Conversely, any communication from participant N will be encrypted using GK" which will be intercepted by the LI server, then decrypted using GK", re-encrypted using GK', and sent through to participants 1 through N-1.

III. IMS Embodiments

0106In the following section, the above general principles of MIKEY_IBAKE and its extensions are applied to an IP Multimedia Subsystem (IMS) environment. That is, the multimedia communication system in this section is considered to be an IMS network. IMS standards are described, for example, in 3GPP Technical Specifications TS 23.218, TS 23.228, TS 24.228, TS 24.229, and TS 24.930, the disclosures of which are incorporated by reference herein

0107We first describe an architectural framework for IMS media plane security, specifically key management, based on which various features and use cases can be derived.

0108At the core of the solution, is the identity-based encryption (IBE) concept, similar to RFC 5091, RFC 5408 and RFC 5409, the disclosures of which are incorporated by reference herein.

0109However, these RFCs do not provide authentication and suffer from an inherent key escrow problem. We address these problems, by extending basic IBE to include the Identity Based Authenticated Key Exchange (IBAKE) protocol that provides mutual authentication, eliminates passive key escrow, and provides perfect secrecy of keys. While IBAKE is the basic protocol construct, we use MIKEY as the protocol container for key delivery.

0110One key idea about the inventive IMS solution framework is that, we re-use the proposed architecture including a KMS, but notably we do not require these KMS servers to be always on-line. In other words, in the proposed framework, KMSs are offline servers that communicate with end-user clients periodically (e.g., once a month) to create a secure identity based encryption framework, while the on-line transactions between the end-user clients (for media plane security) are based on an IBAKE framework which allows the participating clients to exchange key components in an asymmetric identity based encryption framework. This framework, in addition to eliminating passive escrow, allows for end-user clients to mutually authenticate each other (at the IMS media plane layer) and provides perfect forwards and backwards secrecy.

0111Observe that the KMS to client exchange is used sparingly (e.g., once a month) - hence the KMS is no longer required to be a high availability server, and in particular different KMSs do not have to communicate with each other (across operator boundaries). Moreover, given that asymmetric identity based encryption framework is used, the need for costly Public Key Infrastructure (PKI) and all the operational costs of certificate management and revocation is eliminated. Additionally, various IMS media plane features are securely supported - this includes secure forking, retargeting, deferred delivery, pre-encoded content, media clipping, and anonymity.

0112Extensions of the solution allow for secure conferencing applications, where an IMS conference application server authenticates users into a call but all participants of the call decide on a group key (with contributions from everybody) while the conference server itself does not learn the group key. Moreover, the group key can be modified to account for new participants and participants who exit a call. An additional feature of the IMS-based key management framework is that, despite the elimination of passive key escrow, it supports legally sharing security credentials with law enforcement using the concept of active escrow.

0113<figref idref="f0011">FIG. 7</figref> provides a schematic of the architecture along with the entities involved in an example end-to-end key exchange protocol in the IMS media plane. It is understood that since the IMS architecture is well-known, the functional components depicted in <figref idref="f0011">FIG. 7</figref> are not described in detail. Reference may be made to the IMS standards for detailed explanation of their functions. Note that, as is known, CSCF refers to a call session control function whereby P-CSCF is a proxy CSCF and S-CSCF is a serving CSCF. NAF refers to a network application function.

0114In the scenario illustrated, two IMS capable end user phones are engaged in an end-to-end (e2e) key exchange to secure communications in the application layer. Note that the illustration includes offline transactions between a UE (user equipment) and a KMS as well as online transactions between the UEs through IMS.

0115Observe that the UEs and the KMS share a pre-configured security association, wherein users can establish secure connections with the key management server and wherein mutual authentication is provided. One natural example in the context of 3GPP systems, is the use of Generalized Bootstrap Architecture (see, e.g., 3GPP TS 33.220, the disclosure of which is incorporated by reference herein). In <figref idref="f0011">FIG. 7</figref>, the transactions between the KMS and a UE are enabled through a BSF (bootstrapping server function) and recall that this transaction is performed sparingly (e.g., once a month). Note that if GBA is unavailable, other types of credentials such as IKEv2 with pre-shared keys or certificates (see, e.g., IETF RFC 4306, the disclosure of which is incorporated by reference herein) can be used for establishing this mutual authentication between the user and the KMS.

0116During this transaction, the UE presents it's subscription credentials following which the KMS generates a set of private keys (used in IBAKE). If this transaction is performed once a month, then the KMS may choose to generate one key for each day. The number of keys, and the frequency of this exchange is a matter of policy and it may be tied to the subscription. This flexibility is especially useful for prepay customers.

0117Note that rather than a single KMS, two different KMSs may be involved; one for user A, i.e., KMS_A, and one for user B, i.e., KMS_B. However, KMS_A and KMS_B do not have to communicate with each other. This scenario is especially applicable in inter-operator scenarios.

0118We now give a short summary of exchanges involved in the MIKEY-IBAKE in the IMS context.

0119Suppose A, B are the two users that are attempting to authenticate and agree on a key. At the same time, A and B represent their corresponding identities, which by definition also represent their public keys. Let H₁(A)=Q_A and H₁(B)=Q_B be the respective points on the elliptic curve corresponding to the public keys. In effect, one could refer to Q_A and Q_B as the public keys as well, since there is a one-to-one correspondence between the identities and the points on the curve obtained by applying H₁. Let x be a random number chosen by A, and let y be a random number chosen by B. Encryption below refers to identity based encryption as described above in section I.

0120The IMS-based MIKEY-IBAKE protocol exchange includes the following steps (with reference to components shown in <figref idref="f0011">FIG. 7</figref>): <ol id="ol0001" compact="compact"><li>1. IMS UE belonging to user A bootstraps with the BSF to be able to establish a secure connection with the KMS which acts as a NAF. This allows the BSF to authenticate the user and the user to indirectly authenticate the KMS. If GBA cannot be used, the IMS UE connects and authenticates to the KMS and establishes a shared key, based on a preestablished security association.</li><li>2. The IMS UE engages in a MIKEY exchange with the KMS and requests a secret key (or multiple secret keys, e.g., one for each day).</li><li>3. The KMS generates the media secret key(s) for IMS UE of user A and sends it to the user A.</li><li>4. The IMS UE of user A computes xP (i.e., P added to itself x times as a point on E, using the addition law on E) encrypts it using B's public key, and transmits it to IMS UE of user B.</li><li>5. The IMS core detects the INVITE and handles it in such a way that a network function, if authorized, can get access to the session key. This step in particular is applicable only to support the active escrow feature needed to satisfy any lawful intercept requirement.</li><li>6. The IMS UE of user B receives the INVITE including encrypted xP. IMS UE of user B decrypts the message and obtains xP. Subsequently B computes yP, and encrypts the pair {xP, yP} using the public key of IMS UE of user A and then transmits it in a response message to A.</li><li>7. Upon receipt of this message, IMS UE of user A decrypts the message and obtains yP. Subsequently IMS UE of user A encrypts yP using B's public key and sends it back in response conformation message to B. Following this, both A and B compute xyP as the session key.</li><li>8. At this point, the IMS UE of user B accepts the invitation and use of media security.</li></ol>

0121Observe that A chose x randomly, and received yP in the second step of the protocol exchange. This allows A to compute xyP by adding yP to itself x times. Conversely B chose y randomly, and received xP in the first step of the protocol exchange. This allows B to compute xyP by adding xP to itself y times.

0122Some advantageous properties that flow from the MIKEY-IBAKE protocol are as follows.

0123Mutual authentication. Observe that the contents of the payload in steps 4 and 7 are encrypted using B's public key. Hence B, and only B, can decrypt these messages. Similarly, the contents of the message in step 6 can be decrypted by A and only A. Also note that steps 6 and 7 allow B and A to authenticate with each other (by proving that the message was decrypted correctly). This novel feature allows for A and B to mutually authenticate each other without the aid of any on-line server or certificate authority.

0124Perfect secrecy. Observe that x and y are random. Hence the session key xyP is fresh and bears no relation to past or future transactions.

0125Elimination of passive escrow. Observe that, while the KMS (or a pair ofKMSs) can decrypt the messages in the exchange, it is hard to determine xyP given xP and yP. The hardness assumption relies on the Diffie-Hellman problem over elliptic curves. Also note that, the curves used for IBE are KMS specific, and moreover need not be the same as the curve used to generate the session key. This flexibility offers a wide number of choices, and also eliminates any coordination needed between KMSs.

0126Identity management. As described above, to encrypt a message a sender uses a recipient's public key, generated using the identity (or one of the identities) of the recipient. The identity of the recipient may be in format that specifies a specific user, a group of users or any user. The naming of users and user groups may follow normal IMS conventions and may be extended with use of wildcards. In certain scenarios involving group applications, it may be natural to have a policy allowing all recipients in the group to use the secret key corresponding to the identity of that particular user group. For example, for enterprise users, it may be natural to have as a default that secret keys corresponding to identity of enterprise are distributed to all enterprise users. Note that due to the properties of identity based encryption, although all the users belonging to a group possibly possess the secret key of that group, all users nevertheless can not obtain the session key established between a sender and some other user belonging to that same group. To ensure that polices are enforced, it is also necessary that a public user identity can be securely bound to an IMS UE. In other words, it is important to the identity used by the user to authenticate against the KMS to a (set of) public identity.

0127We now discuss extensions of MIKEY-IBAKE protocol to various IMS-based use case scenarios. Note that these extensions were generally described above in section II. There description below is in the context of an IMS environment.

A. Lawful intercept (LI) through active escrow

0128To be able to provide a clear copy of intercepted communication, the following conditions have to be fulfilled: <ol id="ol0002" compact="compact"><li>1. It must be possible to intercept the traffic (both signalling and media).</li><li>2. The session keys used for actual traffic protection have to be available. To make the session keys available, KMS functions/services are required.</li></ol>

0129As stated above, the actual session keys used for traffic protection are generated between the sender and the recipient, thus not known by the KMS. Therefore, an active escrow solution is needed. In this scenario, for the KMS to obtain a session key between users A and B, it needs to establish an active session key between itself and user A and another simultaneous active session between itself and user B. The KMS pretends to be B towards A, and conversely. This 'man-in-the-middle' role played by the KMS is referred to as active escrow and similar to the methods used in a PKI environment where a Certificate Authority generates 'fake certificates' and sits in the middle of the exchange. The difference between the technique used in conventional CA's and our approach to active escrow is that the KMS does not have to generate fake keys.

0130With signaling traffic routed via the home network, intercept of the signaling traffic in the home network can be done at SIP (Session Initiation Protocol) server(s). This signaling traffic then needs to be routed towards the appropriate KMS in order for this KMS to establish the needed session keys with the corresponding users. In roaming situations, as the SIP signaling traffic normally is confidentiality protected between the IMS UE and the P-CSCF and considering that in current deployments the P-CSCF is located in the home network, the SIP signaling is only available in encrypted format at bearer level in the visited network.

0131For roaming scenarios, while encrypted SIP signaling and content will always be available, in order to intercept SIP signaling and decrypt the content of communication, there has to be an interoperation agreement between the visited network and the entity handling KMS. Typically, the KMS will reside in the home network so that, for LI performed by the visited network, cooperation with the home network is needed.

0132In line with LI standards, when the VPLMN (Visited Public Land Mobile Network) is not involved in the encryption, only encrypted content would be available for LI in the VPLMN.

B. Users in different KMS domains

0133Users in different KMS domains will have their secret keys generated by different KMSs. As a result, a different set of public parameters (e.g., cryptographic material) can be used to generate public and secret keys for users in different KMS domains. To ensure proper encryption/decryption, a sender and recipient need to know exact public parameters used by each side. Nevertheless, if a user in one KMS domain needs to establish a secure call to a user in another KMS domain the involved KMSs do not need to cooperate. As in any identity based cryptographic protocol, or for that matter any public key protocol, we can safely assume that public parameters needed for the exchange are publicly available or exchanged.

C. End-to-middle scenarios

0134In end-to-middle scenarios, media protection is between an IMS UE and a network entity. In a scenario when the call is initiated from an IMS UE, the set up of the call would follow the same principles as for an end-to-end protected call. The initiating IMS UE uses the identity of the network entity (e.g., MGWC - media gateway control) to encrypt xP as described above and sends it together with the INVITE. The MGWC intercepts the message, and generates yP in the same way as a receiving IMS UE would have done. The MGWC then sets up the MGW to have media security towards the IMS UE. The media traffic is forwarded in plain in the PSTN (public switched telephone network).

0135For incoming calls to IMS UEs, the MGWC checks that at least one terminal registered for the intended recipient has registered media security capabilities and preferences. If there is no media protection-capable terminal, the call is forwarded in plain. Otherwise, the MGWC chooses y and generates yP. The MGWC then inserts the encrypted yP (using the IMS UEs identity) in the INVITE and initiates use of media security in the MGW on the media traffic between the MGW and the IMS terminal.

D. Key Forking

0136In this section, forking is discussed for the case of IMS-based MIKEY-IBAKE. Recall that forking is generally described above in the context of <figref idref="f0003">FIG. 2</figref>. Forking is the delivery of a request (e.g., INVITE message) to multiple locations. This happens when a single IMS user is registered more than once. An example of forking is when a user has a desk phone, PC client, and mobile handset all registered with the same public identity.

0137In the example depicted below and shown in the context of steps 1 through 8 of <figref idref="f0012">FIG. 8</figref>, assume that IMS UE of user B has multiple contact addresses registered with a single public user identity B. In other words, both B1 and B2 obtain a secret key corresponding to a public identity B. In this case, if IMS UE of user A wants to contact the IMS UE of user B, the request will be delivered to both B1 and B2. Assuming that B2 responds to a call, B2 first decrypts the message received using secret key associated with the identity B. B2 then chooses random y and sends to A a message including yP and its identity B2 encrypted using A's public identity. Upon receiving this message, user A decrypts it, realizes that it is communicating with user B2, and sends a response confirmation message including received yP encrypted using B2's public identity.

0138Observe that B1 is able to decrypt the message received from user A encrypted using B's public identity, therefore is able to obtain xP. However, it is not able to decrypt the message sent from B2 as it is encrypted using A's identity. Thus, user B1 is not able to obtain yP. Also note that even if B1 was able to obtain yP, it would still not be able to compute xyP. Note that in <figref idref="f0011">FIG. 7</figref>, (M)_X denotes that the message M is encrypted using the identity of X.

E. Redirection

0139In this section, session redirection (retargeting) is discussed for the case of IMS-based MIKEY-IBAKE. Recall that redirection is generally described above in the context of <figref idref="f0004">FIG. 3</figref>. Session redirection is a scenario in which a functional element decides to redirect the call to a different destination. Session redirection enables the typical services of "Session Forward Unconditional," "Session Forward Busy," "Session Forward Variable," "Selective Session Forwarding," and "Session Forward No Answer."

0140There are two basic scenarios of session redirection. In scenario one, a functional element (e.g., S-CSCF) decides to redirect the session using SIP REDIRECT method. In other words, the functional element passes the new destination information to the originator. As a result, the originator initiates a new session to the redirected destination provided by the functional element. For the case of MIKEY-IBAKE, this means that the originator will initiate a new session with the identity of the redirected destination.

0141In the second scenario, a functional element decides to redirect the session without informing the originator. A common scenario is one in which the S-CSCF of the destination user determines that the session is to be redirected. The user profile information obtained from the HSS (home subscriber server) by the 'Cx-pull' during registration may contain complex logic and triggers causing session redirection.

0142In the example depicted in steps 1 through 8 of <figref idref="f0013">FIG. 9</figref>, without loss of generality, it is assumed that the user B set up session forwarding to the user C. In this case, user B includes in its user profile its secret key SK_B encrypted using C's identity. Therefore, once the S-CSCF receives the message from user A and decides that the message needs to be redirected, it includes B's encrypted key in the message redirected to the user C. Upon receiving the message, the user C encrypts the secret key, and in turn, the message from A. User C then chooses random y and sends to A a message including yP and its identity C encrypted using A's public identity. Upon receiving this message, user A decrypts it, realizes that it is communicating to user C, and sends a response conformation message including received yP encrypted using C's public identity. In <figref idref="f0013">FIG. 9</figref>, (M)_X denotes that the message M is encrypted using the identity of X.

F. Deferred Delivery

0143In this section, deferred delivery is discussed for the case of IMS-based MIKEY-IBAKE. Recall from section II that deferred delivery is a type of service such that the session content can not be delivered to the destination at the time that it is being sent (e.g., the destination user is not currently online or decides not to answer the call). Nevertheless, the sender expects the network to deliver the message as soon as the recipient becomes available. A typical example of deferred delivery is voicemail.

0144Below, two basic scenarios of deferred delivery for the case of IMS-based MIKEY-IBAKE are presented. Reference may be made back to <figref idref="f0005">FIG. 4A</figref> for the first scenario and <figref idref="f0006">FIG. 4B</figref> for the second scenario.

0145In the first scenario, user A and B's mailbox perform mutual authentication before they agree on the key to be used for decrypting the content of the message intended for deferred delivery, while in the second scenario mutual authentication is not performed.

0146In the first scenario (again, reference may be made back to <figref idref="f0005">FIG. 4A</figref> where the functional element 402 is an IMS server), it is assumed that the user A is trying to reach the user B, who is currently not available, therefore the call is forwarded to the B's 'voicemail' (more generally, deferred delivery server). Following the MIKEY-IBAKE protocol, the message received by B's mailbox is encrypted using B's identity, therefore B's mailbox will not be able to decrypt it. B's mailbox chooses random y and computes yP and send its identity and yP IBE-encrypted to the user A. The user A recognizes that B did not receive the message and that the actual recipient was not able to decrypt the message sent in the first step by the lack of its identity and xP. Therefore, the user sends a new message containing A's identity, B's mailbox identity, xP and yP all IBE-encrypted using B's mailbox identity. Upon reception of this message, B's mailbox accepts "sK" as the session key for the message intended for B and return A's identity and xP to the user A to complete the authentication.

0147Observe that sK is encrypted using B's public key; hence mailbox B cannot decrypt this message and obtain "sK." Subsequently, when B is online and checks 'voicemail' (checks with the deferred delivery server), B can obtain the encrypted value of sK from the mailbox server. Note that B may have to authenticate with the mailbox to obtain the key - this could be based on existing authentication mechanisms already in place.

0148In the second scenario (again, reference may be made back to <figref idref="f0006">FIG. 4B</figref> where the functional element 402 is an IMS server), the same assumption holds - the user A is trying to reach the user B, which is currently not available, therefore the call is forwarded to B's voicemail. However, in this case, B's mailbox and user A do not perform the authentication. Instead, B's mailbox just accepts sK as the session key and returns an OK message to the user A to confirm it.

G. Group and Conference Calls

0149In this section, the key management protocol of MIKEY-IBAKE is extended to group and conference calls. Note that the advantageous properties that flow from the MIKEY-IBAKE protocol are therefore realized in a conferencing environment. Recall that conferencing was generally described above in the context of <figref idref="f0008 f0009 f0010">FIGs. 6A through 6C</figref>. Note that the IMS example in <figref idref="f0014">FIG. 10</figref> is for N=3.

0150In the IMS-based scenario depicted in steps 1 through 18 of <figref idref="f0014">FIG. 10</figref>, it is assumed that there is a conference server (AS/MRFC - application server/multimedia resource function controller) that invites users to the conference call. This could be a result of, for example, previously received REFER request from another user. An alternative approach would be to delegate this function to one of the users (e.g., conference chair). Although this alternative is not shown in <figref idref="f0014">FIG. 10</figref>, the approach would be similar and the computation of the group key would be the same.

0151In the description below, it is assumed that all messages are IBE encrypted (e.g., if a user Y is sending a message M to a user X, then the message M is encrypted using X's identity) using the appropriate identity. In <figref idref="f0014">FIG. 10</figref>, this is denoted as (M)_X meaning the message M is IBE encrypted using the identity of X.

0152In the first set of exchanges with the conference server, users A₁, A₂, and A₃ choose random a₁, a₂, and a₃ respectively and each user A_i sends w_i = a_iP to the conference server. In the second set of exchanges the conference server sends all a_iP's to every user, while each user sends z_i = a_i(a_i+1P - a_i-1P). In the final exchange, the conference server sends all z_i's to each user. Upon this, all conference participants are able to compute the group key as follows: K_i = 3a_iw_i-1 + 2z_i + z_i+1.

0153Note that K₁=K₂=K₃. Also note, while users A₁, A₂, and A₃ are able to generate the group key, the conference server is not since while it knows the z_i's and w_i's, only individual users know their randomly chosen a_i.

0154For simplicity reasons, above discussion focuses on three conference call participants. However, the above procedures can be generalized to n participants. In case of n participants, the group key is generated as K_i = <i>n</i>a_i w_i-1 + (<i>n</i>-1)z_i + (<i>n</i>-2)z_i-1 + ...+ z_i-2, where w_i and z_i are as defined above.

0155One of the important features of the protocol is that the group key changes every time a new user is admitted or an existing user exits the call. This ensures that new users do not learn the group key before they were added to the call, and users who leave the call prematurely do not gain access to the conversations after the call.

0156Observe that when a new user is added, and there are N users in the system already, then there will be a total of N+1 users in the system. When these users are placed in a circle, then the user next to the N-th user is now the (N+1)th user (and not the 1^st user, which was the case prior to admitting the N+1th user). The protocol to admit a new user works as follows:

0157The new user authenticates with the conference server using IBAKE, similar to every user. This allows the user to be admitted (and authorized to the call), and the new user is guaranteed of joining the correct conference (via authentication of the conference server). <maths id="math0002"><math display="block"><mi>Let</mi><mspace width="1em" /><msub><mi mathvariant="normal">z</mi><mrow><mi mathvariant="normal">N</mi><mo mathvariant="normal">+</mo><mn mathvariant="normal">1</mn></mrow></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">a</mi><mrow><mi mathvariant="normal">N</mi><mo mathvariant="normal">+</mo><mn mathvariant="normal">1</mn></mrow></msub><mo>⁢</mo><mi>P be the value chosen by the new user during authentication</mi><mn mathvariant="normal">.</mn></math><img file="EP2471211B1_D0002.tif" /></maths>

0158The conference server then sends the set {z_i} for all i=1 to N+1 to all users, either broadcast or unicast. This allows all users to learn of the new user, and determine their new neighbors. Observe that the neighbor list changes only for users 1, N, and N+1.

0159Users 1, N, and N+1 then compute their corresponding value of w, and send it back to the conference server (individually).

0160The server then sends an updated list of {w_i} to all users.

0161All participants then recompute the group key using the same relation as above, except N is replaced by N+1 and the new values of z_i and w_i.

0162When a user exits the conference call, then no new authentication procedures have to be executed, but the group key changes. The procedure works as follows:

0163The conference server learns about the user exiting the conference call.

0164Subsequently, the conference server informs everybody of this event and information pertaining to which user (not just identity, but also includes the order) exited the call. In order to simplify matters, the conference server may resend the new list {z_i}

0165This allows all users to rediscover their neighbors, and recompute w_i, if necessary.

0166All those participants remaining in the call, for whom w_i changed, will inform the conference server their new value.

0167The conference server then sends the updated list {w_i}.

0168All participants then recompute the group key using the same relation as above, except N is replaced by N-1 and the new values of w_i are used.

IV. Illustrative Computing System

0169<figref idref="f0015">FIG. 11</figref> illustrates a generalized hardware architecture 1100 of a network environment and communication devices in the form of computing devices suitable for implementing a secure key management protocol between two entities according to the present invention. While <figref idref="f0015">FIG. 11</figref> shows only two entities, it is to be understood that other entities can have the same configuration. Thus, in terms of the secure key management protocols described above, the two entities may be initiator 102-I (a first party or A) and responder 102-R (a second party or B). However, KMSs, conference servers, LI servers, functional elements, additional client devices (parties) and additional servers may be implemented with the same architecture as shown in a computing device of <figref idref="f0015">FIG. 11</figref>. Thus, for the sake of simplicity, all the computing devices (communication devices) that may participate in the protocols of the invention are not shown in <figref idref="f0015">FIG. 11</figref>.

0170As shown, A's computing device designated 1102 and B's computing device designated 1104 are coupled via a network 1106. The network may be any network across which the devices are able to communicate, for example, as in the embodiments described above, the network 1106 could include a publicly-accessible wide area communication network such as a cellular communication network operated by a network operator (e.g., Verizon, AT&amp;T, Sprint). However, the invention is not limited to a particular type of network. Typically, the devices could be client machines. Examples of client devices that may be employed by the parties to participate in the protocols described herein may include, but are not limited to, cellular phones, smart phones, desktop phones, personal digital assistants, laptop computers, personal computers, etc. However, one or more of the devices could be servers. Thus, it is to be understood that the communication protocol of the present invention is not limited to the case where the computing systems are client and server, respectively, but instead is applicable to any computing devices comprising the two network elements.

0171As would be readily apparent to one of ordinary skill in the art, the servers and clients may be implemented as programmed computers operating under control of computer program code. The computer program code would be stored in a computer readable storage medium (e.g., a memory) and the code would be executed by a processor of the computer. Given this disclosure of the invention, one skilled in the art could readily produce appropriate computer program code in order to implement the protocols described herein.

0172Nonetheless, <figref idref="f0015">FIG. 11</figref> generally illustrates an exemplary architecture for each computer system communicating over the network. As shown, device 1102 comprises I/O devices 1108-A, processor 1110-A, and memory 1112-A. Device 1104 comprises I/O devices 1108-B, processor 1110-B, and memory 1112-B. It should be understood that the term "processor" as used herein is intended to include one or more processing devices, including a central processing unit (CPU) or other processing circuitry, including but not limited to one or more signal processors, one or more integrated circuits, and the like. Also, the term "memory" as used herein is intended to include memory associated with a processor or CPU, such as RAM, ROM, a fixed memory device (e.g., hard drive), or a removable memory device (e.g., diskette or CDROM). In addition, the term "I/O devices" as used herein is intended to include one or more input devices (e.g., keyboard, mouse) for inputting data to the processing unit, as well as one or more output devices (e.g., CRT display) for providing results associated with the processing unit.

0173Accordingly, software instructions or code for performing the methodologies of the invention, described herein, may be stored in one or more of the associated memory devices, e.g., ROM, fixed or removable memory, and, when ready to be utilized, loaded into RAM and executed by the CPU.

0174Although illustrative embodiments of the present invention have been described herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various other changes and modifications may be made by one skilled in the art without departing from the scope of the invention.