Patent Application
20090182668
The present invention relates generally to privacy and encryption of media traffic over data networks, and in particular, voice traffic over data networks, for example voice over IP (VoIP).
With the advent of voice and other multimedia over data networks (e.g. voice over IP (VoIP)), there have been privacy concerns, especially when such traffic is transmitted over the public internet. Voice over IP and multimedia traffic is susceptible to an attacker recording traffic, rerouting traffic or using malware programs to eavesdrop on the traffic. This has been a concern and various parties (e.g., standard bodies) are working on solutions to prevent eavesdropping and are trying to ensure that private communications remain private. For example, in order to prevent eavesdropping and provide privacy for the end user, SIP and H.323 multimedia traffic is now being encrypted using strong cryptographic methods. One method gaining widespread acceptance is the use of Secure Real Time Protocol (SRTP). Within SRTP the multimedia traffic is encrypted with Advanced Encryption Standard (AES) cryptography with a 128 bit or greater key length. However, the use of such strong encryption prevents even lawfully authorized agencies from decrypting this data without having access to the key due to the huge numbers of possible key combinations. (E.g., 128 bit keys have 2 to the power of 128 possible key combinations).
Also, since key exchanges are now being negotiated between endpoint terminals directly, there is no opportunity for the service provider or a lawful intercept agency such as the FBI, CIA, NSA, CISIS, or other lawfully authorized bodies to obtain the session keys in order to perform lawful intercept.
It is, therefore, desirable to provide a mechanism which will protect the privacy of callers, while still allowing for lawful intercept (LI) by lawfully authorized agencies.
The present invention provides a mechanism which will protect the privacy of callers, while still allowing for lawful intercept (LI) by lawfully authorized agencies (hereafter LI agency).
One aspect of the invention provides a method and system for communicating the session keys used to encrypt the media stream such that it is possible for a lawfully authorized agency to lawfully intercept and decrypt the media stream. Assuming the endpoints negotiate the session keys themselves, the endpoints are responsible for communicating said media session key. Accordingly at least one of said endpoints communicates said media session key to at least one 3rd party to allow for lawful intercept (LI) by an LI agency. In order to ensure that only a lawfully authorized agency can intercept the traffic, according to one embodiment of the invention, the endpoints send the media session key in an encrypted format key message.
In one embodiment the at least one 3rd party is the LI agency itself, in which case, the encrypted format key message is encrypted with an encryption key for which only the LI agency knows the corresponding decryption key. In such an embodiment, such an encrypted format key message can be decrypted directly by the LI agency. However, to avoid abuse by the LI agency, or even to avoid the perception that LI agencies can intercept private calls without due process, the at least one 3rd party can comprise one or more intermediary and/or additional parties, according to alternative embodiments of the invention. In such cases, the encrypted format key message encrypts the media session key using at least one additional key, with the corresponding decryption key(s) being unknown to the LI agency. For example, the co-operation of a service provider (e.g., an internet service provider or carrier) associated with at least one of the endpoints can be required before the LI agency can decrypt the encrypted format key message. In such an example, the encrypted format key message is encrypted both by a key associated with the LI agency, and in addition, with a key associated with the service provider (i.e., only the service provider knows the corresponding decryption key). Therefore, the LI agency can not intercept the traffic without the cooperation of the service provider. In order to avoid abuse by collusion between the LI agency and the service provider, more than one additional party can be required.
In some jurisdictions, Lawful intercept requires a court order before a LI agency can lawfully intercept a private call. In such a jurisdiction, decryption of the encrypted format key message by the court (or an appointed agent) can be required, by encrypting the encrypted format key message with a key associated with the court (i.e., only the court (or an authorized agent) knows the corresponding decryption key). As an alternative, if there are several government agencies within a jurisdiction, such as the US with (FBI, CIA, or NSA), the courts (or an appointed agency) or some other authority can act as the LI agency itself, and provide the decrypted media key to the appropriate agency if a court order is obtained. This prevents the need for each media stream to be encrypted with a key for each possible LI agency.
An aspect of the invention provides for a method of securing a media stream between first and second endpoints of a packet data network, while still allowing lawful intercept, comprising: a) endpoints negotiating a media session key for encrypting said media stream; b) endpoints encrypting said media stream with said media session key to produce an encrypted media stream; and c) at least one of said endpoints creating and transmitting an encrypted message which contains the media session key encrypted with a first additional key for which the corresponding decryption key is known by a lawful intercept (LI) agency. According to one embodiment step (c) comprises further encrypting said media session key using at least one additional key with a corresponding decryption key not known by said LI agency.
In one embodiment, the encrypted format key message can be sent via a signaling channel. In alternative embodiments, the encrypted format key message can be transmitted between said parties in the same media plane which carries the media stream. In one exemplary embodiment, we introduce a new type of media stream packet which we call a tracer packet. Such a tracer packet is sent after some number (n) of media stream packets, and includes the encrypted key in its payload. Additional information can be included in said tracer packet to assist the LI agency in intercepting the call, or in subsequently demonstrating (e.g, to a court of law) that the call has not been altered or fabricated by the LI agency.
As well as the methods described herein, aspects of the invention are directed to the endpoint devices and/or call servers/media gateways or network intercept points which carry out the methods, and also to computer program products tangibly embodied in computer readable mediums which contain computer executable instructions for causing said devices to execute the methods described and claimed herein. For example, one aspect of the invention provides for data network multimedia apparatus for transmitting encrypted media while still allowing for lawful intercept (LI) comprising: a) a call signaling module for establishing a call with another endpoint; b) a key negotiation module for negotiating a media session key with said another endpoint; c) an encryption module for encrypting media traffic with said negotiated media session key; and d) a LI module for creating and transmitting an encrypted message which contains the media session key encrypted with a first additional key for which the corresponding decryption key is known by a lawful intercept (LI) agency.
Another aspect of the invention provides for a multimedia/VoIP terminal apparatus for securely transmitting a media stream to a second endpoint of a packet data network, while still allowing lawful intercept, comprising: a) means for negotiating a media session key for encrypting said media stream; b) means for encrypting said media stream with said media session key to produce an encrypted media stream; and c) means for creating and transmitting an encrypted message which contains the media session key encrypted with a first additional key for which the corresponding decryption key is known by a lawful intercept (LI) agency. According to one embodiment said means for creating comprises means for further encrypting said media session key using at least one additional key with a corresponding decryption key not known by said LI agency.
A Network Intercept Apparatus for intercepting a composite encrypted media stream transmitted via a data network, said composite encrypted media stream including encrypted media stream packets encrypted with a media session key and tracer packets which include an encrypted media session key which is encrypted with an additional key, said apparatus comprising: a data network interface which provides a logical and physical interface to the data network; a target mirroring module which replicates an encrypted media stream targeted for lawful intercept (LI) and separates said tracer packets from said encrypted media stream packets; a tracer packet processing module which isolates said encrypted media session key from within the tracer packet and performs decryption of the media session key using the additional key and reassembles each tracer packet to include the decrypted media session key; and a LI Media Stream Packet Processing Module which receives the outputs from both the Tracer Packet Processing Module and the Target Mirroring Module and re-inserts the reassembled tracer packets within the replicated encrypted media stream.
Other aspects and features of the present invention will become apparent to those ordinarily skilled in the art upon review of the following description of exemplary embodiments of the invention in conjunction with the accompanying figures.
Embodiments of the present invention will now be described, by way of example only, with reference to the attached Figures, wherein:
Generally, the present invention provides methods and systems for protecting the privacy of callers, while still allowing for lawful intercept by lawfully authorized agencies.
In the following description, for purposes of explanation, numerous details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent to one skilled in the art that these specific details are not required in order to practice the present invention. In other instances, well-known electrical structures and circuits are shown in block diagram form in order not to obscure the present invention. For example, specific details are not provided as to whether the embodiments of the invention described herein are implemented as a software routine, hardware circuit, firmware, or a combination thereof.
Embodiments of the invention may be represented as a software product stored in a machine-readable medium (also referred to as a computer-readable medium, a processor-readable medium, or a computer usable medium having a computer readable program code embodied therein). The machine-readable medium may be any suitable tangible medium, including magnetic, optical, or electrical storage medium including a diskette, compact disk read only memory (CD-ROM), memory device (volatile or non-volatile), or similar storage mechanism. The machine-readable medium may contain various sets of instructions, code sequences, configuration information, or other data, which, when executed, cause a processor to perform steps in a method according to an embodiment of the invention. Those of ordinary skill in the art will appreciate that other instructions and operations necessary to implement the described invention may also be stored on the machine-readable medium. Software running from the machine readable medium may interface with circuitry to perform the described tasks.
Embodiments of the invention will be described based on the non-limiting example of a VoIP configuration, but it should be appreciated that the examples described herein can be extended to other voice over data network applications, or indeed to multimedia (e.g., a video conference call) over data networks in general
The terminals 20 and 30 are configured to embed tracer packets in the encrypted media stream 50. These tracer packets include an encrypted media stream key K1 which is encrypted with the public key of the carrier and the public key of the government LI agency. Carrier intercept point 60 decrypts the tracer with the carrier private key and re-embeds the tracer in a message which is sent either directly or indirectly to the LI agency node 7, for example, via path 65. However, it should be appreciated that the LI agency 70 could also have access to the media stream 50 and it is able to decrypt the tracer packets which the carrier lawful intercept point re-embeds within the media stream.
The government LI agency node decrypts the tracer packet with the LI private key to recover K1. This allows the LI agency to decrypt the voice with K1 thus making lawful intercept possible. As stated, the carrier participation prevents abuse by, or the perception of abuse by, the LI agency by preventing the LI agency to obtain the media key K1 covertly. As stated, this is just one embodiment and more than two keys can be used to encrypt the media key K1 within the tracer packet. For example, a court or privacy agency, or an agent thereof, could supplement the carrier lawful intercept to ensure that the lawful intercept agency follows due process before being able to obtain the tracer packet in a format in which it can decrypt. In addition, as a further alternative, multiple parties can be required to decrypt the tracer packet, each with their own key which is unknown to the LI agency or the other parties, to further ensure that the lawful intercept is indeed lawful. It should be appreciated that the Carrier Intercept point is not actually necessary, and the abuse (and the perception of abuse) can be prevented by having the courts and/or some other privacy agency operate the intercept point. The point is to require the co-operation of at least one additional party, so that the LI agency can not decrypt the media stream unilaterally. However, if abuse is not a concern, then the tracer packet need only be encrypted with the LI key, and the LI agency node 70 can directly decrypt the tracer packet, and thus the media stream.
In
Media Encryption Module 415 performs encryption on the VoIP or multimedia stream using the media session key 412. Encryption may be performed under the secure real time protocol (SRTP), IPsec, DTLS or other encryption protocol. Media Encryption Module 415 also performs media decryption of incoming VoIP or multimedia information.
In addition to the above components, which are for the most part conventional, the endpoint also includes an LI Module 430 which produces the encrypted format key message which includes the encrypted media session key which is decrypted by the LI agency in order to decrypt the media stream. According to the embodiment illustrated in
LI module 430 comprises Key Generating Module 432, Media Session Key Encryption Module 435, and a packet generator 434 which produces the header and other payload information of the tracer packet.
Key Generating Module 432 generates and/or stores the key(s) used for tracer packet encryption. The number of keys (M) which are generated and/or stored depends on the number of 3rd parties which are required to co-operate with a LI agency in order to perform LI. According to one embodiment, asymmetric encryption is used, in which case the key generation process comprises the Key Generating Module 432 looking up public keys of the carrier, LI agency and other optional authorized bodies. It should be noted, that this can be done for each session, or alternatively, if these keys do not change very often, they can be stored within an internal database, which is updated as the keys are changed by the corresponding 3rd party.
According to an alternative embodiment, symmetric encryption is used, in which case the key generation module 432 performs key negotiation with each authorized body using a secure protocol such as IKE (internet key exchange), authenticated Diffie-Hellman or other protocol.
Media Session Key Encryption Module 435 performs M encryptions on the payload of the tracer packet which includes the media session key, and optionally, other tracer packet information. Encryptions are performed using either asymmetric encryption algorithms such as RSA or symmetric encryption algorithms such as AES, 3-DES, Blowfish, or many others.
Once the payload is encrypted, the tracer packet is transmitted to the other endpoint using the same media plane as the media stream via IP network Interface 440
Once the call is established, the VoIP Processing module 420 creates each voice packet 120, and then each voice packet is transmitted 130 via IP network interface 440. However a controller for the endpoint 30 checks whether a transmitted packet is the Nth packet since the last tracer packet has been transmitted 140. If not, voice packets are created and sent until the Nth speech packet is sent. After the Nth packet is transmitted, the LI module 430 creates a tracer packet 150, which comprises a header, and payload. The payload includes the media session key 412, and optionally other information, as will be discussed below. The payload is then encrypted 160 via the Media session encryption module 435, and then transmitted 170 via the IP network interface 440.
The process of creating and sending speech packets, with every Nth packet being a tracer packet, continues until the call is ended 180.
We point out that although the Carrier Interception point is shown and described as separate network node, this is not necessary. The appropriate functions can be executed by a processor of a carrier router (and preferably an edge router, so that the core routers do not need to be upgraded) or a firewall at the carrier's edge. Furthermore this functionality can be split between nodes. For example, the edger router can monitor for the presence of the tracer packet, and alert or deny the media stream if the tracer packets are not present, whereas one (or more) dedicated LI point(s) performs the decryption and packet re-assembly if necessary.
Assuming the tracer packets are present, then the processor will evaluate whether the media stream is subject to LI enforcement 230. If not, then normal VoIP processing and routing occurs 240. Depending on the embodiment, and also on the requirements of the jurisdiction, the media stream can be stored for subsequent review by a law enforcement agency if there is no real time requirement for lawful intercept.
However, if there is real time requirement of lawful intercept then the processor will decrypt the tracer packet with a key corresponding to K2 (that is to say the carriers decryption key) 250. The processor then will reassemble the tracer packet with the decrypted payload 260. Note that this payload will still be encrypted with the law enforcement key, and potentially other keys if there are additional third party encryptions applied to the media stream. The processor will then reinsert the tracer packet into the media stream (that is to say apply the appropriate headers to the decrypted payload) and transmit the tracer packet. This continues until the call is ended 280.
b shows a corresponding tracer packet which will be inserted into the media stream every N packets. The tracer packet comprises an IP Header 308, a UDP Header 312, a Tracer Header 322 which identifies the packet as a tracer packet and an encrypted Tracer Packet payload 332.
a shows a raw tracer packet comprising a Tracer Header 340 and a payload which comprises the media stream key 345 and optionally a media stream identification information 350 as well as optionally a checksum of the previous N packet 355.
The checksum may be used by the LI agency to ensure that the packets in the media stream have not been modified and do indeed correspond to the tracer packet for those N packets. As the tracer packet is different for each N media stream packets, it has and has to be recalculated by the phone or client for each tracer packet. Accordingly, the checksum is an optional field since it represents higher overhead.
Tracer Packet Processing Module 520 records any relevant information from tracer packets such as the optional identification information and checksum. It then isolates encrypted media session key from within the tracer packet and performs partial decryption of the media session key using the Carrier Key. Note the Carrier key will be the Carrier's private key if asymmetrical encryption is used, and will be a secret key shared with the endpoint if a symmetric key encryption is used. It then reassembles each tracer packet to include the partially decrypted media session key.
LI Media Stream Packet Processing Module 530 receives the outputs from both the Tracer Packet Processing Module 520 and the Target Mirroring Module 510. It then changes the IP address of all packets to route these to the LI agency. The processing module 530 then re-inserts the reassembled tracer packets within the replicated encrypted media stream.
Note that the LI media stream packet processing module may do this processing in real time or in alternative embodiment, may store and delay the media stream temporarily and process in non real time.
Note that
The above-described embodiments of the present invention are intended to be examples only. Alterations, modifications and variations may be effected to the particular embodiments by those of skill in the art without departing from the scope of the invention, which is defined solely by the claims appended hereto.
This application claims the benefit of priority of U.S. Provisional Patent Application No. 61/010,805 filed Jan. 11, 2008, which is incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| 61010805 | Jan 2008 | US |
