Dynamic session classification
A request to establish a communication session between the first communication endpoint and a second communication endpoint is received. For example, the request may be a Session Initiation Protocol (SIP) INVITE message to establish a voice communication session. A security classification for the communication session is determined. For example, the determined security classification may be that the call is top secret or unclassified. The security classification is not based on whether the communication session is solely encrypted. The security classification is inserted into the request to establish the communication session. The request to establish the communication session with the security classification is sent to the second communication endpoint. This allows the second endpoint to display the security classification. A similar process is used in a response to the request to establish the communication session to convey the security classification to the first communication endpoint.
1. A system comprising:
a microprocessor; and
a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that program the microprocessor to:
receive, from a first communication endpoint, a Session Initiation Protocol (SIP) INVITE message to establish a communication session between the first communication endpoint and a second communication endpoint,
determine a first security classification of a plurality of possible security classifications for the communication session, wherein the first security classification is not based on whether the communication session is solely encrypted,
insert the first security classification into the SIP INVITE message, and
send the SIP INVITE message with the first security classification to the second communication endpoint.
2. The system of claim 1 , wherein first security classification is inserted into one of a SIP From: header, a SIP Contact header, a SIP P-Asserted-Identity header, or a proprietary header in the SIP INVITE message.
3. The system of claim 2 , wherein the first security classification is inserted into the SIP From: header, the SIP Contact header, and the SIP P-Asserted-Identity header in the SIP INVITE message.
4. The system of claim 2 , wherein the microprocessor receives a SIP 200 OK message from the second communication endpoint, inserts the first security classification into one of the SIP To: header, the SIP Contact header, the SIP P-Asserted-Identity header, or the proprietary header in the SIP 200 OK message, and sends the SIP 200 OK message with the first security classification to the first communication endpoint.
5. The system of claim 4 , wherein the first security classification is inserted into the SIP To: header, the SIP Contact header, and the SIP P-Asserted-Identity header in the SIP 200 OK message.
6. The system of claim 2 , wherein the microprocessor receives a SIP 200 OK message from a Back-to-Back User Agent (B2BUA), wherein the SIP 200 OK message comprises a second security classification for a SIP dialog between the B2BUA and the second communication endpoint in one of the SIP To: header, the SIP Contact header, the SIP P-Asserted-Identity header, or the proprietary header, determines an overall security classification based on the first security classification and the second security classification, and sends the SIP 200 OK message with the overall security classification to the first communication endpoint.
7. The system of claim 6 , wherein the overall security classification is sent in the SIP To: header, the SIP Contact header, and the SIP P-Asserted-Identity header in the sent SIP 200 OK message.
8. The system of claim 2 , wherein the communication session between the first communication endpoint and the second communication endpoint is transferred from the first communication endpoint to a third communication endpoint to establish a communication session between the second communication endpoint and the third communication endpoint, wherein the microprocessor receives a second SIP INVITE message or a SIP INVITE with replaces header message and inserts a second security classification into one of the SIP From: header, the SIP Contact header, the SIP P-Asserted-Identity header, or the proprietary header in the second SIP INVITE message or the SIP INVITE with replaces header message.
9. The system of claim 2 , wherein microprocessor receives a SIP 200 OK message from a Back-to-Back User Agent (B2BUA), wherein the SIP 200 OK message comprises a second security classification for a SIP dialog between the B2BUA and the second communication endpoint in a SIP via header.
10. The system of claim 2 , wherein the microprocessor receives a SIP 200 OK message from a Back-to-Back User Agent (B2BUA), wherein the SIP 200 OK message comprises an overall security classification inserted by a proxy server into the SIP 200 OK message.
11. A method comprising:
receiving, by a microprocessor, from a first communication endpoint, a Session Initiation Protocol (SIP) INVITE message to establish a communication session between the first communication endpoint and a second communication endpoint;
determining, by the microprocessor, a first security classification of a plurality of possible security classifications for the communication session, wherein the first security classification is not based on whether the communication session is solely encrypted;
inserting, by the microprocessor, the first security classification into the SIP INVITE message; and
sending, by the microprocessor, the SIP INVITE message with the first security classification to the second communication endpoint.
12. The method of claim 11 , wherein the first security classification is inserted into one of a SIP From: header, a SIP Contact header, a SIP P-Asserted-Identity header, or a proprietary header in the SIP INVITE message.
13. The method of claim 12 , wherein the first security classification is inserted into the SIP From: header, the SIP Contact header, and the SIP P-Asserted-Identity header in the SIP INVITE message.
14. The method of claim 12 , further comprising:
receiving, by the microprocessor, a SIP 200 OK message from the second communication endpoint;
inserting, by the microprocessor, the first security classification into one of the SIP To: header, the SIP Contact header, the SIP P-Asserted-Identity header, or the proprietary header in the SIP 200 OK message; and
sending, by the microprocessor, the SIP 200 OK message with the first security classification to the first communication endpoint.
15. The method of claim 14 , wherein the first security classification is inserted into the SIP To: header, the SIP Contact header, and the SIP P-Asserted-Identity header in the SIP 200 OK message.
16. The method of claim 12 , further comprising:
receiving, by the microprocessor, a SIP 200 OK message from a Back-to-Back User Agent (B2BUA), wherein the SIP 200 OK message comprises a second security classification for a SIP dialog between the B2BUA and the second communication endpoint in one of the SIP To: header, the SIP Contact header, the SIP P-Asserted-Identity header, or the proprietary header;
determining, by the microprocessor, an overall security classification based on the first security classification and the second security classification; and
sending, by the microprocessor, the SIP 200 OK message with the overall security classification to the first communication endpoint.
17. A system comprising:
a microprocessor; and
a computer readable medium coupled with the microprocessor and comprising microprocessor readable and executable instructions that program the microprocessor to execute a conference bridge, wherein the conference bridge:
receives a first Session Initiation Protocol (SIP) INVITE message from a first communication endpoint, wherein the first SIP INVITE message comprises a first security classification,
receives a second SIP INVITE message from a second communication endpoint, wherein the second SIP INVITE message comprises a second security classification,
determines an overall security classification for a conferenced communication session based on the first security classification being different from the second security classification, and
in response to the first security classification being different from the second security classification, sends a first SIP Re-INVITE message to the first communication endpoint, wherein the first SIP Re-INVITE message comprises the overall security classification.
18. The system of claim 17 , wherein the overall security classification is not unclassified, wherein the conference bridge receives a third SIP INVITE message that does not comprise a security classification and, in response to receiving the third SIP INVITE message that does not comprise the security classification, sends a second SIP Re-INVITE message to the first communication endpoint, wherein the second SIP Re-INVITE message comprises a security classification of unclassified, and sends a third SIP Re-INVITE message to the second communication endpoint, wherein the third SIP Re-INVITE message comprises the security classification of unclassified.
19. The system of claim 17 , wherein the first security classification is in one of a SIP From: header, a SIP Contact header, a SIP P-Asserted-Identity header, or a proprietary header of the SIP INVITE message.
20. The system of claim 17 , wherein the conference bridge sends a SIP UPDATE message to the first communication endpoint, wherein the SIP UPDATE message comprises the overall security classification.