Method of end to end securing of a communication
The aim of the invention is to strengthen the security of secure voice and/or video communications established through a network of Internet type. The security of these communications, which are based on the use of the SRTP protocol, is strengthened by the invention which makes it possible, without significantly modifying the protocols, to use better quality session keys produced by a security server of HSM type. These keys are configured by an intermediate server of SIP proxy type when establishing the communication.
1. A process for end-to-end securing of a communication between at least one first item of terminal equipment and a second item of terminal equipment, the communication being established using a session initiation protocol making it possible to exchange session keys, wherein each item of said at least one first item of terminal equipment and said second item of terminal equipment uses a session key to encrypt communication data that said each item of said at least one first item of terminal equipment and said second item of terminal equipment is transmitting, wherein the session keys are exchanged securely via an intermediate server using a security certificate, wherein via the intermediate server, the process comprising:
receiving a first invitation message of the at least one first item of terminal equipment inviting the second item of terminal equipment, wherein the first invitation message comprises at least one descriptive attribute of a first session key;
producing a second invitation message of the at least one first item of terminal equipment inviting the second item of terminal equipment, wherein the second invitation message comprises
the first session key, the first session key being configured by the intermediate server according to the at least one descriptive attribute of the first session key, the first session key being configured to be used to encrypt and decrypt the communication data transmitted by the at least one first item of terminal equipment;
at least one second session key, the at least one second session key being configured by the intermediate server, the at least one second session key being configured to be used to encrypt and decrypt the communication data transmitted by the second item of terminal equipment;
transmitting the second invitation message;
receiving a first acceptance message of the second item of terminal equipment accepting the second invitation message;
producing a second acceptance message of the second item of terminal equipment accepting the second invitation message, wherein the second acceptance message comprises
the first session key;
the at least one second session key; and
transmitting the second acceptance message.
2. The process for end-to-end securing of a communication according to claim 1 , wherein the first session key or the at least one second session key are configured by a request to a security server configured to implement a random sequence generator, wherein the first session key and the at least one second session key are produced using said random sequence generator.
3. The process for end-to-end securing of a communication according to claim 2 , wherein the request to the security server allows obtaining a bundle of session keys, wherein the bundle of session keys is stored by the intermediate server in a first key buffer, wherein the first session key and the at least one second session key are configured using contents of the first key buffer, wherein each key stored in the first key buffer are single-use.
4. The process for end-to-end securing of a communication according to claim 3 , wherein the intermediate server comprises a second key buffer, wherein the second key buffer is supplied by another request to the security server, wherein the intermediate server
uses the first key buffer as long as the first key buffer contains keys, and
then uses the second key buffer and fills the first key buffer again by a third request to the security server,
wherein the first key buffer and the second key buffer are used cyclically.
5. The process for end-to-end securing of a communication according to claim 1 , wherein the session initiation protocol to establish a session is an SIP protocol.
6. The process for end-to-end securing of a communication according to claim 5 , wherein
the first session key is sent to the at least one first item of terminal equipment as a value of an attribute named a=hsmkey;
the at least one second session key is sent to the at least one first item of terminal equipment as a value of an attribute named a=crypto;
the first session key is sent to the second item of terminal equipment as the value of the attribute named a=crypto;
the at least one second session key is sent to the second item of terminal equipment as the value of the attribute named a=hsmkey.
7. The process for end-to-end securing of a communication according to claim 1 , wherein the communication is a voice communication.
8. The process for end-to-end securing of a communication according to claim 1 , wherein the communication is a video communication.
9. A process for end-to-end securing of a communication between at least one first item of terminal equipment and a second item of terminal equipment, the communication being established using a session initiation protocol making it possible to exchange session keys, wherein each item of said at least one first item of terminal equipment and said second item of terminal equipment uses a session key to encrypt communication data that said each item of said at least one first item of terminal equipment and said second item of terminal equipment is transmitting, wherein the session keys are exchanged securely via an intermediate server using a security certificate, wherein via the intermediate server, the process comprising:
receiving a first invitation message of the at least one first item of terminal equipment inviting the second item of terminal equipment, wherein the first invitation message comprises at least one descriptive attribute of a first session key;
producing a second invitation message of the at least one first item of terminal equipment inviting the second item of terminal equipment, wherein the second invitation message comprises
the first session key, the first session key being configured by the intermediate server according to the at least one descriptive attribute of the first session key, the first session key being configured to be used to encrypt and decrypt the communication data transmitted by the at least one first item of terminal equipment;
at least one second session key, the at least one second session key being configured by the intermediate server, the at least one second session key being configured to be used to encrypt and decrypt the communication data transmitted by the second item of terminal equipment;
transmitting the second invitation message;
receiving a first acceptance message of the second item of terminal equipment accepting the second invitation message;
producing a second acceptance message of the second item of terminal equipment accepting the second invitation message, wherein the second acceptance message comprises
the first session key;
the at least one second session key; and
transmitting the second acceptance message;
wherein the first session key or the at least one second session key are configured by a request to a security server configured to implement a random sequence generator, wherein the first session key and the at least one second session key are produced using said random sequence generator; and
wherein the request to the security server allows obtaining a bundle of session keys, wherein the bundle of session keys is stored by the intermediate server in a first key buffer, wherein the first session key and the at least one second session key are configured using contents of the first key buffer, wherein each key stored in the first key buffer are single-use.
10. The process for end-to-end securing of a communication according to claim 9 , wherein the intermediate server comprises a second key buffer, wherein the second key buffer is supplied by another request to the security server, wherein the intermediate server
uses the first key buffer as long as the first key buffer contains keys, and
then uses the second key buffer and fills the first key buffer again by a third request to the security server,
wherein the first key buffer and the second key buffer are used cyclically.
11. A process for end-to-end securing of a communication between at least one first item of terminal equipment and a second item of terminal equipment, the communication being established using a session initiation protocol making it possible to exchange session keys, wherein each item of said at least one first item of terminal equipment and said second item of terminal equipment uses a session key to encrypt communication data that said each item of said at least one first item of terminal equipment and said second item of terminal equipment is transmitting, wherein the session keys are exchanged securely via an intermediate server using a security certificate, wherein via the intermediate server, the process comprising:
receiving a first invitation message of the at least one first item of terminal equipment inviting the second item of terminal equipment, wherein the first invitation message comprises at least one descriptive attribute of a first session key;
producing a second invitation message of the at least one first item of terminal equipment inviting the second item of terminal equipment, wherein the second invitation message comprises
the first session key, the first session key being configured by the intermediate server according to the at least one descriptive attribute of the first session key, the first session key being configured to be used to encrypt and decrypt the communication data transmitted by the at least one first item of terminal equipment;
at least one second session key, the at least one second session key being configured by the intermediate server, the at least one second session key being configured to be used to encrypt and decrypt the communication data transmitted by the second item of terminal equipment;
transmitting the second invitation message;
receiving a first acceptance message of the second item of terminal equipment accepting the second invitation message;
producing a second acceptance message of the second item of terminal equipment accepting the second invitation message, wherein the second acceptance message comprises
the first session key;
the at least one second session key; and
transmitting the second acceptance message;
wherein the session initiation protocol to establish a session is an SIP protocol; and
wherein
the first session key is sent to the at least one first item of terminal equipment as a value of an attribute named a=hsmkey;
the at least one second session key is sent to the at least one first item of terminal equipment as a value of an attribute named a=crypto;
the first session key is sent to the second item of terminal equipment as the value of the attribute named a=crypto;
the at least one second session key is sent to the second item of terminal equipment as the value of the attribute named a=hsmkey.