Bearer control of encrypted data flows in packet data communications

1. A method for a communication session with encrypted data packets through a monitoring intermediary, comprising:

providing to a source mobile device an index identifying an encryption process;

including said index in a signaling message to a destination mobile device; and

signaling for said communication session between the source and destination devices by sending said signaling message having said index through said monitoring intermediary, wherein said monitoring intermediary is operable to enforce on said communication session a set of security policies associated with said index,

wherein said enforcement includes matching said index from said signaling message with a corresponding index from the data packets.

2. The method as in claim 1 wherein said signaling for said communication session includes responding through said monitoring intermediary to an invitation to said communication session.

3. The method as in claim 1 further including providing said index in said data packets of said communication session.

4. A method for a communication session with encrypted data packets through a monitoring intermediary in a communication system supported by the IP (Internet Protocol), comprising:

providing a SPI (Security Parameter Index) identifying a SA (Security Association);

including said SPI in a signaling message selected from a group consisting of a SIP INVITE message and a SIP 200 OK message; and

signaling for said communication session by sending said signaling message having said SPI through said monitoring intermediary so as to allow said monitoring intermediary using said SPI for packet data monitoring and for enforcing on said communication session a set of security policies associated with said index,

wherein said enforcing includes matching said SPI from said signaling message with a corresponding SPI from the data packets.

5. A method for monitoring a communication session with encrypted data packets, comprising:

receiving at a monitoring intermediary a first index which identifies a decryption process from a signaling message being transmitted from a source mobile device to a destination mobile device;

receiving at said monitoring intermediary a second index from said data packets of said communication session between the source and destination devices;

enforcing by said monitoring intermediary a set of policies on said communication session by including comparing said first and second indexes; and

allowing said data packets of said communication session to pass through said monitoring intermediary when said comparing said first and second indexes results in a comparison match and rejecting said data packets of said communication session from passing through when said comparing said first and second indexes results in a comparison mismatch.

6. The method as in claim 5 wherein said signaling message being a first signaling message, said method further including receiving said first index from a second signaling message.

7. The method as in claim 6 wherein said first signaling message being an invitation message for said communication session, and said second signaling message being a response message for said invitation message.

8. The method as in claim 5 , further comprising identifying if said data packets comprise audio data.

9. The method as in claim 5 , further comprising identifying if said data packets comprise video data.

10. The method as in claim 5 , wherein said method further includes:

if said first and second indices match, identifying a destination port and passing said data packets to said destination port; and

if said first and second indices do not match, dropping said packets.

11. A method for monitoring a communication session with encrypted data packets in a communication system supported by the IP (Internet Protocol), comprising:

receiving a first SPI (Security Parameter Index) from a signaling message selected from a group consisting of a SIP INVITE message and a SIP 200 OK message;

receiving a second SPI from said data packets of said communication session; and

enforcing by a monitoring intermediary a set of policies on said communication session by including comparing said first SPI and said second SPI,

wherein said enforcing includes matching said first SPI from said signaling message with said second SPI from the data packets.

12. An apparatus for a communication session with encrypted data packets through a monitoring intermediary, comprising:

means for providing to a source mobile device an index identifying an encryption process;

means for including said index in a signaling message to a destination mobile device; and

means for sending said signaling message having said index through said monitoring intermediary, wherein said monitoring intermediary is operable to enforce on said communication session a set of security policies associated with said index,

wherein said enforcement includes matching said index from said signaling message with a corresponding index from the data packets.

13. The apparatus as in claim 12 wherein said signaling message being an invitation message, said apparatus further including means for including said index in a response message in response to said invitation message.

14. The apparatus as in claim 12 further including means for including said index in said encrypted data packets of said communication session.

15. An apparatus for a communication session with encrypted data packets through a monitoring intermediary in a communication system supported by the IP (Internet Protocol), comprising:

means for providing a SPI (Security Parameter Index) identifying a SA (Security Association);

means for including said SPI in a signaling message selected from a group consisting of a SIP INVITE message and a SIP 200 OK message; and

means for sending said signaling message having said SPI through said monitoring intermediary so as to allow said monitoring intermediary using said index for packet data monitoring and for enforcing on said communication session a set of security policies associated with said index,

wherein said enforcing includes matching said SPI from said signaling message with a corresponding SPI from the data packets.

16. An apparatus for monitoring a communication session with encrypted data packets, comprising:

means for receiving at a monitoring intermediary a first index which identifies a decryption process from a signaling message being transmitted from a source mobile device to a destination mobile device;

means for receiving at said monitoring intermediary a second index from said data packets of said communication session between the source and destination devices;

means for enforcing by said monitoring intermediary a set of policies on said communication session by including comparing said first and second indexes; and

means for allowing said data packets of said communication session to pass through said monitoring intermediary when said comparing said first and second indexes results in a comparison match and means for rejecting said data packets of said communication session from passing through when said comparing said first and second indexes results in a comparison mismatch.

17. The apparatus as in claim 16 wherein said signaling message being a first signaling message, said apparatus further including means for receiving said first index from a second signaling message.

18. The apparatus as in claim 17 wherein said first signaling message being an invitation message for said packet data communication session, and said second signaling message being a response message for said invitation message.

19. The apparatus as in claim 16 , further comprising means for identifying if said data packets comprise audio data.

20. The apparatus as in claim 16 , further comprising means for identifying if said data packets comprise video data.

21. An apparatus for monitoring encrypted packet data of a communication session with encrypted data packets in a communication system supported by the IP (Internet Protocol), comprising:

means for receiving a first SPI (Security Parameter Index) from a signaling message selected from a group consisting of a SIP INVITE message and a SIP 200 OK message;

means for receiving a second SPI from said data packets of said communication session; and

means for enforcing by a monitoring intermediary a set of policies on said communication session by including comparing said first SPI and said second SPI,

wherein said enforcing includes matching said first SPI from said signaling message with said second SPI from the data packets.

22. An apparatus for a communication session with encrypted data packets through a monitoring intermediary, comprising:

a memory unit having computer-readable instructions for providing an index identifying an encryption process, including said index in a signaling message, and sending said signaling message having said index through said monitoring intermediary, wherein said monitoring intermediary is operable to enforce on said communication session a set of security policies associated with said index, wherein said enforcement includes matching said index from said signaling message with a corresponding index from the data packets; and

a processor circuit coupled to said memory unit for processing said computer-readable instructions.

23. The apparatus as in claim 22 wherein said signaling message being an invitation message, said apparatus further including computer-readable instructions for including said index in a response message in response to said invitation message.

24. The apparatus as in claim 22 further including computer-readable instructions for including said index in said data packets of said communication session.

25. An apparatus for a communication session with encrypted data packets through a monitoring intermediary in a communication system supported by the IP (Internet Protocol), comprising:

a memory unit having computer-readable instructions for providing a SPI (Security Parameter Index) identifying a SA (Security Association), for including said SPI in a signaling message selected from a group consisting of a SIP INVITE message and a SIP 200 OK message, and sending said signaling message having said SPI through said monitoring intermediary so as to allow said monitoring intermediary using said index for packet data monitoring and for enforcing on said communication session a set of security policies associated with said index, wherein said enforcing includes matching said SPI from said signaling message with a corresponding SPI from the data packets; and

a processor circuit coupled to said memory unit for processing said computer-readable instructions.

26. An apparatus for monitoring a communication session with encrypted data packets, comprising:

a memory unit having computer-readable instructions for receiving at a monitoring intermediary a first index which identifies a decryption process from a signaling message being transmitted from a source mobile device to a destination mobile device, receiving at said monitoring intermediary a second index from said data packets of said communication session between the source and destination devices, and enforcing a set of policies on said communication session by said monitoring intermediary including comparing said first and second indexes, and allowing said data packets of said communication session to pass through said monitoring intermediary when said comparing said first and second indexes results in a comparison match and means for rejecting said data packet of said communication session from passing through when said comparing said first and second indexes results in a comparison mismatch; and

a processor circuit coupled to said memory unit for processing said computer-readable instructions.

27. The apparatus as in claim 26 further including computer-readable instructions for allowing said data packets of said communication session to pass through said monitoring intermediary when said comparing said first and second indexes results in a comparison match and means for rejecting said data packet of said communication session from passing through when said comparing said first and second indexes results in a comparison mismatch.

28. The apparatus as in claim 26 wherein said signaling message being a first signaling message, said apparatus further including computer-readable instructions for receiving said first index from a second signaling message.

29. The method as in claim 28 wherein said first signaling message being an invitation message for said communication session, and said second signaling message being a response message for said invitation message.

30. The apparatus as in claim 26 , wherein the memory unit further comprises computer-readable instructions for identifying if said data packets comprise audio data.

31. The apparatus as in claim 26 , wherein the memory unit further comprises computer-readable instructions for identifying if said data packets comprise video data.

32. An apparatus for monitoring a communication session with encrypted data packets in a communication system supported by the IP (Internet Protocol), comprising:

a memory unit having computer-readable instructions for receiving a first SPI (Security Parameter Index) from a signaling message selected from a group consisting of a SIP INVITE message and a SIP 200 OK message, receiving a second SPI from said data packets of said communication session, and enforcing by a monitoring intermediary a set of policies on said communication session by including comparing said first SPI and said second SPI, wherein said enforcing includes matching said first SPI from said signaling message with said second SPI from the data packets; and

a processor circuit coupled to said memory unit for processing said computer-readable instructions.

33. A memory unit, comprising:

instructions for providing to a source mobile device an index identifying an encryption process;

instructions for including said index in a signaling message to a destination mobile device;

instructions for signaling for said communication session between the source and destination devices by sending said signaling message having said index through a monitoring intermediary, wherein said monitoring intermediary is operable to enforce on said communication session a set of security policies associated with said index; and

instructions for enforcing said security policies by matching said index from said signaling message with a corresponding index from the data packets.

34. A memory unit, comprising:

instructions for receiving at a monitoring intermediary a first index which identifies a decryption process from a signaling message being transmitted from a source mobile device to a destination mobile device;

instructions for receiving at said monitoring intermediary a second index from data packets of said communication session between the source and destination devices; and

instructions for enforcing by said monitoring intermediary a set of policies on said communication session by including comparing said first and second indexes; and

instructions for allowing said data packets of said communication session to pass through said monitoring intermediary when said comparing said first and second indexes results in a comparison match and rejecting said data packets of said communication session from passing through when said comparing said comparing said first and second indexes results in a comparison mismatch.

35. The memory unit as in claim 34 , further comprising instructions for identifying if said data packets comprise audio data.

36. The memory unit as in claim 34 , further comprising instructions for identifying if said data packets comprise video data.