Device authentication and secure channel management for peer-to-peer initiated communications

A system for authenticating and providing secure communication between devices initiating communication over a Session Initiation Protocol (SIP) network, comprising:

• a SIP client in communication with a SIP device, the SIP device and the SIP client being, respectively, first and second endpoints in a SIP media session, the SIP client requesting secure access to the SIP device;
• and
• a secure access server in communication with both the SIP client and the SIP device, the secure access server configured to:
• register the SIP device to the secure access server in a first SIP session, the first SIP session established between the secure access server and the SIP device, wherein registration comprises:
• authenticating the SIP device,
• generating a first asymmetric key pair comprising a first private key and a first complementary public key, the first asymmetric key pair being uniquely associated with the SIP device,
• encrypting the first private key, and
• transmitting the first private key to the SIP device;
• process the request from the SIP client to securely access the SIP device and establish a second SIP session between the secure access server and the SIP client, wherein processing comprises, as part of processing the request or establishing the second SIP session:
• authenticating the SIP client,
• retrieving the first complementary public key uniquely associated with the SIP device and generated prior to receiving the request from the SIP client to securely access the SIP device, and
• transmitting the first complementary public key to the SIP client;
• and
• wherein the first private key and the first complementary public key are made available to the SIP device and the SIP client, respectively, before the SIP client requests secure access to the SIP device in the second SIP session, and
• wherein the SIP client accesses the SIP device in the SIP media session, the SIP media session established between the SIP client and the SIP device, wherein:
• the SIP client is configured to:
• generate a symmetric key, asymmetrically encrypt the symmetric key using the first complementary public key previously registered to be uniquely associated with the SIP device, and transmit the encrypted symmetric key to the SIP device,
• the SIP device is configured to asymmetrically decrypt the encrypted symmetric key using the first private key previously registered to be uniquely associated with the SIP device, and
• the SIP client and the SIP device establish the secure communication channel by using the symmetric key for subsequent secure peer-to-peer communication between the SIP device and the SIP client during the SIP media session;
• and wherein the secure access server is further configured to, prior to a subsequent request from the SIP client to securely access the SIP device in a further SIP session, provide the SIP device with a second private key in a fourth SIP session, the fourth SIP session established between the secure access server and the SIP device, and the providing comprises:
• authenticating the SIP device,
• receiving a request from the SIP device for the second private key in response to expiry of the first private key,
• generating a second asymmetric key pair comprising the second private key and a second complementary public key, the second asymmetric key pair being uniquely associated with the SIP device,
• encrypting the second private key, and
• transmitting the second private key to the SIP device;
• wherein providing the SIP device with the second private key in the fourth SIP session makes the second private key and the second complementary public key available to the SIP device and the SIP client, respectively, before the SIP client requests secure access to the SIP device in the further SIP session.

A method of authenticating and establishing an Advanced Encryption Standard (AES) tunnel between devices in a Session Initiation Protocol (SIP) network, comprising:

• registering a SIP device to a secure access server in a first SIP session, the first SIP session established between the secure access server and the SIP device, the SIP device being a first endpoint in a SIP media session, the secure access server configured to:
• authenticate the SIP device,
• generate a first asymmetric key pair comprising a first private key and a first complementary public key, the first asymmetric key pair being uniquely associated with the SIP device,
• encrypt the first private key, and
• transmit the first private key to the SIP device;
• processing a request from a SIP client to securely access the SIP device and establishing a second SIP session between the secure access server and the SIP client, the SIP client being a second endpoint in the SIP media session, the secure access server configured to, as part of processing the request or establishing the second SIP session:
• authenticate the SIP client,
• retrieve the first complementary public key uniquely associated with the SIP device and generated prior to receiving the request from the SIP client to securely access the SIP device, and
• transmit the first complementary public key to the SIP client;
• and
• wherein the first private key and the first complementary public key are made available to the SIP device and the SIP client, respectively, before the SIP client requests secure access to the SIP device in the second SIP session,
• the method further comprising:
• accessing the SIP device by the SIP client in SIP media session, the SIP media session established between the SIP client and the SIP device, wherein:
• the SIP client is configured to:
• generate an AES key, asymmetrically encrypt the AES key using the first complementary public key previously registered to be uniquely associated with the SIP device, and transmit the encrypted AES key to the SIP device,
• the SIP device is configured to asymmetrically decrypt the encrypted AES key using the first private key previously registered to be uniquely associated with the SIP device, and
• the SIP client and the SIP device establish the AES tunnel by using the AES key for subsequent secure peer-to-peer communication between the SIP device and the SIP client during the SIP media session;
• prior to a subsequent request from the SIP client to securely access the SIP device in a further SIP session, providing the SIP device with a second private key in a fourth SIP session, the fourth SIP session established between the secure access server and the SIP device, the secure access server configured to:
• authenticate the SIP device,
• receive a request from the SIP device for the second private key in response to expiry of the first private key,
• generate a second asymmetric key pair comprising the second private key and a second complementary public key, the second asymmetric key pair being uniquely associated with the SIP device,
• encrypt the second private key, and
• transmit the second private key to the SIP device;
• wherein providing the SIP device with the second private key in the fourth SIP session makes the second private key and the second complementary public key available to the SIP device and the SIP client, respectively, before the SIP client requests secure access to the SIP device in the further SIP session.