Abstract:
A method of building a secured unified public network for providing voice, video and data based on Internet Protocol (IP) and secured common channel signaling is disclosed. The network comprises a signaling network for common channel signaling; a data network for video, voice and data; a database for storing and processing digital keys and digital signatures; and the subscriber terminal devices connected to both the signaling network and the data network; The signaling network and database provide sign-on services, key exchange services, digital signature services and call processing services. The encrypted data are transmitted through the data network with shared keys of the caller and called parties.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    1. Field of the Invention  
           [0002]    This invention generally relates to digital broadband unified secured telecommunication network based on Internet Protocol (IP) for voice, video and data, and particularly to common channel signaling based on real physical or virtual private network.  
           [0003]    2. Description of Prior Art  
           [0004]    Though Internet can make full use of resource; the principle of “best effort” method, the lack of reliable subscriber&#39;s identification method and the lack of reliable control over network resource are limiting the ability of the current Internet to be a reliable and secure communication tool. For example, the path or trace of each packet of the voice, video and data traffic is based on “best effort” method and is controlled by Internet Protocols (IP), resulting both security and reliability concerns. An IP address can not be used as a trustable identification since it can be set by the subscriber themselves. In contrast, a subscriber in traditional Public Switched Telephone Network (PSTN) is identified through a physical address of the port on the line card that a telephone number is issued to, and the trace of the data traffic is managed by SS7 signaling network, or each subscriber in PSTN is well identified through their Physical location, and their data transmission trace is well controlled, except the limitation that the broadband data in PSTN network is expensive and difficulty to work with. The lack of the security and reliability of the Internet architecture limit the Internet to be a good solution to meet the demands of in today&#39;s fast paced world of e-Commerce, while PSTN technology just can&#39;t meet the demands for more economical broadband and easy interconnectivities.  
           [0005]    The security of the Internet has been a long concern to many subscribers, and has caused multiple billion dollars&#39; loss since Internet&#39;s starting to play a key role in people&#39;s daily life. For example, some of the security problems are: fake identities to access un-authorized hosts, interception of passwords and information, denial of services attack (DOS), spread of computer virus and worms, un-authorized monitoring subscribers&#39; activities, such as changing the Web contents, unable to trace the attacking sources, and etc. All these security problems are very hard to overcome and very expensive to fix with current Internet without major enhancement of the network infrastructure functionalities.  
           [0006]    Many methods are available today, such as Certificate Authentications with SSL, VPN, and SSH. They are very effective on preventing several types of attacks and protecting the information and network, but are difficult to setup, and are not designed for general public communication network. The DOS or flooding attack is a fundamental weakness of Internet; no technology can effectively stop it yet.  
           [0007]    Some of the great success of PSTN services including 1-800 called party paying and 1-900 services cannot be implemented in today&#39;s Internet because lack of metered service on demand architecture.  
           [0008]    Hence, a method of building a secured unified public network is required to overcome the disadvantages of the prior art.  
         BRIEF SUMMARY OF THE INVENTION  
         [0009]    An object of the present invention is to enhance the functionalities of the Internet, further it will enable Internet to be used as a secured public telecommunication network.  
           [0010]    Another object of the present invention is to set up a foundation for toll services including 1-800 and 1-900 number services based on Internet Protocol (IP).  
           [0011]    To fulfill the above mentioned objects, a secured unified network in accordance with the present invention comprises a signaling network based on secured private network for common channel signaling, a data network for voice, video and data traffic, at least two terminal devices are connected to both the signaling network and data network, and a database associated with the signaling network. The signaling network is based on a stand alone independent physical network, or a virtual private network that shares the same physical media with the data network, or a combination of a stand alone physical network and a virtual private network. The database contains pre-stored information for each subscriber and also is used to provide digital signature services. When a subscriber connects his/her terminal to the signaling network, the signal module of the terminal device will perform a sign-on process with the signaling network. The sign-on process will establish an identity of the subscriber, service privileges, security status, and other status required for services. When the caller party originate a call, his/her identity and his/her public key will be signed by the database in the signaling network and passed to a called party, and the called party will also return his/her public key via the signaling network and be signed by the signaling network to the caller party. The public keys which exchange between the caller and called party can be either fixed public keys or generated based on session-by-session to achieve maximum security. After both the caller and called party agree on each other&#39;s identity, voice, video and data will be encrypted by a shared key which is generated by negotiation of the two parties and sent between the two parties by the data network. At the same time, the signaling network saves and processes the detail billing information in the database and prepares for billing.  
           [0012]    Other objects, advantages and novel features of the invention will become more apparent from the following detailed description of the present embodiment when taken in conjunction with the accompanying drawings. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0013]    For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following description taken in conjunction with the accompanying drawings, wherein like reference numerals represent like parts, in which:  
         [0014]    [0014]FIG. 1 illustrates a secured unified network for voice, video, and data;  
         [0015]    [0015]FIG. 2 illustrates a sign-on signaling process;  
         [0016]    [0016]FIG. 3 illustrates a calling process, public keys exchanging process and a shared key generating process. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0017]    [0017]FIG. 1 illustrates a secured unified network for transmitting voice, video, and data. The network comprises the following parts: a signaling network  10  based on a secured private network for common channel signaling; a data network  11  for sending encrypted voice, video and data; a database  12  for storing and processing pre-stored information for each subscriber, as well as signing public keys and communication parameters for each subscriber; and terminal devices  13  that run the signaling software and encryption software.  
         [0018]    The signaling network  10  is designed as a common channel signaling network. Each link between the signaling network  10  and the terminal device  13  is unique in the sense of security and is based on shared keys.  
         [0019]    The signaling network  10  is an independent network or a virtual private network which shares the same physical media with the data network  11 , or a combination of a stand alone physical network and a virtual private network.  
         [0020]    The database  12  is connected to the signaling network  10 . The database  12  stores a key for each subscriber. Different subscribers will have different keys. The keys are used to establish the identity as well to establish the privileges and service rights of each subscriber.  
         [0021]    The database  12  also provides digital signature services for each calling process for both the caller and called parties. This is one of the additional security measures which ensure the correct public keys being used in the encryption processes. It is also used for establishing the service privileges.  
         [0022]    A subscriber terminal device  13  is physically connected to the signaling network  10  through a wired cable, or a wireless channel, or other networks shared by more than one subscriber. The physical link between the subscribers and the signaling network  10  can be shared with the data network  11  and other subscribers or other shared physical media.  
         [0023]    A subscriber terminal device  13  is linked to the signaling network  10  via either an independent physical media or a virtual private link that shares the physical link or network with data link and other subscribers.  
         [0024]    Each terminal device  13  has two connections, one is to the signaling network  10  and the other is to the data network  11 , and the two connections can be physically separated or share the same physical media or network.  
         [0025]    [0025]FIG. 2 illustrates a sign-on signaling process. After the subscriber terminal device  13  is linked to the signaling network  10 , the subscriber terminal device  13  will send a request for sign-on with the subscriber&#39;s public key KEY 1 . After the signaling network  10  receives the sign-on request, it will return a shared key KEY 2  encrypted with KEY 1  to the subscriber. The subscriber terminal device  13  will use KEY 2  to encrypt the subscriber&#39;s sign-on Universal ID (UID) which is a unique number with  16  digits used to identify each subscriber in a worldwide area. The subscriber will also use KEY 2  to encrypt the sign-on subscriber&#39;s information. Both encrypted UID and sign-on subscriber&#39;s information with KEY 2  will be sent to the signaling network  10  in format of IP packets for sign-on processing. Then the signaling network processes the sign-on information in comparison with information pre-stored in the signaling network database.  
         [0026]    The signaling network database  12  contains the shared key KEY 2  and the sign-on data. After the sign-on information is received from the subscriber, KEY 2  will be used to de-encrypt the sign-on data and the signaling network checks the sign-on data and establishes the identities, privileges, service type, communication parameters and service rights of the subscriber. Then the signaling network  10  will send an acknowledgement back to the terminal device  13  on the success of the sign-on.  
         [0027]    The said shared key KEY 2  is generated by negotiation between the subscriber terminal devices  13  and the signaling network  10  or is only generated by the signaling network. And for each sign-on process, the shared key KEY 2  will be different.  
         [0028]    After sign-on process, the subscriber&#39;s status in the database  12  will be marked as “On Line Ready”, and the subscriber is ready now, he/she can call others or be called by others.  
         [0029]    After sign-on, the link between the subscriber&#39;s terminal device  13  and the signaling network  10  will be based on the secure link with KEY 2 . From now and on, all signaling will be encrypted by KEY 2 .  
         [0030]    [0030]FIG. 3 illustrates the calling process and public key exchanging process and a shared key generating process. When a subscriber terminal device  13  (here referred to as terminal  1 ) initials a call to another subscriber terminal  13  (here referred to as terminal  2 ), he/she will first create a public key KEY 3 . He/She will send a calling request for link along with a set of options of communication parameters and KEY 3  to the signaling network  10 . The signaling network  10  will digitally sign the KEY 3  and forward the request to terminal  2   13 . Here, terminal  1   13  and terminal  2   13  must have already signed on the signaling network  10 .  
         [0031]    After terminal  2   13  receives the request for link from terminal  1   13 , he/she can decide whether to answer the call from terminal  1   13  or not. In the case that terminal  2   13  wants to answer the call from terminal  1   13 , he/she will create a public key KEY 4  and send it along with other communication parameters to the signaling network  10 . The signaling network  10  will digitally sign KEY 4  and the communication parameters and forward them to terminal  1   13  and acknowledge that the call is answered.  
         [0032]    KEY 3  and KEY 4  are generated for this call only for maximum-security reasons. They can also be generated once only and for all calls.  
         [0033]    After changing the public keys, each party generates a part of a shared key KEY 5 . Then each party encrypts his/her part of KEY 5  by using the public key of the other party and transmits it to the other party via the signaling network  10 , whereby a shared key KEY 5  is generated.  
         [0034]    After both parties get KEY 5 , the secure link between them is established. Each party encrypts voice, video and data by using KEY 5  and transmits them to the other party via the data network  11 . Then the other party uses KEY 5  to de-encrypt voice, video and data after receiving them.  
         [0035]    The shared key KEY 5  is generated only for one communication session, and a new shared key is generated for a new communication session each time.  
         [0036]    Further, A more sophisticate calling process may involve the communication parameter exchanges among the caller party, the signaling network  10  and the called party.  
         [0037]    The caller and called party should establish their identities via the secured private common channel signaling network based on information pre-stored in the signaling network database  12 . When the caller party initials a call that involves communication parameters, he/she must be sure that these parameters are acceptable by both the signaling network  10  and the called party. The caller party will send a list of options, in which are service type, bandwidth and priority, etc, to the signaling network  10 . The signaling network  10  will check the called party&#39;s registered parameters and availability of the services from network and then forward a new set of parameters that the network can serve to the called party, and the called party will make a final choice on the parameters and return a decision to the signaling network  10  and finally the decision is forwarded to the caller party. If the caller party accepts the decision, the communication parameters are set.  
         [0038]    When the caller party sends out an optional list of the parameters, he/she will also mark the priority of each option so that both the signaling network  10  and the called party can have a better understanding of the caller party&#39;s request. The highest priority option can be served first.  
         [0039]    Either the caller party or the called party can exit the communication. If he/she wants to do so, the signaling network  10  will inform the other party and release corresponding resource.  
         [0040]    In additional, referring to FIGS. 1, 2 and  3 , toll services including 1-800 and 1-900 number services can also be provided based on the signaling network  10  and security architecture. After establishing the caller and called parties&#39; identities by the shared keys between subscribers and the signaling network  10 , the signaling system serves the request of the calling and called subscribers, then saves detailed billing information in the database  12  and processes the billing information. For example, If 800 number service is selected, the signaling system will prepare the information for billing of the called party. If 900 number service is selected, the signaling system will prepare the information for billing of the caller party.  
         [0041]    Billing information contains the caller and called parties&#39; identities, physical locations of the caller and called party, resource provided by the data network to meet the demands of the two parties, duration of the calling and status changes during the calling.  
         [0042]    In the foregoing specification, the invention has been described with reference to specific embodiments thereof It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.