Patent ID: 7464267

Claim:
A method of operating a call agent to establish a shared secret media key between each of a caller endpoint and a callee endpoint, the method comprising: establishing a caller authenticated signaling session with the caller endpoint using a caller shared secret authentication key and an authentication hash algorithm, establishing the caller authenticated signaling session comprising: receiving a restart in progress message from the caller endpoint, the restart in progress message comprising: a first random number generated by the caller endpoint; the caller public value, the caller public value being a remainder of a generator value raised to the power of a private value divided by a predetermined large prime number; and a first digest value, the first digest value being the result of performing a hash algorithm on a unique identifier of the caller endpoint, an initial security key, the caller public value, and the first random number; determining that the digest value is verified if the digest value matches a result of performing the hash algorithm on a combination of the unique identifier of the caller endpoint from the message, the initial security key stored in association with the identifier of the caller endpoint by the call agent in a client authentication table, the caller public value from the message, and the first random number from the message; and establishing the signaling session only if the digest value is verified, establishing the signaling session comprising generating a local public value and a local private value of a pair of values, the local public value being a remainder of the generator value raised to the power of the local private value divided by the predetermined large prime number; calculating the caller shared secret authentication key, the caller shared secret authentication key being a remainder of the caller public value raised to the power of the local private value divided by the predetermined large prime number; and providing the local public value to the caller endpoint; establishing a callee authenticated signaling session with the callee endpoint using a callee shared secret authentication key and an authentication hash algorithm; receiving caller public value from the caller endpoint through the caller authenticated signaling session, the caller public value being a public value of a pair of values generated by the caller endpoint and useful for calculating the shared secret media key; sending the caller public value to the callee endpoint using the callee authenticated signaling session; receiving a callee public value from the callee endpoint through the callee authenticated signaling session, the callee public value being a public value of a pair of values generated by the callee endpoint, independent of the pair of values generated by the caller endpoint, and useful for calculating the shared secret media key; sending the callee public value of the caller endpoint using the caller authenticated signaling session.