BACKGROUND
In traditional telephony, a telephonic device, i.e., an analog telephone ("phone"), converts sound waves into an analog electrical signal that is transmitted over a channel to another phone which converts the analog electrical signal into sound waves. Later developed digital phones digitize the analog signals, packcti/.e ihe resulting digital signals, which are transmitted to a receiving phone where the packets arc combined and convened into analog signals and then, sound waves. Using a technique known as Voice Over Internet Protocol (VoIP), computing devices have been used to digitize the analog voice signals, break the digiti/:ed signals into frames, place the frames into packets, and transmit the packets over the Internet to another computing device. The receiving computing device extracts the frames from the packets, assembles the frames into a digitized signal, and converts the digitized signal into an analog voice signal.
In both the traditional and VoIP techniques, the phone acts as an audio device that converts sound waves into an analog electrical signal and vice versa. In traditional telephony, the phone also functions as the transmitter and receiver. It is also possible to pair a computing device with a phone. In such a pairing, the computing device functions as the transmitter and receiver and the phone provides the audio input and output. The paired devices provide telephony service.
When using VoIP, it is desirable that the pairing of a computing device with a phone is accomplished in a secure fashion with a minimum of user or admini.strativc intervention.
SUMMARY
"I'his summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. I'his summar\ is not intended to identify key features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
Pairing a phone with a computing device for secure VoIP communication on an IP network is disclosed. The phone may be a single phone or selectable from a plurality of phones. The computing device may be a single computing device or selectable from a plurality of computing devices, fhe phone is authenticated lo the computing device and the computing device is authenticated to the phone using an identity provided by an identity service such as an SIP service. If the authentications

succeed, a pairing data structure, dedicated to communicating with the coinpuling device, is created on the phone and a pairing data slruclure. dedicated to communicating with the phone, is created on the computing device, DHSCRII'TION OKTHK DRAWINGS
The foregoing aspects and many of the attcndani advantages of this invention will become more rcadil> appreciated as the same become belter understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein;
1-IGURl: I is a diagram of an exemplary network suitable for pairing computing devices with phones:
I'IGURl: 2 is a diagram of an exemplary device pairing using a USB channel for authentication:
I'IGURE 3 is a diagram of an exemplary device pairing using an II' channel for authentication:
fIGURf: 4 is a diagram of an exemplary device pairing involving multiple computing devices and using an IP channel for authentication;
fIGlJRl: 5 is a flow diagram of an exemplary method for pairing an !!' phone v\ iih a computing device using an IP channel for authentication;
I'IGURE 6 is a flow diagram of an exemplary method for pairing a computing device with an IP phone using an IP channel for authentication;
flCiURE 7 is a flow diagram of an exemplary method for pairing an IP phone u ith a computing device using a USB channel for authentication: and
I'IGURH 8 is a tlow diagram of an exemplary method for pairing a computing device with an IP phone using a USB channel for authentication.
DETAILED DESCRIPTION
In VoIP communication, a computing device is otten paired with a phone to provide telephony service. During the pairing of a computing device and a phone, it is desirable that the computer and the phone be securely authenticated, ll is preferable that secure authentication is accomplished with little or no direct human iniervcniion such as manual configuration by users or network administrators. One component used to enable such secure authentication is an identity service capable of providing idenlifiers (or devices such as phones and computing devices. An example of an

idernil} .service that enables secure authentication is a session initiation protocol (SIP) service. Typically an SIP service is provided by an SIP server.
SIP is a protocol for initiating, modifying, and terminating an inieraelive user .session that involves multimedia elements such as video, voice, instant messaging, online games, and virtual reality. SIP is a preferred signaling protocol lor VoIP. While primarily used to set up and tear down voice or video calls. SIP ma> also be used in instant messaging (IM), to publish and subscribe presence information, or in applications where session initiation is required. One purpose of SIP is to provide a signaling and call set-up protocol for IP based communications that can support a superset of the call processing functions and features present in the public suiieh telephone network (PSTN). While SIP does not define PS'ITJ features. SIP enables the building of such features into network elements such as proxy servers and user agents to provide familiar telephone-like operations such as, but not limited lo. dialing a number, causing a phone to ring, and producing ring-back tones or a bus> signal, I Icnce. a network in which computing devices arc paired with phones ortcn contains an SIP service provided by an SIP server or by a peer-to-peer network of phones and computing devices each operating an SIP software application.
ITGURTi I illustrates a diagram of an exemplary network in which computing devices may be paired with phones. The exemplary network illustrated in IKiDRl' I is assembled from various computing and communication devices. In particular, a computing device, machine A 100, communicates with an SIP server 110. .\ second computing device, machine B 102, and an IP phone I 14, also conununicalc ^\ith ihc SIP server 110. The SIP server 110 communicates with an access proxy 112. 1 he access proxy I \2 communicates with a third computing device, machine C 104. and also uith a fourth computing device, machine 0 106, A pairing 1 16 provides secure VoIP communication between the IP phone 114 and machine C 104. I'hc pairing I 16 is enabled by a pairing data structure component, i.e.. a pairing data structure. I 1!^ residing on the IP phone 114 and a pairing data structure 120 residing on the machine C 104.
Ihe pairing 116 may be created using an IP channel or a USB channel for auiheniicalion. Preferably, the pairing data structure componenls. i.e.. the pairing data structures, that enable the pairing reside on the computing devices and/or the phones. While the pairing data structures on the computing devices and phones access ihc SIP

server, preferably, the pairing data structures arc not a pari of the SIP server. When a pairing is created, a pairing data structure, dedicated to communicating v.itli tl-\c computing device, is created on the phone and a pairing data structure, dedicated Id communicating with the phone, is created on the computing device. The pairing data structures are created by a pair data structuring component. Other solhvare components may be used to enable pairing and/or creating pair data structures. I lence. pairing data structures and pair data structuring components should be construed as exemplary and not limiting.
I'iCiURl: 2 is an exemplary diagram illustrating an exemplary process ot pairing a computing device ivilh a phone using a USIi channel for authentication to provide secure VoIP communication on an IP network, such as an l!thernei neluork. In the exemplary process 200 illustrated in FlGURt 2. a phone 202. a computing device, i.e.. PC 204. and an SIP server 206 interact. As noted above, prelc'rabK. the solUvare components that enable the pairing reside on the PC 204 and the phone 202. fhe process 200 begins at the top of FIGURE 2 where the phone 202 registers with the SIP server 206 using the user's SIP identity. The PC 204 also registers with the SIP server 206 using the user's SIP identity, it is also possible for the PC 204 to register with the SIP server 206 before the phone 202 registers with the SIP server 206. The PC 204 sends an authentication message to all users, i.e.. all users connected to the IP network. o\er the SIP channel. Because the phone 202 is connected to the IP network, the phone 202 receives the authentication message. The authentication message's message type is for an IP phone and the authentication message contains a challenge. The phone 202 responds to the challenge over the (JSli channel. I he aulhcnlieation message contains a device RPID (end point idenlillert and the challenge sent b\ the PC 204. When the PC 204 receives the phone's response, the i'C 204 verifies that the appropriate response has been received from the USIi channel. If the PC 204 receives the phone's response on the USB channel, the device, e.g.. phone 202. and the PC. e.g.. PC 204- are paired and the device can send messages .speeillcally for the IP phone over a secure SIP channel. If the PC 204 recci\es the phone's response on a channel other than the USB channel, the device and the PC arc not paired and the device cannot send messages specifically for the IP phone over a secure SIP channel.

In contrast to FIGURB 2, which illustrates an exemplan process of pairing a PC \\ ilh a phone using more than one channel, i.e., an IP channel and a USB channel, for aulhcnlication. FIGURI: 3 illustrates an exemplar) process of pairing a PC with a phone u^ing an IP channel for authentication to provide secure VoIP communication on an IP network. In the exemplary process 300 illustrated in I'KIURI; 3. a phone 302. a computing device, i.e.. PC 304, and an SIP server 306 interact. As noted ab(we. preferably, the softv\are components that enable the pairing reside on the PC 3(]4 atid the phone 302. The process 300 begins at the top of FIGURL 3 where the phone 302 registers with the SIP server 306 using the user's SIP identity. Ihe PC 304 also registers with the SIP server 306 using ihe user's SIP identity. It is also possible for the PC 304 to register with the SIP server 306 before the phone 302 registers v\ ilh the SIP server 306. Ihe 1*C 304 sends an authentication message to all users, i.e.. all users connected to the IP network, over the SIP channel. Because the phone 302 is connected to the IP network, the phone 302 receives the authentication message. I he authentication message's message type is for an IP phone and the authentication message contains a challenge- Unlike the exemplary process 200 illustrated in FIGURF: 2. in the exemplary process 300 illustrated in FiGURI- 3, ihe phone 302 responds to ihe PC 304's challenge over the SIP channel. 'Fhc message, i.e.. the response message, contains a device EPID, the challenge sent by the PC. and location idenlil>ing information. When the PC 304 receives the phone 3()2's response, the PC 204 uses the hPID. the challenge sent by the PC. and the location idenlil\ing. information to verify that the appropriate response has been received from the SIP channel. If the location identifying information docs not provide enough information to verify that the appropriate response has been received to automatically determine co-location, the user is prompted to confirm the location. If co-location is aiitomalically determined or is verified by the user, the device, e.g., the phone 302. and llic 1*C. e.g. PC 304. are paired and the phone can send messages specilicall> lor the IP phone over a secure SIP channel. If the co-location is automaticall> selected, the automatic selection of is overrideable by Ihe user.
Similarh to the exemplary processes illustrated in FKIURF'S 2 and 3. ihe exemplary process illustrated in FIGURE 4 is used to pair phones with PCs lo provide secure VoIP communication on an IP network. The exemplary processes illustrated in FKiURliS 2 and 3 involved one PC and one phone. 'Fhc exemplar^' process illusiraied

in i-ICJlJRI:4 is a pairing process involving one phone and multiple computing devices and using an IP channel for authentication. In the exemplary process 400 illustrated in FIGURE 4, a phone 402, a first computing device, PC-A 404, a second computing device. PC-B 408, and an SIP server 406 interact. As noted above, preferably, the software components that enable the pairing reside on the PC-A 404. \'C-li 40f<. and the phone 402. The exemplary process 400 begins ai ihe top of i-IGlj'KI-; 4 where Ihe phone 402 registers with the SIP server 406 using the user's SIP identify, fhe I'C-A 404 and the PC-B 408 also register with the SIP server 406 using the user's SIP identity. It is also possible for the PC-A 404 and the PC-ii 408 to register with the SIP server 406 before the phone 402 registers with the SIP ser\er 406 aud for Ihe PC-R 408 to register before the PC-A 404 or the phone 402.
At this point in exemplary process 400, the user uses PC-A 404. making SIP client PC-A 404 the most recent active end point, "fhe PC-A 404 sends an authentication message to all users, i.e., all users connected to the IP network, over the Sll' channel. Because the phone 402 is connected to the !P network, ihc phone 402 receives the authentication message, fhe phone 402 responds to the PC-A 404's challenge over the SIP channel, fhe message, i.e., the response message, contains a device KPID. the challenge sent by the PC (PC-A 404), and location idenlilSing information. When Ihe PC-A 404 receives the phone 402's response, the PC-.'\ 404 uses ihc l^PID. the challenge .sent by the PC. and the location identifying information 10 verify that the appropriate response has been received from the SIP channel. Ihe phone 402 determines that PC-A 404 is the most recent active end point. I he device, e.g.. the phone 402. and the PC, e.g. PC-A 404, are paired and the phone can send messages specifically for the IP phone over a secure SIP channel.
At this point in exemplary process 400, the user uses PC-B 408. making SIP client PC-B 408 the most recent active end point and replacing PC-A 404 as the most recent active end point. Similarly to PC-A 404, PC-B 408 sends an authenlicalion message to all users, i.e., all users connected to the IP network, over the SIP channel. Because the phone 402 is connected to the IP network, the phone 402 receives Ihc authentication message. The phone 402 responds to the PC-B 408's challenge over ihe SIP channel. Not shown in TIGURH 4. the exemplary process 400 progresses in a fashion similar to the situation in which PC-A 404 was the most recent active end point, fhat is, the message, i.e.. the response message, contains a device I'PID, ihe

challenge sent b\' the PC {PC-B 408). and location identifying information. W hen the I'C-n 408 receives the phone 402's response, the PC-B 408 uses the l.J'ID. the challenge sent by the PC and the location identifying information to verify that the appropriate response has been received from the SIP channel. I he phone 402 determines that PC-B 408 is the most recent active end point. The device, e.g.. the phone 402. and the PC. e.g. PC-B 408. are paired and the phone can send messages speciIleally for the IP phone over a secure SIP channel.
I:.\cmplar\ processes of pairing phones with PCs, i.e.. computing devices, arc illustrated in TIGURliS 2-4 and described above. l-"our exemplary methods for accomplishing phone to computing device and computing device to phone pairing arc illuslraicd in l-KiL'RLS 5-8. As noted above, in pairing methods .such as the exemplary pairing methods illustrated in hIGURKS 5-8. preferably, the pairing software components reside on the computing devices and phones, and access SIP servers. Preferably, the pairing software components arc not a part of the SIP ser\crs.
fKUJRIi 5 is a flow diagram illustrating an exemplary method for pairing an IP phone, which may be a member of a plurality of IP phones, with a computing device, which may be a member of a plurality of computing devices, using an IP channel for authentication to provide secure VoIP communication on an IP nciwork. fhe method starts at block 500 in which a computing device, e.g.. a PC. registers, such as machine A 100 shown in KIGURH 1. (or PCs register) with an SIP server using the user's SIP identity. At block 502. an IP phone, such as IP phone 114 shown in 1'KJURI: 1. registers (or phones register) with an SIP server using the user's SIP identity, Ihe action in block 500 may occur before the action in block 503 or vice versa or the actions in blocks 500 and 502 may occur simultaneously. At block 504. the phone determines the most recently active PC. At decision block 506. it is determined if the user has registered only one PC and one phone. II' the user registered only one PC and only one phone, the control Hows to block 5 10. where I he phone sends a pairing request to the PC. The control then Hows lo block 520, II the user registered more than one PC and/or more than one phone, the control llo\vs lo block 508, where the phone sends pairing requests to all the user's registered i'Cs. Ai block 512. each PC informs the u.scr of pairing requests from the phone. At block 514. the most recent active PC is designated as the preferred PC. At decision block 516. a lest is made to determine if the user has overridden the preferred PC.

I'refcrablv. a timer is used to give the user a certain amount of time in which lo decide whether or not to override the preferred PC and select a different preferred PC. If the user decides to select a new preferred PC, the control flows to block 518 where ihc user designates a selected PC as the preferred PC and the control Hows to block 52U. If the user decides not to select a new preferred PC, the control Hows lo block 520 where the preferred PC responds to the pairing request. At block 522. the preferred PC and the phone are paired. After block 522. the method ends.
While the How diagram shown in KIGURB 5 illustrates an e\emplar> method for pairing an IP phone wiih a computing device using an IP channel for authentication to provide secure VoIP communication on an IP network, the How diagram shown in l-IGURIi 6 illustrates an exemplary method for pairing a computing device, which may be a member of a plurality of computing devices, with an IP phone, which may be a member of a plurality of IP phones, using an IP channel for authentication. The mclhod illustrated in FIGURE 6 begins at block 600. where one or more PCs register with the SIP server, using the server's SIP identity. At block 602. one or more IP phones register with the SIP server using the user's SIP idcnui_\. fhe action in block 600 may occur before the action in block 602 or vice versa or the actions in blocks 600 and 602 may occur simultaneously, .^t block 604. the PC delermines the most recently active IP phone. At decision block 606. it is delcrmined if the user has only one PC and only one phone. If the user has only one PC and only one phone, the control Hows to block 610, where the PC sends a pairing request to the IP phone, fhe control then Hows to block 620. Back at decision block 606. if the user has more than one PC or more than one phone, the control flows to block 608. where the PC' sends a pairing request to an user's IP phones. At block 612, each IP phone informs the user of a pairing request from the PC. At block 614. the most recent acli\e IP phone is designated as the preferred IP phone. At decision block 616, a test is made lo determine if ihe user has overridden the preferred IP phone. Preferably, a timer is used to give the user a certain amount of time in which to decide whether or not to override the preferred IP phone and select a different preferred IP phone. If ihc user decides to select a new preferred IP phone, the control flows to block 618 where the user designates a selected IP phone as the preferred IP phone and ihc control Hows to block 620. If the user decides not to select a new preferred IP phone, the control Hows to block 620 where the preferred IP phone responds to the pairing request. At block

622. the prcierrcd IP phone and the computing device arc paired. After block 522. the method ends.
While f ICitJRIiS 5 and 6 illustrate exemplary methods for pairing II' phones with computing devices using an IP channel. FIGURliS 7 and 8 illustrate exemplar) methods for pairing IP phones with computing devices using a IJSli channel. I'he liSli channel may be provided by connecting the computing devices and phones with IJSli cables or by attaching USB wireless "dongles" lo the computing devices and phones. A dongic is a hardware device that can be attached to a device via a USB connector and that contains circuitry for wireless communication. Il is also possible to use a combination ofcablcd and dongled computing devices and phones.
flCiURp: 7 is a (low diagram illustrating an exemplary method for pairing an IP phone with a computing device using more than one channel, i.e.. an IP channel and a USB channel, for authentication.. The method starts at block 700. where a PC registers with the SIP server using the user's SIP identity. At block 702. an IP phone registers with an SIP server using the user's SIP identity. At block 7(14. a user attaches a PC to an IP phone using a USB cord or a wireless dongic. I he actions in blocks 700. 702. and 704 may occur in any order and may occur simultaneously. Ai hli-)ck 706. an IP phone sends a challenge to all the user's PCs over the l.thcrnel which is an exemplary IP network. At block 708, the PC attached to the IP phone calculates the correct challenge response. At block 710. the PC sends the correct challenge response to a PC over a USB or wireless network connection. At block 712. the PC and the phone arc paired. After block 7!2, the method ends.
While the How diagram shown in f-'lGURli 7 illustrates an exemplar) method for pairing an IP phone with a computing device using a USB channel for aulhenlication. the How diagram shown in FlCiURI.: 8 illustrates an exemplar) method for pairing a computing device with an IP phone using more than one channel, i.e.. an IP channel and a USB channel, for authentication, to provide secure VoIP communication on an IP network. As in the exemplary method illustrated in PKIURI-7. the USH channel may be provided by connecting the computing devices and phones with USB cables or by attaching USB wireless dongles to the computing devices and phones or by a combination of cabled and dongled computing devices and phones. The method illustrated in FIGURE 8 stans at block 800. where a PC registers with the SIP server using the user's SIP identity. At block 802. an IP phone

registers with the SI!' server using the user's SIP identitv. Al block 804. a user altaches a PC to of computing devices on the IP network; (706) and
(c) the computing device (104) connected to the IP phone (I 14) via a network nol connected to the IP network transmitting a correct response lo the challenge. (7U)|
7. Ihc melhod of Claim 6. wlierein line network nol eonnecied lo line IP network is a USIi network,
8. (he method of Claim 6. wherein the network not connected lo the IP network is a wireless network.
4. The method ofClaim I, wherein authenticating the IP phone (114) io the
computing device (104) and the computing device (104) to the IP phone (i 14) using an identity registered with (he identity service comprises:
(a) connecting the computing device and the IP phone via a nelwiirlv tioi connected to the IP network; (804)
(h) the computing device (104) transmitting a challenge to each of a plurality oflP phones; (806) and
(c) the IP ph(*ne (t 14) connected to the computing device (104) via a nci\vork iu>i connected to the IP network transmitting a correct response to the challenge, (SOX)
10. rhc method of Claim 9. wherein the network not connected to the IP network is a USii nelwork.
I 1. The melhod of Claim 9. wherein the network not connected lo the IP network is a wireless network.
12. /\ computer readable medium having stored tliereon executable instructions that when selected pair a computing device (104) to an IP phone (114). ihe computer excculahle instructions including:

an identification component for registering the computing device's idcniiis witli an identity service:
an idcntilleation component for accessing the idcnlily service to acquire an IP phone's iJentit\;
an authenticating component for authenticating the IP phone (114) to ihc compuiing device (104) using the IP phone identity acquired from the identit\ service: and
a pair data siructuring component for creating a pairing data structure (120) an the computing device (104) dedicated to communicating with the IP phone (I 14).
13. The computer rcaiJabie medium of Claim 12. wherein the authenticating
component for authenticating the IP phone (114) to ihc computing device (i 04):
(a) determines the most recent active IP phone of a plurality of IP phones; (604)
(h) transmits a pairing request to each IP phone of the plurality' of II' phones: (608, 6IO)and
(c) designates the most recently active IP phone as a preferred IP phone. (614)
14. I he computer readable medium of Claim 13. wherein the designation o\' the preferred IP phone is overrideable. (616.618)
15. fhe computer readable medium of Claim 12. wherein tlie authcnticming component for authenticating the IP phone (114) to the computing device (104) authenticates the IP phone (114) lo the computing device (104) uses more than one communication channel.
16. A computer readable medium having stored thereon e\eciitablc instructions that when executed pair an IP phone (114) to a compuiing device (104). the computer executable instructions including:
an identification component for registering the IP phone's identity with an ideniil\ service;
an idernil'icalion competent for access!i\g the identity service U> iicquivc a computing device's idenlit)';
an authenticating component for authenticating the coinpuling device (104) to the IP phone (I 14) using the compuiing device's identity acquired from the idenlii_\ service: and

a pair daia strucluritig component for creating a pairing data structure (118) on the II' phone (114) dedicated to communicating with the computing device (104).
17. Ihe computer readable medium of Claim 16, wherein the authenticating
component for authenticating the computing device (104) to the IP phone (114):
(a) determines the most recently active computing device of a pluralii\ oT computing devices: (?04)
(b) transmits a pairing request to each computing device ol" the pluralil\ ol' computing devices: (5 14) and
(c) designates the most recently active computing device as a prclerrcd computing device. (514)
18, The computer readable medium of Claim 17, wherein the designation oi
the preterred computing device is overrideable, (516, 518)
\9. The computer readable medium of Claim 16, wherein the authenticating component for authenticating the computing device (104) to the IP phone (114) aulhenlicales the computing device (104) to the IP plione (114) uses more than one commimication channel-
20, I he computer readable medium of Claim 19. wherein the more than one commimication channels are an ii' network and a liSB network.