CN1893722A - Method for binding IP multi-media subsystem authentication and acess-in layer authentication - Google Patents

Abstract

The invention discloses a binding method of IP multimedia subsystem authentication and access layer authentication, comprising: after receiving a registration message sent by UE, P-CSCF determines the CLF according to the information in the registration message ; The P-CSCF queries the CLF for the attachment information of the UE in the access network to obtain a query result, and sends a registration message carrying the query result to the I-CSCF; the I-CSCF forwards the registration message to The S-CSCF notified by the home subscriber server HSS; the S-CSCF performs authentication on the UE to obtain the authentication result according to the binding authentication mode of the service layer authentication and the access layer authentication obtained from the HSS, and sends the authentication result The right result is sent to UE. In the present invention, the HSS of the business layer decides the authentication mode of the user, and the S-CSCF completes the authentication process, which is more reasonable. The technical solution of the invention requires little modification to the existing IMS AKA process, and has the advantage of being easy to implement.

Description

A method for binding IP multimedia subsystem authentication and access layer authentication

technical field

The invention relates to the technical field of user terminal authentication in an IP multimedia service sub-network (IMS), in particular to a binding method of IP multimedia subsystem authentication and access layer authentication.

Background technique

In a fixed next generation (NGN) network and a mobile network, the network can generally be divided into an access network and a service network. Users access the IP network through the access network of the access network operator, and then enjoy different services, such as voice, video, and streaming media, through the service network of one or more service network operators.

If the access network and the service network do not belong to the same operator, the authentication of the user by the access network and the authentication of the user by the service network are independent of each other. In this case, if a user wants to enjoy a certain service, usually two authentications are required, one is the authentication of the access layer, after passing the authentication of the access layer, the user can access the NGN network; the other is the authentication of the access layer. For the authentication of the service layer, the user can enjoy the services provided by the service network after passing the authentication of the service layer.

If the service network and the access network belong to the same operator, or there is a cooperative relationship between the service network operator and the access network operator, in some networking situations, the service network operator can The authentication of the access layer is bound with the authentication of the access layer, that is, after the user passes the authentication of the access layer, the user is considered to be safe, and the authentication of the service layer is no longer required.

In the existing IP Multimedia Service Subnetwork (IP Multimedia Core Network Subsystem, IMS) access layer, generally use IMS authentication-based Key Agreement (AKA) process to realize the authentication of the IMS service layer to the user.

Referring to Figure 1, the AKA process includes the following steps:

Step 101, a user terminal (User Equipment, UE) sends a registration message Register to a proxy-call session control function entity (Proxy-Call Session Control Function, P-CSCF).

Step 102, the P-CSCF, acting as a Session Initial Protocol (SIP) proxy server, forwards the UE's registration message Register to the interrogating-call session control function entity (Interrogaing-Call Session Control Function, I-CSCF).

Step 103, I-CSCF selects corresponding service call session control function entity (Service-Call Session Control Function, S-CSCF) by Cx-Selection-Info message between I-CSCF and home subscriber server (Home Subscribe Server, HSS), i.e. I - The CSCF sends a request to the HSS, and searches the user attributes in the HSS to determine which S-CSCF is to process the registration message.

In step 104, the I-CSCF forwards the UE's registration message Register to the S-CSCF determined in step 103.

In step 105, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 106, the S-CSCF sends an AV-Req message to the HSS to request the user's authentication vector.

Step 107, the HSS sends an AV-Req-Resp message to the S-CSCF, and sends the user's authentication vector to the S-CSCF.

Step 108, the S-CSCF judges that the user needs to be authenticated according to the authentication vector obtained in step 107 and the registration message of the UE, and then sends a 4xx Auth_Challenge message to the I-CSCF, indicating that authentication is required, and carries There is information related to authentication. Among them, 4xx represents a type of error, and xx represents a number from 00 to 99.

Step 109, the I-CSCF sends the 4xx Auth_Challenge message to the P-CSCF.

Step 110, the P-CSCF sends the 4xx Auth_Challenge message to the UE.

Step 111, after receiving the 4xx Auth_Challenge message, the UE resends a new registration message Register to the P-CSCF, and the Register carries authentication parameters.

In step 112, the P-CSCF sends the UE's Register message to the I-CSCF.

Step 113, after the I-CSCF receives the registration message Register, it determines with the HSS which S-CSCF the UE registration message is for processing through Cx-Query, that is, the I-CSCF queries the HSS for which S-CSCF the user registration message is for The S-CSCF processes, and the HSS informs the I-CSCF of the S-CSCF that processes the user registration message according to the stored S-CSCF indication information.

In step 114, the I-CSCF forwards the registration message Register to the S-CSCF determined in step 113.

In step 115, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user is in this S-CSCF.

Step 116, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

Step 117, the S-CSCF performs authentication according to the subscription data information of the user and the authentication parameters in the UE registration message Register. If the authentication is successful, the S-CSCF sends a 2xxAuth_OK message to the I-CSCF, indicating that the registration is successful, where 2xx indicates the corresponding message of success, and xx is a number from 00 to 99. If the authentication fails, the S-CSCF sends a message indicating the authentication failure to the I-CSCF.

Step 118, if the authentication is successful, the I-CSCF sends the above 2xx Auth_OK message to the P-CSCF. If the authentication fails, the I-CSCF sends the message indicating the authentication failure to the P-CSCF.

Step 119, if the authentication is successful, the P-CSCF sends the above 2xx Auth_OK message to the UE. If the authentication fails, the P-CSCF sends the message indicating the authentication failure to the UE.

France Telecom proposed a solution to realize the binding of IMS service layer authentication and access layer authentication at the TISPAN 6bis interim meeting of telecommunications and Internet convergence services and advanced network protocols. In this solution, the connection location function entity (Connection Location Function, CLF) in the Network Attachment Subsystem (Network Attach Sub System, NASS) stores the corresponding relationship between the IP address of the UE and the access user identification (subscription-id), and The binding identifier for binding the UE service layer authentication and access layer authentication, wherein each connection of a user has an access user identifier.

Referring to Figure 2, the general flow of the program is as follows:

In step 201, the UE sends a registration message Register to the P-CSCF.

In step 202, the P-CSCF queries the CLF for the UE's attachment information according to the source IP address of the registration message. The attachment information includes the UE's access user ID and an indication of service layer authentication and access layer binding.

In step 203, the P-CSCF compares the UE's access user ID with the private user ID in the authentication header field in the registration message. If the two are consistent, then the IMS service layer authentication is successful, and step 205 and its subsequent steps are executed. Otherwise, if the authentication fails, step 204 is performed to send an authentication failure message 403 Forbidden to the UE.

In step 205, the P-CSCF continues to forward the UE's registration message Register to the I-CSCF, and the message carries an indication of whether the authentication is successful.

Step 206, the I-CSCF and the HSS select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the HSS, and searches the user attributes in the HSS to determine which S-CSCF handles the registration report arts.

In step 207, the I-CSCF sends the registration message Register to the S-CSCF determined in step 206.

Step 208, after the S-CSCF confirms that the user has successfully registered, it does not request the user's authentication vector from the HSS, but directly communicates with the HSS through a Cx-Put message, updates the S-CSCF indication information on the HSS, and informs the HSS of the user Subsequent processing is carried out in this S-CSCF, and the subscription data of the user is downloaded through the Cx-Pull message between the S-CSCF and the HSS.

In step 209, the S-CSCF returns a 2xx message to the I-CSCF, indicating that the authentication is successful.

Step 210, the I-CSCF sends the 2xx authentication success message to the P-CSCF.

Step 211, the P-CSCF sends the 2xx authentication success message to the UE.

In the above technical solution, the private user ID carried in the registration message Register is required to be consistent with the user's access user ID, that is, the private user ID of the service layer and the user ID of the access layer are the same ID, but in many cases, the service network Operators and access network operators are not the same operator, forcing them to use the same identity will limit the flexibility of network applications. It is also unreasonable to indicate service layer authentication and access layer binding in the attachment subsystem of the network access layer. It should be indicated by relevant equipment (such as HSS) in the service layer, and the access layer network is only responsible for providing relevant information. . It is also unreasonable for the P-CSCF to complete the authentication work. The reasonable way should be that the home S-CSCF completes the authentication work of the service layer, and the P-CSCF is also only responsible for providing authentication-related information.

Contents of the invention

In view of this, the purpose of the present invention is to propose a method for binding IP multimedia subsystem authentication and access layer authentication in which the user authentication mode is determined by the service layer.

According to the above purpose, the present invention provides a method for binding IP multimedia subsystem authentication and access layer authentication, the method includes the following steps: after A.P-CSCF receives the registration message sent by UE, The information in the registration message and the correspondence between the information in the preset registration message and the CLF determine the CLF;

B. The P-CSCF queries the CLF for the attachment information of the UE in the access network to obtain a query result, and sends a registration message carrying the query result to the I-CSCF;

C. The I-CSCF forwards the registration message to the S-CSCF notified by the HSS;

D. The S-CSCF authenticates the UE to obtain the authentication result according to the binding authentication mode of the service layer authentication and the access layer authentication obtained from the HSS, and sends the authentication result to the UE.

In the above solution, before step A, it further includes: A1. UE sends a registration message to S-CSCF; A2. S-CSCF requests the HSS for the authentication vector of the UE; The data judges whether the authentication method of the UE is the binding of the service layer authentication and the access layer authentication, and if yes, sends a message including the authentication method to the S-CSCF; A4. The UE sends a message including the authentication method; A5. After receiving the message including the authentication method, the UE sends a new registration message to the P-CSCF; the registration described in step A, step B and step C The message is the new registration message.

In the above solution, before step D, it further includes: the S-CSCF requests the HSS for the authentication vector of the UE; the HSS judges whether the authentication mode of the UE is service layer authentication and The access layer authenticates and binds, and if yes, sends a message including the authentication mode to the S-CSCF.

The HSS further includes, after the step of judging whether the UE's authentication mode is binding service layer authentication and access layer authentication according to the preset user authentication subscription data: if the UE's authentication mode is not service In the case that layer authentication is bound with access layer authentication, it is processed according to the key agreement AKA process.

The information in the registration message in step A is the access operator identifier or the source IP address of the registration message.

Preferably, the registration message includes the access user identifier; the attachment information of the UE in the access network corresponding to the access user identifier is stored in the CLF in advance; in step B, the P-CSCF sends the The step of the CLF querying the attachment information of the UE in the access network to obtain the query result includes: P-CSCF queries the CLF for the attachment information of the UE in the access network according to the access user identifier; When attaching information of the IP address information corresponding to the access user identifier, the CLF returns a query result including the IP address information to the P-CSCF, otherwise returns a query result of query failure to the P-CSCF.

Preferably, the registration message includes a private user identifier; the attachment information of the UE corresponding to the private user identifier in the access network is stored in the CLF in advance; in step B, the P-CSCF reports to the CLF The step of querying the UE's attachment information in the access network to obtain the query result includes: P-CSCF queries the CLF for the UE's attachment information in the access network according to the private user identifier; When identifying the attachment information of the corresponding IP address information, the CLF returns a query result including the IP address information to the P-CSCF, otherwise returns a query result of query failure to the P-CSCF.

Step B further includes the step of P-CSCF sending the source IP address of the received registration message to I-CSCF; step C further includes I-CSCF forwarding the source IP address of the registration message to the S-CSCF The step; the step of authenticating the UE in step D to obtain the authentication result includes: when the query result includes IP address information, the S-CSCF compares the source IP address of the registration message received by the P-CSCF If the source address is consistent with the IP address information in the query result, an authentication result of successful authentication is obtained; otherwise, an authentication result of authentication failure is obtained; when the query result is query failure information, the S-CSCF The authentication result of authentication failure is obtained.

Preferably, the attachment information of the UE in the access network corresponding to the source IP address of the registration message is stored in the CLF in advance; in step B, the P-CSCF queries the CLF for the attachment information of the UE in the access network The step of obtaining the query result from the information includes: P-CSCF queries the CLF for the attachment information of the UE in the access network according to the source IP address of the registration message; When accessing the attachment information of the user-associated information, the CLF returns a query result including the accessed user-associated information to the P-CSCF, otherwise returns a query result of query failure to the P-CSCF.

In Step D, before authenticating the UE to obtain the authentication result, it further includes the step that the S-CSCF obtains from the HSS the bound access user association information stored in the HSS in advance; in Step D, the UE is authenticated to obtain The step of authenticating the result includes: when the query result includes access user association information, the S-CSCF compares the bound access user association information obtained from the HSS with the access user association information in the query result , if consistent, obtain an authentication result of successful authentication, otherwise obtain an authentication result of failed authentication; when the query result is query failure information, the S-CSCF obtains an authentication result of failed authentication.

In the above solution, the access user association information is access user identifier, location information or IP address information.

It can be seen from the above scheme that the present invention queries the attachment information in the CLF through the access user ID, the private user ID or the source IP address of the registration message, and the HSS determines the user authentication mode, and the S-CSCF performs the authentication. Judgment on success or failure. Different from the prior art, in the present invention, compared with the prior art, the HSS of the service layer decides the authentication mode of the user, and the S-CSCF completes the authentication process, which is more reasonable. Moreover, the present invention locates the CLF according to the access operator ID, and uses the access user ID to query the CLF for user attachment information. At this time, it is not required that the service layer user ID and the access user ID must be the same. At the same time, considering the actual networking situation and simplifying the solution, this solution also supports when the service operator and the access operator are the same operator and the IP address is well planned, and the private user ID of the service layer and the access user ID are At the same time, you can use the source IP address of the registration message to locate the CLF, and use the service layer private user ID or the source IP address of the registration message to go to the CLF to query the user's attachment information in the access network. And, when the S-CSCF is authenticated, by comparing the IP address information obtained from the CLF query with the source IP address of the registration message received by the P-CSCF, or by comparing the access user association information obtained from the CLF query with the When the bound access user association information obtained by the HSS is consistent, an authentication success result is obtained, and when the two are inconsistent, an authentication failure result is obtained. Therefore, compared with the prior art, this solution has more versatility and flexibility, conforms to the principle of business layer authentication in the solution, and has a more reasonable and logical implementation mode. In addition, the technical solution of the present invention is more effective to the existing IMS AKA process. The changes are relatively small, and the process is basically the same, except for the change of authentication parameters, which is easier to integrate with the existing IMS AKA process, and has the advantage of being easy to implement.

Description of drawings

FIG. 1 is a schematic flow chart of the AKA authentication mechanism;

Fig. 2 is the schematic flow chart of prior art;

3a and 3b are schematic flow charts of the first embodiment of the present invention;

4a and 4b are schematic flow charts of the second embodiment of the present invention;

5a and 5b are schematic flow charts of the third embodiment of the present invention;

6a and 6b are schematic flow charts of a fourth embodiment of the present invention;

7a and 7b are schematic flow charts of a fifth embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the following examples are given to further describe the present invention in detail.

Based on the AKA process, the first embodiment of the present invention provides a binding method of IMS service layer authentication and access layer authentication. In the first embodiment, the user's authentication subscription data is stored in the HSS in advance, and the authentication subscription data indicates whether the user's authentication mode is the binding of the service layer authentication and the access layer authentication.

Referring to Figure 3a and Figure 3b, the flow of the first embodiment is as follows:

In step 301, the UE sends a registration message Register to the P-CSCF.

In step 302, the P-CSCF forwards the Register message of the UE to the I-CSCF.

Step 303: The I-CSCF and the HSS select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the HSS to find out the user attributes in the HSS to determine which S-CSCF will process the registration report. arts.

In step 304, the I-CSCF forwards the UE's registration message Register to the S-CSCF determined in step 303.

In step 305, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 306, the S-CSCF sends an AV-Req message to the HSS to request the user's authentication vector.

Step 307, the HSS checks the user's authentication subscription data, judges according to the authentication subscription data whether the user's authentication method is the binding of service layer authentication and access layer authentication, and if so, executes step 308 and its subsequent steps, Otherwise, execute steps 107 to 119 of the AKA process to perform a general authentication process.

In step 308, the HSS sends an AV-Req-Resp message to the S-CSCF. Different from the authentication vector sent in the prior art, in this step, the user's authentication mode information is sent to the S-CSCF.

In step 309, the S-CSCF learns that the user's authentication method is binding service layer authentication and access layer authentication according to the authentication method information obtained in step 308, and then sends a 4xxAuth_Challenge message to the I-CSCF, and In the authentication header field of the message, it is indicated that the authentication mode is the binding of the service layer authentication and the access layer authentication, that is, the authentication mode indication information is carried.

Step 310, the I-CSCF sends the 4xx Auth_Challenge message carrying the authentication mode indication information to the P-CSCF.

Step 311, the P-CSCF sends the 4xx Auth_Challenge message carrying the authentication mode indication information to the UE.

At this time, since the P-CSCF learns from the message that the authentication mode is the binding of the service layer authentication and the access layer authentication, the P-CSCF does not need to establish a security association with the UE.

Step 312, after receiving the 4xx Auth_Challenge message, the UE sends a registration message Register to the P-CSCF again, and the message carries the access operator ID and the access user ID.

In step 313, the P-CSCF determines the CLF according to the operator identifier in the registration message and the preset correspondence between the operator identifier and the CLF.

In step 314, the P-CSCF searches the CLF determined above for the attachment information of the user at the access layer according to the access user identifier in the registration message. Different from the prior art, the data record of the attachment information corresponding to the access user ID is stored in the CLF in advance, and the attachment information includes IP address information, location information, etc., but does not include the binding ID of the prior art. If there is no data record of the access user ID in the CLF, the CLF will return query failure.

In step 315, the P-CSCF sends the registration message Register carrying the query result in the previous step and the source IP address of the Register received by the P-CSCF to the I-CSCF. If the previous query is successful, the attachment information obtained from the query is sent to the I-CSCF; if the query fails, the query failure information is reported to the I-CSCF.

In step 316, the I-CSCF and the HSS determine which S-CSCF to process the UE registration message through Cx-Query, that is, the I-CSCF inquires from the HSS which S-CSCF the registration message is to process, and the HSS uses the saved S-CSCF to process the registration message. - The CSCF indication information informs the I-CSCF to process the S-CSCF of the registration message.

In step 317, the I-CSCF forwards the Register packet containing the query result and the source IP address of the Register received by the P-CSCF to the S-CSCF determined in step 316. The query result is the attachment information obtained from the query when the query succeeds, and the query failure information reported when the query fails.

Step 318, when the query result is the attachment information obtained from the query, the S-CSCF judges whether the source IP address of the Register message Register received by the P-CSCF is consistent with the IP address information in the attachment information obtained from the CLF query, If they are consistent, it means that the authentication is successful, and step 319 and its subsequent steps are executed, that is, a message of successful authentication is sent to the UE; Failed message.

When the query result is the reported query failure information, it also means that the authentication fails, and step 331 and its subsequent steps are executed, that is, a message of authentication failure is sent to the UE.

In step 319, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 320, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 321, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful.

Step 322, I-CSCF sends the above 2xx Auth_OK message to P-CSCF.

In step 323, the P-CSCF sends the above 2xx Auth_OK message to the UE.

In step 331 shown in Figure 3b, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 332, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 333, the S-CSCF sends an authentication failure message to the I-CSCF, indicating that the authentication fails.

Step 334, the I-CSCF sends the authentication failure message to the P-CSCF.

In step 335, the P-CSCF sends the authentication failure message to the UE.

When the access network operator and the service network operator are the same operator, since the access user ID and the private user ID are the same, the NASS will not issue the access operator ID and the access user ID to the UE. The method of the second embodiment shown in Figure 4a and Figure 4b can be used, the second embodiment is a simplified method of the first embodiment, in the second embodiment, the source IP address of the Register is used to identify the access operator and CLF, and query the attachment information of the UE at the access layer in the CLF according to the private user identity of the IMS service layer. Like the first embodiment, the user's authentication subscription data is stored in the HSS in advance, and the authentication subscription data indicates whether the user's authentication mode is binding of service layer authentication and access layer authentication.

Referring to Fig. 4a and Fig. 4b, the second embodiment comprises the following steps:

Wherein, Step 401 to Step 411 are the same as Step 301 to Step 311 in the first embodiment.

In step 401, the UE sends a registration message Register to the P-CSCF.

In step 402, the P-CSCF forwards the Register message of the UE to the I-CSCF.

Step 403: The I-CSCF and the HSS select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the HSS to search the user attributes in the HSS to determine which S-CSCF is to process the registration report. arts.

In step 404, the I-CSCF forwards the UE's registration message Register to the S-CSCF determined in step 403.

In step 405, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 406, the S-CSCF sends an AV-Req message to the HSS to request the user's authentication vector.

Step 407, the HSS checks the user's authentication subscription data, judges according to the authentication subscription data whether the user's authentication method is the binding of service layer authentication and access layer authentication, and if so, executes step 408 and its subsequent steps, Otherwise, execute steps 107 to 119 of the AKA process to perform a general authentication process.

In step 408, the HSS sends an AV-Req-Resp message to the S-CSCF. Different from the authentication vector sent in the prior art, in this step, the user's authentication mode information is sent to the S-CSCF.

In step 409, the S-CSCF learns that the user's authentication method is the binding of service layer authentication and access layer authentication according to the authentication method information obtained in step 408, and then sends a 4xxAuth_Challenge message to the I-CSCF, and In the authentication header field of the message, it is indicated that the authentication mode is the binding of the service layer authentication and the access layer authentication, that is, the authentication mode indication information is carried.

Step 410, the I-CSCF sends the 4xx Auth_Challenge message carrying the authentication mode indication information to the P-CSCF.

Step 411, the P-CSCF sends the 4xx Auth_Challenge message carrying the authentication mode indication information to the UE.

At this time, since the P-CSCF learns from the message that the authentication mode is service layer authentication and access layer binding, the P-CSCF does not need to establish a Security Association (SA) with the UE.

Step 412: After receiving the 4xx Auth_Challenge message, the UE resends the registration message Register to the P-CSCF. Unlike the first embodiment, the message does not need to carry the access operator ID and the access user ID. Instead, the private user identifier described in the prior art is carried in the authentication header field, which already exists in the existing IMS AKA process.

In step 413, the P-CSCF determines the CLF according to the source IP address of the registration message and the preset correspondence between the source IP address and the CLF.

In step 414, the P-CSCF queries the CLF determined above for the attachment information of the user at the access layer according to the private user identifier in the authentication header field of the registration message. The data record of the attachment information corresponding to the private user ID is pre-stored in the CLF, and the attachment information includes IP address information, location information, etc., but does not include the binding ID in the prior art. If there is no data record of the private user ID in CLF, CLF will return query failure.

The following steps 415 to 423 are the same as steps 315 to 323 in the first embodiment.

In step 415, the P-CSCF sends the registration message Register carrying the query result in the previous step and the source IP address of the Register received by the P-CSCF to the I-CSCF. If the previous query is successful, the attachment information obtained from the query is sent to the I-CSCF; if the query fails, the query failure information is reported to the I-CSCF.

In step 416, the I-CSCF and the HSS determine which S-CSCF to process the UE registration message through Cx-Query, that is, the I-CSCF queries the HSS which S-CSCF to process the registration message, and the HSS uses the stored S - The CSCF indication information informs the I-CSCF to process the S-CSCF of the registration message.

In step 417, the I-CSCF forwards the Register packet containing the query result and the source IP address of the Register received by the P-CSCF to the S-CSCF determined in step 416. The query result is the attachment information obtained from the query when the query succeeds, and the query failure information reported when the query fails.

Step 418, when the query result is the attachment information obtained from the query, the S-CSCF judges whether the source IP address of the Register message Register received by the P-CSCF is consistent with the IP address information in the attachment information obtained from the CLF query, If they are consistent, it means that the authentication is successful, and step 419 and its subsequent steps are executed, that is, a message of successful authentication is sent to the UE; Failed message.

When the query result is the reported query failure information, it also means that the authentication fails, and step 331 and its subsequent steps are executed, that is, a message of authentication failure is sent to the UE.

In step 419, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

Step 420, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 421, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful.

Step 422, I-CSCF sends the above 2xx Auth_OK message to P-CSCF.

Step 423, the P-CSCF sends the above 2xx Auth_OK message to the UE.

In step 431 shown in Figure 4b, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user is performed in this S-CSCF.

In step 432, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 433, the S-CSCF sends an authentication failure message to the I-CSCF, indicating that the authentication fails.

Step 434, the I-CSCF sends the authentication failure message to the P-CSCF.

Step 435, the P-CSCF sends the authentication failure message to the UE.

In the methods of the first embodiment and the second embodiment, the UE sends the registration message carrying the operator ID and the access user ID after the authentication mode is bound to the service layer authentication and the access layer authentication . In the third embodiment of the present invention, the UE initially sends a registration message carrying the operator ID and the access user ID. Like the first embodiment and the second embodiment, in the third embodiment, the user's authentication subscription data is stored in the HSS in advance, and the authentication subscription data indicates whether the user's authentication method is service layer authentication and access layer authentication. Rights binding.

Referring to Figure 5a and Figure 5b, the flow of the second embodiment is as follows:

In step 501, the UE sends a registration message Register to the P-CSCF, and the message carries an access operator identifier and an access user identifier.

In step 502, the P-CSCF determines the CLF according to the access operator ID in the registration message and the preset correspondence between the access operator ID and the CLF.

In step 503, the P-CSCF searches the CLF determined above for the attachment information of the user at the access layer according to the access user identifier in the registration message. The data record of attachment information corresponding to the private user ID is pre-stored in the CLF, and the attachment information includes IP address information, location information, etc., but does not include the binding ID in the prior art. If there is no data record of the access user ID in the CLF, the CLF will return query failure.

In step 504, the P-CSCF sends the registration message Register carrying the query result in the previous step and the source IP address of the registration message received by the P-CSCF to the I-CSCF. If the previous query is successful, the attachment information obtained from the query is sent to the I-CSCF; if the query fails, the query failure information is reported to the I-CSCF.

Step 505: The I-CSCF and the HSS select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the HSS to search the user attributes in the HSS to determine which S-CSCF will process the registration report arts.

In step 506, the I-CSCF forwards the Register message Register including the above query result and the source IP address of the register message received by the P-CSCF to the S-CSCF determined in step 505. The query result is the attachment information obtained from the query when the query succeeds, and the query failure information reported when the query fails.

In step 507, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 508, the S-CSCF sends an AV-Req message to the HSS to request the user's authentication vector.

In step 509, the HSS checks the user's authentication subscription data, and judges according to the authentication subscription data whether the user's authentication method is the binding of service layer authentication and access layer authentication, and if so, execute step 510 and its subsequent steps, Otherwise, execute steps 107 to 119 of the AKA process to perform a general authentication process.

In step 510, the HSS sends an AV-Req-Resp message to the S-CSCF. Different from the authentication vector sent in the prior art, in this step, the user's authentication mode information is sent to the S-CSCF.

Step 511, when the query result is the attachment information obtained from the query, the S-CSCF judges whether the source IP address of the Register message Register received by the P-CSCF is consistent with the IP address information in the attachment information obtained from the CLF query, If they are consistent, it means that the authentication is successful, and step 512 and its subsequent steps are executed, that is, a message of successful authentication is sent to the UE; Failed message.

When the query result is the reported query failure information, it also means that the authentication fails, and step 521 and its subsequent steps are executed, that is, a message of authentication failure is sent to the UE.

In step 512, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

Step 513, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 514, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful.

Step 515, I-CSCF sends the above 2xx Auth_OK message to P-CSCF.

Step 516, P-CSCF sends the above 2xx Auth_OK message to UE.

In step 521 shown in Figure 5b, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user is performed in this S-CSCF.

In step 522, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 523, the S-CSCF sends an authentication failure message to the I-CSCF, indicating that the authentication fails.

Step 524, the I-CSCF sends the authentication failure message to the P-CSCF.

In step 525, the P-CSCF sends the authentication failure message to the UE.

As in the second embodiment, when the access network operator and the service network operator are the same operator, since the access user ID and the private user ID are the same, the access operator ID and the private user ID will not be issued in NASS. To access the user ID to the UE, the method of the fourth embodiment shown in Figure 6a and Figure 6b can be used. The fourth embodiment is a simplified method of the third embodiment. In the fourth embodiment, the source IP of the Register The address identifies the access operator and the CLF, and queries the UE's attachment information at the access layer in the CLF according to the private user ID of the IMS service layer. Like the first embodiment, the user's authentication subscription data is stored in the HSS in advance, and the authentication subscription data indicates whether the user's authentication mode is binding of service layer authentication and access layer authentication.

Referring to Fig. 6a and Fig. 6b, the fourth embodiment comprises the following steps:

In step 601, the UE sends a registration message Register to the P-CSCF. Unlike the third embodiment, the message does not need to carry the access operator ID and the access user ID, but carries the current ID in the authentication header field. There is a private user ID as described in the technique.

In step 602, the P-CSCF determines the CLF according to the source IP address of the registration message and the preset correspondence between the source IP address and the CLF.

In step 603, the P-CSCF queries the CLF determined above for the attachment information of the user at the access layer according to the private user identifier in the authentication header field of the registration message. The data record of attachment information corresponding to the private user ID is pre-stored in the CLF, and the attachment information includes IP address information, location information, etc., but does not include the binding ID in the prior art. If there is no data record of the private user ID in CLF, CLF will return query failure.

The following steps 604 to 625 are the same as steps 504 to 525 in the third embodiment.

In step 604, the P-CSCF sends the registration message Register carrying the query result in the previous step and the source IP address of the registration message received by the P-CSCF to the I-CSCF. If the previous query is successful, the attachment information obtained from the query is sent to the I-CSCF; if the query fails, the query failure information is reported to the I-CSCF.

Step 605: The I-CSCF and the HSS select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the HSS to find the user attributes in the HSS to determine which S-CSCF will process the registration report arts.

In step 606, the I-CSCF forwards the registration message Register including the above query result and the source IP address of the registration message received by the P-CSCF to the S-CSCF determined in step 605. The query result is the attachment information obtained from the query when the query succeeds, and the query failure information reported when the query fails.

In step 607, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 608, the S-CSCF sends an AV-Req message to the HSS to request the user's authentication vector.

Step 609, the HSS checks the user's authentication subscription data, and judges according to the authentication subscription data whether the user's authentication method is the binding of service layer authentication and access layer authentication, and if so, execute step 610 and its subsequent steps, Otherwise, execute steps 107 to 119 of the AKA process to perform a general authentication process.

In step 610, the HSS sends an AV-Req-Resp message to the S-CSCF. Different from the authentication vector sent in the prior art, in this step, the user's authentication mode information is sent to the S-CSCF.

Step 611, when the query result is the attachment information obtained from the query, the S-CSCF judges whether the source IP address of the Register message Register received by the P-CSCF is consistent with the IP address information in the attachment information obtained from the CLF query, If they are consistent, it means that the authentication is successful, and step 612 and its subsequent procedures are executed, that is, a message of successful authentication is sent to the UE; Failed message.

When the query result is the reported query failure information, it also means that the authentication fails, and step 621 and its subsequent steps are executed, that is, a message of authentication failure is sent to the UE.

In step 612, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

Step 613, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 614, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful.

Step 615, I-CSCF sends the above 2xx Auth_OK message to P-CSCF.

In step 616, the P-CSCF sends the above 2xx Auth_OK message to the UE.

In step 621 shown in Figure 6b, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 622, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 623, the S-CSCF sends an authentication failure message to the I-CSCF, indicating that the authentication fails.

Step 624, the I-CSCF sends the authentication failure message to the P-CSCF.

Step 625, the P-CSCF sends the authentication failure message to the UE.

In the methods of the first embodiment to the fourth embodiment, the S-CSCF performs authentication by comparing whether the source IP address of the registration message Register received by the P-CSCF is consistent with the IP address information obtained from the CLF query, In the fifth embodiment of the present invention, the S-CSCF performs authentication by comparing the bound access user association information stored in the HSS in advance with the access user association information obtained from the CLF query, wherein the access user The associated information may be access user identity, location information, IP address information, etc. Here, the implementation process is described by taking the access user identity as an example. In the fifth embodiment, the process of determining the CLF and querying the user association information from the CLF is described by taking the source IP address of the registration message as an example. However, it can be seen from the previous embodiments that other parameters can be used to realize this process, which will not be repeated here. repeat.

Referring to Figure 7a and Figure 7b, the flow of the second embodiment is as follows:

In step 701, the UE sends a registration message Register to the P-CSCF.

In step 702, the P-CSCF determines the CLF according to the source IP address of the registration message and the preset correspondence between the IP address and the CLF.

In step 703, the P-CSCF searches the CLF determined above for the access user ID of the user according to the source IP address of the registration message. The data record of the attachment information of the UE corresponding to the source IP address is stored in the CLF in advance. The attachment information includes at least access user association information, where the access user association information is an access user identifier. If there is no data record of the source IP address in CLF, CLF will return query failure.

In step 704, the P-CSCF sends the registration message Register carrying the query result in the previous step to the I-CSCF. If the previous query is successful, the access user ID obtained from the query is sent to the I-CSCF as the query result; if the query fails, the query failure information is reported to the I-CSCF as the query result.

Step 705: The I-CSCF and the HSS select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the HSS to search the user attributes of the UE in the HSS to determine which S-CSCF will handle it The registration message.

In step 706, the I-CSCF forwards the Register message Register including the query result to the S-CSCF determined in step 705. The query result is the access user ID obtained from the query when the query is successful, and is the reported query failure information when the query fails.

In step 707, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 708, the S-CSCF sends an AV-Req message to the HSS to request the user's authentication vector.

Step 709, the HSS checks the user's authentication subscription data, judges according to the authentication subscription data whether the user's authentication method is the binding of service layer authentication and access layer authentication, and if so, executes step 710 and its subsequent steps, Otherwise, execute steps 107 to 119 of the AKA process to perform a general authentication process.

In step 710, the HSS sends an AV-Req-Resp message to the S-CSCF, which is different from the authentication vector sent in the prior art. In this step, the user's authentication method information and access user ID are sent to the S-CSCF .

Step 711, when the query result is the access user ID obtained from the query, the S-CSCF judges whether the access user ID obtained from the CLF query is consistent with the access user ID issued by the HSS, and if they are consistent, it means authentication If successful, execute step 712 and its subsequent procedures, that is, send a message of successful authentication to the UE; if not, it means that the authentication fails, and perform step 521 and its subsequent steps, that is, send a message of authentication failure to the UE.

When the query result is the reported query failure information, it also means that the authentication fails, and step 721 and subsequent steps are executed, that is, a message of authentication failure is sent to the UE.

In step 712, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user will be performed in this S-CSCF.

In step 713, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 714, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful.

Step 715, I-CSCF sends the above 2xx Auth_OK message to P-CSCF.

Step 716, P-CSCF sends the above 2xx Auth_OK message to UE.

In step 721 shown in Figure 7b, the S-CSCF and the HSS update the S-CSCF indication information on the HSS through a Cx-Put message, and inform the HSS that the subsequent processing of the user is performed in this S-CSCF.

In step 722, the S-CSCF and the HSS obtain the subscription data information of the user through the Cx-Pull message.

In step 723, the S-CSCF sends an authentication failure message to the I-CSCF, indicating that the authentication fails.

Step 724, the I-CSCF sends the authentication failure message to the P-CSCF.

Step 725, the P-CSCF sends the authentication failure message to the UE.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of the present invention. within the scope of protection.

Claims (11)

1. A method for IP multimedia subsystem authentication and access layer authentication binding, characterized in that the method comprises the following steps: A. After the proxy call session control function entity P-CSCF receives the registration message sent by the user terminal UE, according to the information in the registration message and the information in the pre-set registration message and the connection location function entity CLF The corresponding relationship determines the CLF; B. The P-CSCF queries the CLF for the attachment information of the UE in the access network to obtain a query result, and sends the registration message carrying the query result to the inquiry call session control function entity I-CSCF; C. The I-CSCF forwards the registration message to the serving call session control function entity S-CSCF notified by the home subscriber server HSS; D. The S-CSCF authenticates the UE to obtain the authentication result according to the binding authentication mode of the service layer authentication and the access layer authentication obtained from the HSS, and sends the authentication result to the UE. 2. The method according to claim 1, characterized in that, before step A, further comprising: A1. UE sends a registration message to S-CSCF; A2. The S-CSCF requests the HSS for the authentication vector of the UE; A3. The HSS judges whether the authentication mode of the UE is the binding of the service layer authentication and the access layer authentication according to the preset user authentication subscription data, and if yes, sends a message to the S-CSCF including the information in the right way; A4. The S-CSCF sends a message including the authentication mode to the UE; A5. After receiving the message including the authentication mode, the UE sends a new registration message to the P-CSCF; The registration message described in step A, step B and step C is the new registration message. 3. The method according to claim 1, characterized in that, before step D, further comprising: The S-CSCF requests the HSS for the authentication vector of the UE; According to the preset user authentication subscription data, the HSS judges whether the authentication method of the UE is the binding of the service layer authentication and the access layer authentication, and if yes, sends a message including the authentication method to the S-CSCF. news. 4. The method according to claim 2 or 3, wherein the HSS judges whether the authentication mode of the UE is binding service layer authentication and access layer authentication according to the preset user authentication subscription data. After the predetermined steps, it further includes: in the case that the authentication mode of the UE is not the binding of the service layer authentication and the access layer authentication, processing according to the key agreement AKA process. 5. The method according to claim 1, wherein the information in the registration message in step A is the access operator identifier or the source IP address of the registration message. 6. The method according to claim 1, wherein the registration message includes an access user ID; the attachment information of the UE in the access network corresponding to the access user ID is stored in the CLF in advance ; In step B, the P-CSCF queries the CLF for the attachment information of the UE in the access network to obtain the query result, including: The P-CSCF queries the CLF for the attachment information of the UE in the access network according to the access user ID; when the attachment information of the IP address information corresponding to the access user ID exists in the CLF, the CLF sends the P-CSCF an The CSCF returns a query result including the IP address information, otherwise returns a query result of query failure to the P-CSCF. 7. The method according to claim 1, wherein the registration message includes a private user ID; the attachment information of the UE in the access network corresponding to the private user ID is stored in the CLF in advance; In step B, the P-CSCF queries the CLF for the attachment information of the UE in the access network to obtain the query result, including: The P-CSCF queries the CLF for the attachment information of the UE in the access network according to the private user ID; when the attachment information of the IP address information corresponding to the private user ID exists in the CLF, the CLF returns to the P-CSCF Include the query result of the IP address information, otherwise, return the query result of query failure to the P-CSCF. 8. The method according to any one of claims 1, 6, and 7, characterized in that, Step B further includes the step of P-CSCF sending the source IP address of the received registration message to I-CSCF; Step C further includes the step of forwarding the source IP address of the registration message to the S-CSCF by the I-CSCF; The step of authenticating the UE described in step D to obtain the authentication result includes: When the query result includes IP address information, the S-CSCF compares the source IP address of the registration message received by the P-CSCF with the IP address information in the query result, and if they are consistent, the authentication is successful Otherwise, the authentication result of authentication failure is obtained; when the query result is query failure information, the S-CSCF obtains the authentication result of authentication failure. 9. The method according to claim 1, wherein the attachment information of the UE in the access network corresponding to the source IP address of the registration message is stored in the CLF in advance; In step B, the P-CSCF queries the CLF for the attachment information of the UE in the access network to obtain the query result, including: The P-CSCF queries the CLF for the attachment information of the UE in the access network according to the source IP address of the registration message; the attachment information of the access user association information corresponding to the source IP address of the registration message exists in the CLF , the CLF returns a query result including the associated information of the access user to the P-CSCF, otherwise returns a query result of query failure to the P-CSCF. 10. A method according to claim 1 or 9, characterized in that In Step D, before authenticating the UE to obtain the authentication result, the step further includes the step of the S-CSCF obtaining from the HSS the bound access user association information stored in the HSS in advance; The step of authenticating the UE described in step D to obtain the authentication result includes: When the query result includes access user association information, the S-CSCF compares the bound access user association information obtained from the HSS with the access user association information in the query result, and if they are consistent, obtain the authentication Otherwise, the authentication result of authentication failure is obtained; when the query result is query failure information, the S-CSCF obtains the authentication result of authentication failure. 11. The method according to claim 10, wherein the access user associated information is an access user ID, location information or IP address information.

Images