CN101001145B - Authentication method for supporting terminal roaming of non-IP multimedia service subsystem - Google Patents

Abstract

The invention discloses an authentication method supporting non-IMS terminal roaming in an NGN network, comprising: S-CSCF receives a registration message containing location information sent by P-CSCF/I-CSCF, and queries UPSF for an authentication method After summing up the authentication data, according to the hybrid authentication information returned from the UPSF, the UE is authenticated to obtain an authentication result, and the authentication result is sent to the UE. The authentication scheme provided by the invention is simple in configuration, good in backward compatibility, has little influence on the existing norms, and the expansion of the scheme is natural and easy to realize, thereby providing support for flexible authentication modes for users.

Description

Authentication method supporting non-IP multimedia service subsystem terminal roaming

technical field

The invention relates to the field of Internet Protocol (IP) Multimedia Service Subsystem (IMS), in particular to an authentication method for supporting IP Multimedia Service Subsystem terminal roaming in the next generation (NGN) network. the

Background technique

In a fixed next generation (NGN) network and a mobile network, the network can generally be divided into an access network and a service network. Users access the IP network through the access network of the access network operator, and then enjoy different services, such as voice, video, and streaming media, through the service network of one or more service network operators. the

If the access network and the service network do not belong to the same operator, the authentication of the user by the access network and the authentication of the user by the service network are independent of each other. In this case, if a user wants to enjoy a certain service, usually two authentications are required, one is the authentication of the access layer, after passing the authentication of the access layer, the user can access the NGN network; the other is the authentication of the access layer. For the authentication of the service layer, the user can enjoy the services provided by the service network after passing the authentication of the service layer. the

If the service network and the access network belong to the same operator, or there is a cooperative relationship between the service network operator and the access network operator, in some networking situations, the service network operator can The authentication of the access layer is bound with the authentication of the access layer, that is, after the user passes the authentication of the access layer, the user is considered to be safe, and the authentication of the service layer is no longer required. For the convenience of description later, this authentication method is called "IMS service layer authentication and access layer authentication binding" authentication method, that is, NASS-Bundled authentication method. the

At present, there are three authentication methods for telecommunications and Internet convergence services and advanced network protocols (TISPAN): HTTP DIGEST AKA, HTTP DIGEST, and NASS-Bundled. For IMS terminal users with IP Multimedia Subscriber Identity Module or Universal Subscriber Identity Module (ISIM/USIM), the authentication method is determined by the terminal capability. At this time, only HTTP DIGEST AKA authentication method can be used to improve security; for users without ISIM/USIM For non-IMS terminal users of USIM, the authentication method is determined by the configuration in the UPSF entity of the user database service entity on the network side. At this time, an authentication method in HTTP DIGEST or NASS-Bundled may be used. the

Referring to Figure 1, the flow of the NASS-Bundled authentication method is as follows:

Step 101, network attachment subsystem (NASS) access layer attach authentication, and record the location information of the user terminal (UE) on the connection location function entity (Connection Location Function, CLF). the

Step 102, the UE sends a registration message REGISTER message to the Proxy-Call Session Control Function (P-CSCF), and the message carries the access operator ID and the access user ID. the

In step 103, the P-CSCF judges whether it is necessary to establish a security association with the UE by checking whether the REGISTER message contains security negotiation parameters (such as Security-Client). If there is this parameter, it needs to be established; if there is no such parameter, it does not need to be established. In general, the case of Key Agreement (HTTP DIGEST AKA) definitely has this parameter, while the case of NASS-Bundled and Hypertext Transfer Protocol Digest (HTTP DIGEST) definitely does not. the

In step 104, the P-CSCF determines the CLF according to the access operator ID in the registration message and the preset correspondence between the access operator ID and the CLF. Then, the P-CSCF queries the location information of the user in the CLF determined above according to the source IP address of the registration message. the

Step 105, since the location information corresponding to the source IP address is stored in the CLF in advance, so in this step, the CLF returns the corresponding location information and other information to the P-CSCF. the

Step 106, P-CSCF sends the registration message REGISTER carrying the location information and other information queried in the previous step to the Interrogating-Call Session Control Function (I-CSCF). the

In step 107, the I-CSCF sends a user authorization request (UAR) message to the user database (UPSF). the

In step 108, the UPSF returns a User Authorization Answer (UAA) message. the

Step 109, the I-CSCF selects the corresponding Service-Call Session Control Function (Service-Call Session Control Function, S-CSCF) according to the message returned from the UPSF, that is, selects which S-CSCF to process the registration message. the

Step 110, the I-CSCF forwards the registration message REGISTER including the above location information to the S-CSCF determined above. the

In step 111, the S-CSCF judges which authentication method it is based on whether the REGISTER message contains the Integrity-Protected parameter. If there is this parameter, it must be the HTTP DIGEST AKA method. The authentication request sent by S-CSCF to UPSF is only to request authentication parameters; The request to UPSF is to request authentication mode and corresponding authentication parameters. Since the NASS-Bundled authentication method is adopted here, the Integrity-Protected parameter is not included in the REGISTER message. The S-CSCF sends a Multimedia Authentication Request (MAR) message to the UPSF, requesting the user's authentication vector and corresponding authentication parameters. the

In step 112, the UPSF checks the authentication subscription data of the user, and finds that the authentication method of the user is NASS-Bundled authentication method. the

In step 113, the UPSF sends a Multimedia Authentication Response (MAA) message to the S-CSCF, and returns the user's authentication method and authentication parameters, that is, location information. the

In step 114, the S-CSCF compares the location information sent from the P-CSCF with the location information obtained from the UPSF query. If they are consistent, it means that the authentication is successful. Step 115 and its subsequent procedures are executed, that is, sending a successful authentication message to the UE. message; if inconsistent, it means that the authentication fails, and step 115 and its subsequent steps are executed, that is, a message of authentication failure is sent to the UE. the

In step 115, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful. the

Step 116, I-CSCF sends the above 2xx Auth_OK message to P-CSCF. the

Step 117, P-CSCF sends the above 2xx Auth_OK message to UE. the

If the authentication fails, a message indicating the authentication failure is sent in step 115 to step 117 . the

Referring to Figure 2, the process of the HTTP DIGEST authentication mechanism is roughly as follows:

Step 201, UE sends a registration message REGISTER to P-CSCF. the

In step 202, the P-CSCF judges whether it needs to establish a security association with the UE by checking whether the REGISTER message contains security negotiation parameters (such as Security-Client). If there is this parameter, it needs to be established; if there is no such parameter, it does not need to be established. In general, the case of Key Agreement (HTTP DIGEST AKA) definitely has this parameter, while the case of NASS-Bundled and Hypertext Transfer Protocol Digest (HTTP DIGEST) definitely does not. the

In step 203, the P-CSCF forwards the REGISTER message of the UE to the I-CSCF. The message also carries the location information of the UE obtained by the P-CSCF from the CLF. the

Step 204, the I-CSCF and the UPSF select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the UPSF to search the user attributes in the UPSF to determine which S-CSCF handles the registration report arts. the

In step 205, the I-CSCF forwards the UE's REGISTER message to the S-CSCF determined in step 204. the

In step 206, the S-CSCF judges which authentication method it is based on whether the REGISTER message contains the Integrity-Protected parameter. If there is this parameter, it must be the HTTP DIGEST AKA method. The authentication request sent by S-CSCF to UPSF is only to request authentication parameters; The request to UPSF is to request authentication mode and corresponding authentication parameters. Since the HTTP DIGEST authentication method is used here, the Integrity-Protected parameter is not included in the REGISTER message. The S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through the Cx-Put message, and inform the UPSF that the subsequent processing of the user will be performed in this S-CSCF. the

In step 207, the S-CSCF sends a MAR message to the UPSF, requesting the user's authentication method and authentication data. the

Step 208, UPSF checks the user's authentication subscription data, obtains the authentication method of the user according to the authentication subscription data is the HTTP DIGEST authentication method, and generates authentication vectors such as nonce and expected results (XRES) and the like. the

In step 209, the UPSF sends a MAR message to the S-CSCF, and sends the user's authentication method information HTTP DIGEST, authentication parameter nonce, expected result (XRES), etc. to the S-CSCF. the

Step 210, the S-CSCF calculates the expected result XRES. the

In step 211, the S-CSCF obtains the authentication method information and saves the XRES, and then sends a "4xx Auth_Challenge" message to the I-CSCF. The Algorithm parameter in the WWW-Authenticate header of the message indicates that the HTTP DIGEST authentication method is adopted. the

In step 212, the I-CSCF sends a "4xx Auth_Challenge" message to the P-CSCF, and the Algorithm parameter in the WWW-Authenticate header of the message indicates that the HTTP DIGEST authentication method is adopted. the

In step 213, the P-CSCF sends a "4xx Auth_Challenge" message to the UE. the

Step 214: After receiving the "4xx Auth_Challenge" message, the UE finds that the Algorithm parameter indicates the HTTP DIGEST authentication method, and re-sends the registration message REGISTER to the P-CSCF, and carries a response (RES) for authentication. the

Step 215, P-CSCF sends the registration message REGISTER carrying RES to I-CSCF. the

Step 216, the I-CSCF and the UPSF determine which S-CSCF to process the UE registration message through Cx-Query, that is, the I-CSCF inquires from the UPSF which S-CSCF the registration message is to process, and the UPSF uses the saved S-CSCF to process the registration message. - The CSCF indication information informs the I-CSCF to process the S-CSCF of the registration message. In the following steps, the S-CSCF sends the authentication success or authentication failure message to the UE. the

In step 217, the I-CSCF forwards the registration message REGISTER to the S-CSCF determined in step 216. the

In step 218, the S-CSCF compares the XRES obtained from the UPSF with the RES sent from the UE. If the two are consistent, it means that the authentication is successful, and when the two are inconsistent, it means that the authentication fails. the

In step 219, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the subsequent processing of the user will be performed in this S-CSCF. the

In step 220, the S-CSCF and the UPSF obtain the subscription data information of the user through the Cx-Pull message. the

In step 221, the S-CSCF sends a 200 message indicating that the authentication is successful, or a 403 Forbidden message indicating that the authentication fails to the I-CSCF. In the figure, it is only represented by a 200 message when the authentication is successful. the

Step 222, the I-CSCF sends the above message to the P-CSCF. the

Step 223, the P-CSCF sends the above message to the UE. the

Therefore, for any user, only one of the authentication methods can be used in a current registration process. However, there may be such an application scenario: for a non-IMS terminal using NASS-Bundled authentication, the user may wish to access the network through the same terminal when nomadic in other places, using a fixed terminal just like using a mobile phone. However, since the user's location information changes when nomadic, if the NASS-Bundled authentication method is still used, the user authentication will inevitably fail, which will affect the user's use of the network. If you can consider using the HTTP DIGEST authentication method to authenticate users at this time, you can provide users with flexible authentication support and network services. the

In the patent application with the application number 200510109162.X, our company proposed the technical solution of pre-configuring the user authentication method in UPSF as "NASS-Bundled by default, and HTTP DIGEST AKA or HTTP DIGEST if it fails". . In this scheme, after the S-CSCF finds out that the user uses the above authentication methods, the NASS-Bundled authentication method is used first, and if it fails, the HTTP DIGEST AKA or HTTP DIGEST authentication method is used to authenticate the user. the

The following uses the HTTP DIGEST authentication method for authentication after NASS-Bundled authentication fails as an example. FIG. 3 is a schematic flowchart of the method, wherein for sub-step B in step 311, please refer to the steps after 209 in FIG. 2 . The method includes the following steps:

In step 301, the UE sends a registration message REGISTER to the P-CSCF, and the message carries an access operator ID and an access user ID. the

In step 302, the P-CSCF determines the CLF according to the access operator ID in the registration message and the preset correspondence between the access operator ID and the CLF. the

In step 303, the P-CSCF searches the CLF determined above for the attachment information of the user at the access layer according to the access user identifier in the registration message. The data record of attachment information corresponding to the private user identifier is pre-stored in the CLF, and the attachment information includes IP address information, location information, and the like. the

In step 304, the P-CSCF sends the registration message REGISTER carrying the access layer attachment information queried in the previous step and the source IP address of the registration message received by the P-CSCF to the I-CSCF. the

Step 305: The I-CSCF and the UPSF select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the UPSF to search the user attributes in the UPSF to determine which S-CSCF will handle the registration report arts. the

Step 306 , the I-CSCF forwards the registration message REGISTER including the above query result and the source IP address of the registration message received by the P-CSCF to the S-CSCF determined in step 305 . the

In step 307, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the subsequent processing of the user will be performed in this S-CSCF. the

In step 308, the S-CSCF sends a MAR message to the UPSF to request the user's authentication vector. the

Step 309, UPSF checks the user's authentication subscription data, and obtains the user's authentication method according to the authentication subscription data. The default is the binding of IMS service layer authentication and access layer authentication, and then adopts HTTP DIGEST authentication method after failure Or HTTP DIGEST AKA authentication method. Here, the HTTP DIGEST authentication method is used as an example after failure. the

Step 310, UPSF sends MAA message to S-CSCF, and sends the user's authentication mode information to S-CSCF, namely: IMS service layer authentication and access layer authentication binding authentication mode and authentication parameter location information (default); HTTP DIGEST authentication method and authentication parameters XRES or HTTPDIGEST AKA authentication method and authentication parameters. the

In step 311, the S-CSCF saves all authentication modes and corresponding authentication vectors. The S-CSCF judges whether the source IP address of the REGISTER is consistent with the IP address information in the attachment information obtained from the CLF query, or compares whether the access layer user ID obtained from the CLF query is the same as the access layer user ID issued by the UPSF Consistent, if they are consistent, then the authentication is successful, and step 312 and its subsequent processes are executed, that is, a message of successful authentication is sent to the UE; Use the HTTP DIGEST authentication method or the HTTP DIGEST AKA authentication method for authentication. Here, the HTTP DIGEST authentication method is used as an example. the

In step 312, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the subsequent processing of the user will be performed in this S-CSCF. the

In step 313, the S-CSCF and the UPSF obtain the subscription data information of the user through the Cx-Pull message. the

In step 314, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful. the

Step 315, I-CSCF sends the above 2xx Auth_OK message to P-CSCF. the

Step 316, the P-CSCF sends the above 2xx Auth_OK message to the UE. the

Although the above existing technologies provide a variety of mixed authentication methods, UPSF needs to configure the mixed authentication methods of NASS-Bundled/HTTP DIGEST AKA or the mixed authentication methods of NASS-Bundled/HTTP DIGEST The configuration is relatively complicated, and has a great impact on the latest TISPAN specification. In addition, according to the latest regulations of TISPAN, the two authentication methods of NASS-Bundled/HTTP DIGEST can only be used when the user terminal does not have ISIM/USIM. If the user terminal has ISIM/USIM, only HTTP DIGEST AKA authentication can be used to improve security. In this case, the above-mentioned "default NAS S-Bundled, fail to transfer to HTTP DIGEST AKA or HTTP DIGEST" authentication method has a problem. If NASS-Bundled fails, it can only transfer to HTTP DIGEST authentication, but not to HTTP DIGEST AKA. the

Contents of the invention

In view of this, the purpose of the present invention is to propose a hybrid authentication method with better compatibility with existing specifications. the

According to the above purpose, the present invention provides an authentication method supporting non-IMS terminal roaming in the next generation network, which is characterized in that the method includes the following steps: S-CSCF receives the location information forwarded by P-CSCF through I-CSCF registration message, and query the authentication mode and authentication data from the UPSF, perform authentication processing on the UE to obtain the authentication result according to the mixed authentication information returned from the UPSF, and send the authentication result to the UE;

The mixed authentication information is: the authentication method is the second authentication method, the authentication parameter is the authentication parameter of the second authentication method and the authentication method of the IMS service layer authentication and the access layer authentication binding authentication method The location information of the authorization parameter; or the authentication mode is the binding authentication mode of the IMS service layer authentication and the access layer authentication, and the authentication parameter is the authentication of the binding authentication mode of the IMS service layer authentication and the access layer authentication The data is location information and authentication parameters of the second authentication mode; or the authentication mode is IMS service layer authentication and access layer authentication binding authentication mode, and the authentication parameters are IMS service layer authentication and access layer authentication Authentication binding authentication method authentication parameter position information and IMS service layer authentication and access layer authentication binding authentication method priority, and the authentication method is the second authentication method, and the authentication parameter is the second Authentication method authentication parameters and the priority of the second authentication method;

The second authentication method is the Hypertext Transfer Protocol Digest HTTP DIGEST authentication method. the

In the above technical solution, the mixed authentication information is: the authentication method is the second authentication method, the authentication parameter is the authentication parameter of the second authentication method and the binding of IMS service layer authentication and access layer authentication The authentication parameter position information of the authentication method; the step of performing authentication processing on the UE to obtain the authentication result and sending the authentication result to the UE includes: S-CSCF judges whether the received authentication parameter includes Valid location information, if it is, first use the IMS service layer authentication and access layer authentication binding authentication method to authenticate the UE to obtain the authentication result, and send the authentication result when the authentication result is successful For the UE, if the authentication result is a failure, then use the second authentication method to authenticate the UE to obtain the authentication result and send the authentication result to the UE; otherwise, directly use the second authentication method to authenticate the UE to obtain the The authentication result is sent to the UE. the

In the above technical solution, the mixed authentication information is: the authentication mode is the binding authentication mode of IMS service layer authentication and access layer authentication, and the authentication parameter is IMS service layer authentication and access layer authentication Binding the location information authentication parameters of the authentication mode and the authentication parameters of the second authentication mode; the step of performing authentication processing on the UE to obtain an authentication result and sending the authentication result to the UE includes: S- The CSCF first uses the IMS service layer authentication and access layer authentication binding authentication method to authenticate the UE to obtain the authentication result. If the authentication result is successful, the authentication result is sent to the UE. If the authentication result is When it fails, use the second authentication method to authenticate the UE to obtain the authentication result and send the authentication result to the UE. the

In the above technical solution, the hybrid authentication information is: IMS service layer authentication with priority and access layer authentication binding authentication mode and location information and the second authentication mode with priority and its authentication parameters. The step of performing authentication processing on the UE to obtain the authentication result and sending the authentication result to the UE includes: the S-CSCF receives the hybrid authentication information sent by the UPSF; when the IMS service layer authentication and access When the priority of layer authentication binding authentication mode is high, S-CSCF first uses IMS service layer authentication and access layer authentication binding authentication mode to authenticate UE to obtain the authentication result. If the authentication result is successful, send the authentication result to the UE, and then use the second authentication method to authenticate the UE to obtain the authentication result and send the authentication result to the UE when the authentication result is a failure; when the second authentication When the mode priority is higher, the second authentication mode is directly used to authenticate the UE to obtain an authentication result, and the authentication result is sent to the UE. the

In the above technical solution, the step of authenticating the UE by using the IMS service layer authentication and access layer authentication binding authentication method to obtain the authentication result includes: S-CSCF compares the location information reported by P-CSCF with the UPSF When the delivered location information is consistent, the result of authentication is successful; when the two are inconsistent, the result of authentication failure is obtained. the

In the above technical solution, the step of using the HTTP DIGEST authentication method to authenticate the UE to obtain the authentication result and send the authentication result to the UE includes: C1. The S-CSCF sends the HTTP DIGEST authentication message to the UE. C2. UE sends a registration message containing authentication parameters to S-CSCF after receiving the challenge message including HTTP DIGEST authentication mode; C3. S-CSCF compares the authentication parameters obtained from UPSF When the two are consistent with the authentication parameters obtained from the UE, the result of successful authentication is obtained, and a message indicating successful authentication is sent to the UE; when the two are inconsistent, the result of authentication failure is obtained, and a message indicating successful authentication is sent to the UE Authentication failed message. the

In the above technical solution, before the S-CSCF receives the registration message containing the location information forwarded by the P-CSCF through the I-CSCF, it further includes: the P-CSCF determines according to the access operator identifier in the registration message that it is related to the registration message. The connection location function entity CLF corresponding to the access operator identifier; the P-CSCF queries the CLF according to the source IP address of the registration message to obtain the location information corresponding to the source IP address. the

Through the technical solution of the present invention, on the one hand, it can be ensured that when the user accesses the network at a fixed location, the original NASS-Bundled mode or the HTTP DIGEST mode is adopted by default to authenticate the user. On the other hand, it can solve the problem that if the NASS-Bundled authentication fails when the user accesses the network in a nomadic scenario, the HTTP DIGEST method will be used to continue to authenticate the user. These schemes are simple to configure, have good backward compatibility, have little impact on existing specifications, and the expansion of the scheme is natural and easy to implement, thus providing support for flexible authentication methods for users. the

Description of drawings

Figure 1 is a schematic flow diagram of the NASS-Bundled authentication method;

Figure 2 is a schematic flow diagram of the HTTP DIGEST authentication method;

Fig. 3 is the schematic flow chart of prior art;

Fig. 4 is the schematic flow sheet of the first embodiment of the present invention;

Fig. 5 is the schematic flow sheet of the second embodiment of the present invention;

FIG. 6 is a schematic flowchart of a third embodiment of the present invention. the

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the following examples are given to further describe the present invention in detail. the

In the first embodiment as shown in FIG. 4 , the authentication mode of adding the authentication parameter of NASS-Bundled to the authentication parameter of HTTP DIGEST is adopted. That is, the authentication method is HTTP DIGEST, and the authentication parameter is the HTTP DIGEST authentication parameter and the location information of the NASS-Bundled authentication parameter. the

With reference to Fig. 4, the first embodiment of the present invention comprises the following steps:

Step 1101, NASS access layer attach authentication, record UE location information on CLF. the

Step 1102, the UE sends a registration message REGISTER to the P-CSCF, and the message carries an access operator ID and an access user ID. the

In step 1103, the P-CSCF finds that there is no security negotiation parameter (such as Security-Client) in the REGISTER message through inspection, so there is no need to establish a security association with the UE. the

In step 1104, the P-CSCF determines the CLF according to the access operator ID in the registration message and the preset correspondence between the access operator ID and the CLF. Then, the P-CSCF queries the location information of the user in the CLF determined above according to the source IP address of the registration message. The data record of the location information corresponding to the source IP address of the registration message is stored in the CLF in advance. the

Step 1105, the P-CSCF sends the registration message REGISTER carrying the location information obtained in the previous step to the I-CSCF. the

Step 1106, the I-CSCF and the UPSF select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the UPSF, and searches the user attributes in the UPSF to determine which S-CSCF handles the registration report arts. the

In step 1107, the I-CSCF forwards the registration message REGISTER including the above location information to the S-CSCF determined in step 1105. the

In step 1108, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the subsequent processing of the user will be performed in this S-CSCF. the

In step 1109, the S-CSCF finds that the REGISTER message does not contain the Integrity-Protected parameter, so it needs to send a MAR message to the UPSF to query the user's authentication method and corresponding authentication parameters. the

Step 1110, UPSF checks the user's authentication subscription data, and finds that the user's authentication method is the HTTP DIGEST authentication method. the

Step 1111, UPSF sends MAA message to S-CSCF, and sends the user's authentication method information to S-CSCF, that is: the authentication method is HTTP DIGEST authentication method, and the authentication parameters are the original parameters of HTTP DIGEST and NASS- Bundled authentication parameter location information. the

Step 1112, the S-CSCF saves the authentication method and the corresponding authentication parameters, and checks whether the authentication parameters contain valid location information, if yes, executes step 1113, otherwise executes the steps after step 209 in Figure 2, namely Directly perform HTTP DIGEST authentication mode for authentication. the

In step 1113, the S-CSCF compares whether the location information reported by the P-CSCF is consistent with the location information sent by the UPSF. If they are consistent, it means that the authentication is successful, and the step 1114 and its subsequent procedures are executed, that is, the authentication success is sent to the UE. If inconsistent, then the authentication fails, and the steps after step 209 in Figure 2 are executed, that is, the HTTP DIGEST authentication method is used for authentication. the

Step 1114: The S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the follow-up processing of the user will be performed in this S-CSCF. the

Step 1115, the S-CSCF and the UPSF obtain the subscription data information of the user through the Cx-Pull message. the

In step 1116, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful. the

Step 1117, I-CSCF sends the above 2xx Auth_OK message to P-CSCF. the

Step 1118: After receiving the above 2xx Auth_OK message, the P-CSCF sends the above 2xxAuth_OK message to the UE. the

In the second embodiment as shown in FIG. 5 , an authentication mode in which an authentication parameter of HTTP DIGEST is added to NASS-Bundled authentication parameters is adopted. That is, the authentication method is NASS-Bundled, and the authentication parameters are NASS-Bundled authentication data, namely location information, and HTTP DIGEST authentication parameters. the

With reference to Fig. 5, the second embodiment of the present invention comprises the following steps:

Step 1201, NASS access layer attach authentication, record UE location information on CLF. the

Step 1202, the UE sends a registration message REGISTER to the P-CSCF, and the message carries an access operator ID and an access user ID. the

In step 1203, the P-CSCF finds that there is no security negotiation parameter (such as Security-Client) in the REGISTER message through inspection, so there is no need to establish a security association with the UE. the

In step 1204, the P-CSCF determines the CLF according to the access operator ID in the registration message and the preset correspondence between the access operator ID and the CLF. Then, the P-CSCF queries the location information of the user in the CLF determined above according to the source IP address of the registration message. The data record of the location information corresponding to the source IP address of the registration message is stored in the CLF in advance. the

Step 1205, the P-CSCF sends the registration message REGISTER carrying the location information obtained in the previous step to the I-CSCF. the

Step 1206, the I-CSCF and the UPSF select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the UPSF, and searches the user attributes in the UPSF to determine which S-CSCF handles the registration report arts. the

In step 1207, the I-CSCF forwards the registration message REGISTER including the above location information to the S-CSCF determined in step 1205. the

In step 1208, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the subsequent processing of the user will be performed in this S-CSCF. the

In step 1209, the S-CSCF finds that the REGISTER message does not contain the Integrity-Protected parameter, so it needs to send a MAR message to the UPSF to query the user's authentication mode and corresponding authentication parameters. the

In step 1210, the UPSF checks the user's authentication subscription data, and finds that the user's authentication mode is "NASS-Bundled". the

Step 1211, UPSF sends a MAA message to S-CSCF, and sends the user's authentication method information to S-CSCF, that is, the authentication method is NASS-Bundled authentication method, and the authentication parameter is NASS-Bundled authentication parameter, which is the location information and HTTP DIGEST authentication parameters. the

Step 1212, the S-CSCF saves the authentication method and the corresponding authentication parameters, and compares whether the location information reported by the P-CSCF is consistent with the location information sent by the UPSF. If they are consistent, the authentication is successful, and step 1213 is executed. And its subsequent process, that is, send a message of successful authentication to the UE; if inconsistent, it means that the authentication fails, and the steps after step 209 in Figure 2 are executed, that is, the HTTP DIGEST authentication method is used for authentication. the

In step 1213, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the follow-up processing of the user will be performed in this S-CSCF. the

Step 1214, the S-CSCF and the UPSF obtain the subscription data information of the user through the Cx-Pull message. the

In step 1215, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful. the

Step 1216, I-CSCF sends the above 2xx Auth_OK message to P-CSCF. the

Step 1217: After receiving the above 2xx Auth_OK message, the P-CSCF sends the above 2xxAuth_OK message to the UE. the

In the third embodiment shown in FIG. 6 , two authentication methods exist simultaneously, and the authentication parameters are not mixed, but a priority parameter is added. That is, the authentication method is NASS-Bundled, and the authentication parameter is the location information of the NASS-Bundled authentication parameter, and the priority of the NASS-Bundled; and the authentication method is HTTP DIGEST, and the authentication parameter is the HTTP DIGEST authentication parameter , and the priority of HTTP DIGEST. Of course, you can also replace the HTTP DIGEST authentication method with other authentication methods, or set multiple authentication methods in advance, so I won’t go into details here. the

With reference to Fig. 6, the third embodiment of the present invention comprises the following steps:

Step 1301, NASS access layer attach authentication, record UE location information on CLF. the

Step 1302, the UE sends a registration message REGISTER to the P-CSCF, and the message carries an access operator ID and an access user ID. the

In step 1303, the P-CSCF finds that there is no security negotiation parameter (such as Security-Client) in the REGISTER message through inspection, so there is no need to establish a security association with the UE. the

In step 1304, the P-CSCF determines the CLF according to the access operator ID in the registration message and the preset correspondence between the access operator ID and the CLF. Then, the P-CSCF queries the location information of the user in the CLF determined above according to the source IP address of the registration message. The data record of the location information corresponding to the source IP address of the registration message is pre-saved in the CLF. the

Step 1305, the P-CSCF sends the registration message REGISTER carrying the location information obtained in the previous step to the I-CSCF. the

Step 1306, the I-CSCF and the UPSF select the corresponding S-CSCF through the Cx-Selection-Info message, that is, the I-CSCF sends a request to the UPSF, and searches the user attributes in the UPSF to determine which S-CSCF handles the registration report arts. the

In step 1307, the I-CSCF forwards the registration message REGISTER including the above location information to the S-CSCF determined in step 1305. the

In step 1308, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through a Cx-Put message, and inform the UPSF that the subsequent processing of the user will be performed in this S-CSCF. the

In step 1309, the S-CSCF finds that the REGISTER message does not contain the Integrity-Protected parameter, so it needs to send a MAR message to the UPSF to inquire about the user's authentication method and corresponding authentication parameters. the

Step 1310, UPSF checks the user's authentication subscription data, and finds that the user has multiple authentication methods, and each authentication method has a priority. For example, there are two authentication methods for this user: one is the NASS-Bundled authentication method, which has a higher priority, such as 0.7; the other is the HTTPDIGEST authentication method, which has a lower priority, such as 0.3 . the

Step 1311, UPSF sends MAA message to S-CSCF, and sends the user's authentication method information to S-CSCF, including authentication method, authentication parameters and priority, namely: authentication method 1: NASS-Bundled, authentication Authorization parameter: location information, priority: 0.7; authentication method 2: HTTPDIGEST, authentication parameter: HTTP DIGEST authentication parameter, priority: 0.3. the

Step 1312, the S-CSCF stores the authentication mode and corresponding authentication parameters. It is found that there are two authentication methods, and NASS-Bundled has a higher priority, so NASS-Bundled authentication is performed first, that is, the location information reported by the P-CSCF is compared with the location information delivered by the UPSF. If they are consistent, then the authentication is successful, and step 1313 and its subsequent processes are executed, that is, a message of successful authentication is sent to the UE; if not, then the authentication fails, and the steps after step 209 in Fig. DIGEST authentication mode for authentication. the

If the priority of the HTTP DIGEST authentication method is high, then directly execute the steps after step 209 in Figure 2, that is, directly adopt the HTTP DIGEST authentication method for authentication. the

Situations of other multiple authentication methods are similar, and no examples are given here. the

Step 1313, the S-CSCF and the UPSF update the S-CSCF indication information on the UPSF through the Cx-Put message, and inform the UPSF that the follow-up processing of the user will be performed in this S-CSCF. the

Step 1314, the S-CSCF and the UPSF obtain the subscription data information of the user through the Cx-Pull message. the

Step 1315, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF, indicating that the authentication is successful. the

Step 1316, I-CSCF sends the above 2xx Auth_OK message to P-CSCF. the

Step 1317: After receiving the 2xx Auth_OK message, the P-CSCF sends the 2xxAuth_OK message to the UE. the

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of the present invention. within the scope of protection. the

Claims (7)

1. support the authentication method of non-IP multi-medium subsystem, IMS terminal roaming in the next generation network, it is characterized in that this method may further comprise the steps:

Service call session control function entity S-CSCF receives the logon message that comprises positional information that proxy call conversation control function entity P-CSCF transmits by enquiry call conversation control function entity I-CSCF, and behind customer data base service entities UPSF inquiry authentication mode and authorization data, according to the mixing authentication information that returns from UPSF, user terminal UE is carried out authentication process obtain authenticating result, and described authenticating result is sent to UE;

Described mixing authentication information is: authentication mode is second authentication mode, and authentication parameter is the authentication parameter positional information of authentication parameter and the IMS operation layer authentication and the acess-in layer authentication binding authentication mode of second authentication mode; Perhaps authentication mode is IMS operation layer authentication and acess-in layer authentication binding authentication mode, and authentication parameter is that the authorization data of IMS operation layer authentication and acess-in layer authentication binding authentication mode is the authentication parameter of the position information and second authentication mode; Or authentication mode is that IMS operation layer authentication and acess-in layer authentication binding authentication mode, authentication parameter are the priority of IMS operation layer authentication and acess-in layer authentication binding authentication mode authentication parameter positional information and IMS operation layer authentication and acess-in layer authentication binding authentication mode, and authentication mode is second authentication mode, and authentication parameter is the priority of the second authentication mode authentication parameter and second authentication mode;

Described second authentication mode is a HTML (Hypertext Markup Language) summary HTTP DIGEST authentication mode.

2. method according to claim 1, it is characterized in that, described mixing authentication information is: authentication mode is second authentication mode, and authentication parameter is the authentication parameter positional information of authentication parameter and the IMS operation layer authentication and the acess-in layer authentication binding authentication mode of second authentication mode;

Describedly UE is carried out authentication process obtain authenticating result and the step that described authenticating result sends to UE is comprised: S-CSCF judges in the authentication parameter of receiving whether comprise effective positional information, if, then adopt IMS operation layer authentication and acess-in layer authentication binding authentication mode that UE is carried out authentication earlier and obtain authenticating result, in authenticating result is this authenticating result to be sent to UE successfully the time, adopts second authentication mode that UE is carried out authentication in authenticating result again during for failure and obtains authenticating result and this authenticating result is sent to UE; Otherwise directly adopt second authentication mode that UE is carried out authentication and obtain authenticating result, and this authenticating result is sent to UE.

3. method according to claim 1, it is characterized in that, described mixing authentication information is: authentication mode is IMS operation layer authentication and acess-in layer authentication binding authentication mode, and authentication parameter is IMS operation layer authentication and the positional information authentication parameter of acess-in layer authentication binding authentication mode and the authentication parameter of second authentication mode;

Describedly UE is carried out authentication process obtain authenticating result and the step that described authenticating result sends to UE is comprised: S-CSCF adopts IMS operation layer authentication and acess-in layer authentication binding authentication mode that UE is carried out authentication earlier and obtains authenticating result, in authenticating result is this authenticating result to be sent to UE successfully the time, adopts second authentication mode that UE is carried out authentication in authenticating result again during for failure and obtains authenticating result and this authenticating result is sent to UE.

4. method according to claim 1 is characterized in that, described mixing authentication information is: the IMS operation layer authentication and acess-in layer authentication binding authentication mode and the positional information and second authentication mode and the authentication parameter thereof that have priority that have priority;

Describedly UE is carried out authentication process obtain authenticating result and the step that described authenticating result sends to UE is comprised: S-CSCF receives this mixing authentication information that UPSF sends; When the priority of IMS operation layer authentication and acess-in layer authentication binding authentication mode is higher, S-CSCF adopts IMS operation layer authentication and acess-in layer authentication binding authentication mode that UE is carried out authentication earlier and obtains authenticating result, in authenticating result is this authenticating result to be sent to UE successfully the time, adopts second authentication mode that UE is carried out authentication in authenticating result again during for failure and obtains authenticating result and this authenticating result is sent to UE; When the second authentication mode priority is higher, directly adopts second authentication mode that UE is carried out authentication and obtain authenticating result, and this authenticating result is sent to UE.

5. according to the described method of one of claim 2～4, it is characterized in that described employing IMS operation layer authentication and acess-in layer authentication binding authentication mode carry out the step that authentication obtains authenticating result to UE and comprise:

The positional information that positional information that S-CSCF comparison P-CSCF reports and UPSF issue when both are consistent, obtains the result of authentication success; When both are inconsistent, obtain the result of failed authentication.

6. according to claim 2,3 or 4 described methods, it is characterized in that described employing HTTPDIGEST authentication mode carries out authentication to UE and obtains authenticating result and the step that this authenticating result sends to UE is comprised:

C1.S-CSCF sends the challenge message that comprises described HTTP DIGEST authentication mode to UE;

After C2.UE receives the challenge message of the described HTTP of comprising DIGEST authentication mode, send the logon message that comprises authentication parameter to S-CSCF;

C3.S-CSCF when both are consistent, obtains the result of authentication success relatively from the authentication parameter of UPSF acquisition and the authentication parameter that obtains from UE, sends the message of expression authentication success to UE; When both are inconsistent, obtain the result of failed authentication, send the message of expression failed authentication to UE.

7. method according to claim 1 is characterized in that, further comprises before described S-CSCF receives the logon message that comprises positional information of P-CSCF by the I-CSCF forwarding:

P-CSCF determines and the corresponding link position functional entity CLF of this access carrier sign according to the sign of the access carrier in the logon message;

P-CSCF obtains and this source IP address corresponding position information to the CLF inquiry according to the source IP address of logon message.

Images