CN102857900B - Access method of access equipment to IMS (IP multimedia subsystem) network and AGCF (access gateway control function) and S-CSCF (serving-call session control function) - Google Patents

Abstract

The invention discloses a method for an access device to access an IMS network, an AGCF and an S‑CSCF, and simplifies the registration process. The method includes: when the access device is accessing the IMS network through the AGCF, after the AGCF completes the connection with the access device, it decides to construct a registration request carrying an indication of passing the authentication, and sends the registration request through the query call session The control function entity (I-CSCF) sends it to the serving call session control function entity (S-CSCF), and the authentication pass indication is used for the S-CSCF to decide whether to authenticate the access device. Compared with the prior art, through the above solution, there is no need to store user authentication key information on the AGCF, which simplifies the user registration process for traditional fixed network access devices to access the IMS network through the AGCF. At the same time, since there is no need to save the authentication key on the AGCF, the operation and maintenance cost is reduced.

Description

Access equipment access to IMS network method and AGCF and S-CSCF

technical field

The present invention relates to the field of mobile communication, in particular to a method for an access device to access an IMS (IP Multimedia subsystem, IP Multimedia Subsystem) network through an Access Gateway Control Function (AGCF) and the AGCF and S- CSCF.

Background technique

IP Multimedia subsystem (IMS for short) is the standard of Next Generation Network (NGN for short) defined by the 3rd Generation Partnership Project (3GPP for short). SIP (Session Initiation Protocol, Session Initiation Protocol) system, communication and access have nothing to do, can have a variety of media business control function and bearer capacity separation, call and session separation, application and service separation, business and network separation, and mobile network and Multiple capabilities such as Internet service integration.

The proposal of IMS complies with the development trend of communication network convergence. The main functional entities in the IMS system include: User Equipment (UE for short), Proxy call session control function entity (Proxy call session control function, P-CSCF for short), interrogating call session control function entity (Interrogating call session control function, short for I-CSCF), a Serving call session control function entity (Serving calls session control Function, referred to as S-CSCF), a home subscriber server (Home subscriber Server, referred to as HSS), and an application server (Application Server, referred to as AS).

The concept of Soft Switch (SS for short) was gradually developed on the basis of IP telephony in the late 1990s. It was gradually improved during the transition of the communication network from narrowband to broadband, and from circuit switching to packet switching. . Softswitch has been commercially used on a large scale in the existing network. As IMS is the target network for the convergence of fixed and mobile networks, it is an inevitable trend for softswitch to evolve to IMS. Traditional fixed network access devices, such as Access Media Gateway (AG for short) of H.248/Media Gateway Control Protocol (MGCP for short), can control functional entities (Access Gateway Control Function, referred to as AGCF) accesses the IMS network to implement IMS-related services. The network architecture is shown in Figure 1.

In the existing IMS network technology, traditional fixed network access devices, such as AG and IAD (Integrated Access Device, integrated access device), etc., access the IMS network through the AGCF, and need the AGCF to register on the IMS network instead of the user. Currently, the process of AGCF implementing user registration in the IMS system is shown in Figure 2, including the following steps:

S202. The specific fixed terminal is connected to the fixed network access device. The traditional fixed network access device, such as AG/IAD, etc., is connected to the AGCF based on the existing technology; the current protocol standards supported by the AGCF include H.248/MGCP/323 /V5, etc., taking H.248 as an example, AGCF receives a service change (ServiceChange) request;

S204, the AGCF completes the connection with the traditional fixed network access device based on the existing technology. Taking H.248 as an example, the AGCF will send a ServiceChange Reply (service change reply) response to the ServiceChange request;

S206, the AGCF constructs a registration request (register) based on the SIP protocol based on the prior art, the request message carries the public user ID and the private user ID, and forwards the registration request to the I-CSCF;

S208, the I-CSCF sends a user authentication request (User-Authorization-Request, UAR for short) message to the HSS, requesting to allocate the S-CSCF;

S210, the HSS sends a User-Authorization-Answer (UAA for short) message to the I-CSCF, and the UAA returns the assigned S-CSCF name or the capability of the S-CSCF;

S212, the I-CSCF sends the registration request message to the selected S-CSCF;

S214, for security reasons, the S-CSCF needs to perform authentication and authentication on the user, and needs to send a Multimedia-Auth-Request (MAR for short) to the HSS to obtain the user authentication vector, and the AGCF user generally uses SIPDigest authentication;

S216, the HSS sends a multimedia authentication response (Multimedia-Auth-Answer, MAA for short) to the S-CSCF, and the authentication vector is carried in the response message;

S218, the S-CSCF constructs a challenge request (401 Unauthorized message) according to the authentication vector information, and sends it to the I-CSCF;

S220, the I-CSCF forwards the 401 Unauthorized message to the AGCF;

S222. The AGCF uses the user's authentication key information stored locally to construct a challenge response registration message and send it to the I-CSCF. The authentication key is generally configured locally or through an integrated business and operation support system (Business & Operation Support System, BOSS) acquisition;

S224. After receiving the registration request message, the I-CSCF sends a UAR message to the HSS to request allocation of the S-CSCF;

S226, the HSS sends a UAA message to the I-CSCF, and the assigned S-CSCF name is returned in the UAA;

S228, the I-CSCF sends the registration request message to the selected S-CSCF;

S230, after receiving the registration request message, the S-CSCF judges the legitimacy of the user, completes the authentication of the user, and sends a user configuration data request (Server-Assignment-Request, SAR for short) to the HSS after the authentication is passed;

S232, the HSS stores the S-CSCF information, and sends the user's subscription data and charging address information to the S-CSCF through a user configuration data response (Server-Assignment-Answer, referred to as SAA) message;

S234. The S-CSCF constructs a registration success response message, such as 200 OK, and sends it to the I-CSCF;

S236. The AGCF receives the registration success response forwarded by the I-CSCF, and completes the user registration.

There is a need to improve the registration process described above.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method for an access device to access an IMS network, an AGCF and an S-CSCF, and simplify the registration process.

In order to solve the above technical problems, the present invention provides a method for an access device to access an IP Multimedia Subsystem (IMS) network, comprising:

When the access device is accessing the IMS network through the access gateway control function (AGCF), after the AGCF completes the connection with the access device, it decides to construct a registration request carrying the indication of passing the authentication, and passes the registration request through the query The call session control function entity (I-CSCF) sends it to the serving call session control function entity (S-CSCF), and the authentication pass indication is used for the S-CSCF to decide whether to authenticate the access device.

Further, the AGCF decision constructs a registration request carrying an authentication pass indication, including: AGCF stores the authentication key information of the access user of the access device locally according to the operation and maintenance policy of the operator, and/or locally, If the decision requires the registration request to carry the indication of passing the authentication, construct a registration request carrying the indication of passing the authentication.

Further, after receiving the registration request, the S-CSCF judges that if the registration request carries an indication of passing the authentication, then: decide not to perform authentication on the access device; or, according to the operation and maintenance policy of the operator , and/or the information of the network where the AGCF is located decides whether to authenticate the access device.

Further, the registration request includes an initial registration request, a refresh registration request or a logout request.

Further, the registration request is a SIP message, and the authentication pass indication is placed in a SIP header field or parameter of the registration request.

In order to solve the above-mentioned technical problems, the present invention also provides an Access Gateway Control Function (AGCF) entity, which is used to provide an access device to access an IP Multimedia Subsystem (IMS) network, and the AGCF includes a decision module, a construction module and sending module, where:

The decision-making module is configured to decide whether to construct a registration request carrying an authentication passing indication after the access device is connected to the IMS network through the AGCF;

The construction module is configured to construct a registration request carrying an authentication passing indication when the decision-making module decides to construct a registration request carrying an authentication passing indication;

The sending module is configured to send the registration request constructed by the construction module to the serving call session control function (S-CSCF) through the inquiry call session control function entity (I-CSCF), and the authentication pass indication is used for It is used for the S-CSCF to decide whether to authenticate the access device.

Further, the decision-making module is used to decide whether to construct a registration request carrying an authentication pass indication in the following manner: according to the operation and maintenance policy of the operator, and/or whether to save the authentication of the access user of the access device locally key information to make decisions.

Further, the registration request is a SIP message, and the construction module is used to construct the registration request carrying the authentication pass indication in the following manner: put the authentication pass indication in the SIP header field or parameter of the registration request middle.

In order to solve the above technical problems, the present invention also provides a Serving Call Session Control Function (S-CSCF), which is used to provide an access device to access an IP Multimedia Subsystem (IMS) network, and the S-CSCF includes a receiving module , a judgment module and a decision module, wherein:

The receiving module is configured to receive a registration request sent by an access gateway control function (AGCF);

The judging module is configured to judge whether the registration request carries an authentication pass indication;

The decision-making module is used to judge that the registration request carries an indication of passing the authentication in the judging module, and decide to perform any one of the following operations:

Not performing authentication on the access device;

According to the operation and maintenance policy of the operator and/or the information of the network where the AGCF is located, it is decided whether to authenticate the access device.

Compared with the existing technology, through the above scheme, there is no need to store user authentication key information on the AGCF, and the S-CSCF completes the user authentication by judging the authentication pass indication, which simplifies the traditional fixed network access equipment through the AGCF. User registration process for accessing the IMS network. At the same time, since there is no need to save the authentication key on the AGCF, the operation and maintenance cost is reduced, and there will be no inconsistency between the keys on the AGCF and the HSS. In addition, the fixed access of AG/IAD and AGCF in the current technology can already guarantee the security of users, and the simplified method in this paper will not affect the security of access devices.

Description of drawings

Figure 1 is a schematic diagram of the existing fixed network user access IMS network architecture;

Fig. 2 is the flow chart of known AGCF access IMS network user registration;

Fig. 3 is a flow chart of AGCF access IMS network user registration implementation scheme;

Fig. 4 is a schematic structural diagram of an AGCF and an S-CSCF according to an embodiment of the present invention.

detailed description

According to the analysis of the existing process, because the AGCF needs to save the authentication key of the IMS user to complete the user registration of the IMS network, on the one hand, the AGCF needs to save the authentication key, which increases the operation and maintenance cost, and easily leads to the encryption of the AGCF and the HSS. keys are inconsistent; on the other hand, the current AGCF user registration process is slightly complicated. Considering that traditional fixed network access devices access the IMS network through AGCF, which can ensure the security of access users, this paper provides a simplified solution for access devices to access the IMS network, including:

When the access device is accessing the IMS network through the AGCF, after the AGCF completes the connection with the access device, it decides to construct a registration request carrying the indication of passing the authentication, and sends the registration request to the S-CSCF through the I-CSCF , the authentication pass indication is used for the S-CSCF to decide whether to authenticate the access device.

Preferably, the above registration request includes an initial registration request, a refresh registration request or a logout request.

In order to be compatible with the existing technology, the AGCF can decide whether to carry the authentication pass in the registration request according to the operator's operation and maintenance policy, and/or whether to store the authentication key information of the access user of the access device locally. Instructions, for example, if the AGCF does not store the authentication key information of the access user of the access device locally, the authentication pass indication is carried in the registration request.

AGCF and S-CSCF are generally deployed in trusted networks, but for untrusted networks, in order to prevent fraudulent behavior in untrusted networks, S-CSCF can, after receiving the authentication pass indication, according to the operation and maintenance policy and/or Visit the network information (such as the network information of the AGCF), decide whether to authenticate the access device, if the decision needs to authenticate the access device, ignore the authentication pass indication information, and still perform the authentication on the access device authentication.

Preferably, the registration request is a SIP message, and the authentication indication can be placed in the SIP header field or parameter of the registration request. The SIP header field can be an existing SIP header field or an extended SIP header field. Parameters can also be existing parameters or extension parameters.

The above method can be used not only for fixed network access equipment, but also for mobile access equipment.

The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

In order to simplify the registration process of the traditional access device accessing the IMS network through the AGCF, and to solve the consistency problem of the user authentication key stored by the AGCF, the flow of this embodiment is shown in Figure 3, including the following steps:

S302, traditional fixed network access equipment, such as AG/IAD, is connected to the AGCF based on the existing technology. Taking H.248 as an example, AGCF receives a ServiceChange request;

S304. The AGCF completes the connection with the traditional fixed network access device based on the existing technology. Taking H.248 as an example, the AGCF will send a Reply response to the ServiceChange request;

S306. The AGCF constructs a registration request based on the SIP protocol. The AGCF judges the authentication key of the access user who does not have an access device locally, and decides to carry an authentication pass indication in the request message, hoping that the S-CSCF will not authenticate the user;

The AGCF constructs the registration request based on the SIP protocol based on the prior art.

In addition to judging whether to save the authentication key of the access user of the access device locally to decide whether to carry the authentication pass indication in the request message, the AGCF can also make a decision based on other operation and maintenance strategies of the operator. If the operation and maintenance strategy If all access devices are required to be authenticated, the AGCF will not carry an authentication pass indication in the request message. If the operation and maintenance policy stipulates that all access devices are not authenticated, the AGCF will carry The authentication pass indication, or the operation and maintenance policy may specify the conditions of the access device that needs to be authenticated, and the AGCF decides whether to carry the authentication pass indication in the request message according to the operation and maintenance policy.

The authentication pass indication can use existing SIP header fields or parameters, and can also be extended SIP header fields or parameters, such as setting the integrity-protected (integrity-protected) parameter in the Authentication (Authorization) header to "auth-done "."

S308, the AGCF forwards the registration request to the I-CSCF, and the request message carries an authentication pass indication;

S310, the I-CSCF sends a user authentication request UAR to the HSS, requesting to allocate the S-CSCF;

S312, the HSS sends a user authentication response message to the I-CSCF, and returns the assigned S-CSCF name or S-CSCF capability in the UAA;

S314, the I-CSCF forwards the registration request message to the selected S-CSCF, and the request message carries authentication passing indication information, such as the integrity-protected parameter information in the Authorization header needs to be transmitted to the S-CSCF;

S316. The S-CSCF parses and identifies the authentication pass indication information. If the integrity-protected parameter in the Authorization header is found to be "auth-done", it considers that the user authentication has passed, and decides not to authenticate the access device;

In other embodiments, the S-CSCF may have the ability to ignore the authentication passing indication, and decide whether to authenticate the access device according to the operation and maintenance policy and/or the network information where the AGCF is located. For example, the information about the network where the AGCF is located indicates that the AGCF is in an untrusted network, and the S-CSCF may decide to perform authentication on all registrations requested by the AGCF.

S318, the S-CSCF sends a user configuration data request to the HSS;

S320, the HSS stores the S-CSCF information, and sends the user's subscription data and billing address information to the S-CSCF through the SAA message;

S322. The S-CSCF constructs a registration success response message, such as 200 OK, and sends it to the I-CSCF;

S324. The AGCF receives the registration success response forwarded by the I-CSCF, and completes the user registration.

The AGCF for providing the access device to access the IMS network for implementing the above method, as shown in Figure 4, includes a decision-making module, a construction module and a sending module, wherein:

The decision-making module is configured to decide whether to construct a registration request carrying an authentication passing indication after the access device is connected to the IMS network through the AGCF;

The construction module is configured to construct a registration request carrying an authentication passing indication when the decision-making module decides to construct a registration request carrying an authentication passing indication;

The sending module is configured to send the registration request constructed by the construction module to the S-CSCF through the I-CSCF, and the authentication pass indication is used for the S-CSCF to decide whether to authenticate the access device .

Specifically, the decision-making module of the AGCF is used to decide whether to construct a registration request carrying an authentication passing indication in the following manner: according to the operation and maintenance policy of the operator, and/or whether to store the access user's information of the access device locally Authentication key information to make decisions.

Preferably, the registration request is a SIP message, and the construction module is configured to construct the registration request carrying the authentication pass indication in the following manner: put the authentication pass indication in the SIP header field or parameter of the registration request.

The S-CSCF for providing the access device to access the IMS network for implementing the above method, as shown in Figure 4, includes a receiving module, a judging module and a decision-making module, wherein:

The receiving module is configured to receive a registration request sent by an access gateway control function (AGCF);

The judging module is configured to judge whether the registration request carries an authentication pass indication;

The decision-making module is used to judge that the registration request carries an indication of passing the authentication in the judging module, and decide to perform any one of the following operations:

Not performing authentication on the access device;

According to the operation and maintenance policy of the operator and/or the information of the network where the AGCF is located, it is decided whether to authenticate the access device.

With the method of the embodiment of the present invention, for traditional fixed network device access, the AGCF carries the authentication pass indication information in the registration request message, and the S-CSCF identifies the authentication pass indication information, and does not need to authenticate the user again, and directly completes the user registration process. register. On the one hand, the method simplifies the AGCF user registration process; on the other hand, the AGCF does not need to save the user authentication key, which facilitates the operation and maintenance of the IMS network.

Those skilled in the art can understand that all or part of the steps in the above method can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk or an optical disk, and the like. Optionally, all or part of the steps in the foregoing embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiments may be implemented in the form of hardware, or may be implemented in the form of software function modules. The present invention is not limited to any specific combination of hardware and software.

Certainly, the present invention also can have other multiple embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these corresponding Changes and deformations should belong to the scope of protection of the appended claims of the present invention.

Claims (8)

1. a kind of method that access device accesses IP multimedia subsystem (IMS) network, including：

During IMS network is accessed by AGCF (AGCF), AGCF is completed and accessed access device After the connection of equipment, decision-making construction carries registration request of the authentication by instruction, by the registration request by query call meeting Words control function entity (I-CSCF) are sent to service call session control function entity (S-CSCF), and the authentication is by indicating For whether being authenticated to the access device for the S-CSCF decision-makings；

After the S-CSCF receives registration request, if carrying authentication in judging the registration request by indicating,：

Decision-making is not authenticated to the access device；Or

Whether the network information where the O＆M strategy and/or the AGCF according to operator, decision-making reflects to the access device Power；If decision-making needs to authenticate the access device, ignore authentication by configured information, still the access device is entered Row authentication.

2. the method for claim 1, it is characterised in that：

The AGCF decision-makings construction carries registration request of the authentication by instruction, including：

Whether AGCF is close according to the O＆M strategy of operator, and/or the authentication of the local accessing user for preserving the access device Key information, if decision-making needs to carry in the registration request authentication by instruction, construction carries registration of the authentication by instruction Request.

3. the method for claim 1, it is characterised in that：

The registration request includes initial registration request, refresh registration request or de-registration request.

4. the method for claim 1, it is characterised in that：

The registration request is sip message, and the authentication is placed in the SIP head field or parameter of the registration request by instruction In.

5. a kind of AGCF (AGCF) entity, IP multimedia subsystem (IMS) is accessed for providing access device Network, the AGCF includes decision-making module, constructing module and sending module, wherein：

The decision-making module, during accessing IMS network by the AGCF in access device, sets in completion with access After standby connection, whether decision-making constructs the registration request for carrying authentication by instruction；

The constructing module, for when the decision-making module decision-making constructs carrying and authenticates the registration request by indicating, constructing Carry registration request of the authentication by instruction；

The sending module, the registration request for the constructing module to be constructed passes through query call conversation control function entity (I-CSCF) service call session control function entity (S-CSCF) is sent to, the authentication is by indicating for supplying the S- Whether CSCF decision-makings authenticate to the access device；

The decision-making module is whether that the registration request for carrying authentication by instruction is constructed for decision-making in the following ways：

The Authentication Key information of O＆M strategy and/or the local accessing user for whether preserving the access device according to operator To carry out decision-making.

6. AGCF as claimed in claim 5, it is characterised in that：

The registration request includes initial registration request, refresh registration request or de-registration request.

7. AGCF as claimed in claim 5, it is characterised in that：

The registration request is sip message, and the constructing module is for constructing carrying authentication in the following ways by indicating Registration request：The authentication is placed in the SIP head field of the registration request or parameter by indicating.

8. a kind of service call session control function entity (S-CSCF), IP multimedia subsystem is accessed for providing access device (IMS) network, the S-CSCF includes receiver module, judge module and decision-making module, wherein：

The receiver module, the registration request for receiving AGCF (AGCF) transmission；

The judge module, for judging whether carry authentication by indicating in the registration request；

The decision-making module, for judging the registration request in judge module in carry authentication by indicate, decision-making perform Below operate in any one：

The access device is not authenticated；

Whether network information decision-making where the O＆M strategy according to operator, and/or the AGCF reflects to the access device Power, if decision-making needs to authenticate the access device, ignores authentication by configured information, and still the access device is entered Row authentication.