Security management method and system for WAPI terminal accessing IMS network

• US 8,595,485 B2
• Filed: 07/16/2009
• Issued: 11/26/2013
• Est. Priority Date: 01/16/2009
• Status: Active Grant

• Current Assignee: ZTE Corporation
• Original Assignee: ZTE Corporation
• Inventors: Liang, Jiehui, Shi, Yuanqing, Liu, Jiabing
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US13/143,485
• Publication Number:
  US 20110276798A1
• Time in Patent Office: 1,594 Days
• Field of Search: 713/156
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: Y02D 30/70 in wireless communication networks

Abstract

The present invention discloses a security management method and a security management system for a WAPI terminal accessing an IMS network. The method comprises: an authentication service unit (ASU) sending, under the circumstance that an access point and the WAPI terminal pass the verification of the ASU, a security information request message to a home subscriber server (HSS) (S302); the HSS setting security information corresponding to the IMS account information of the WAPI terminal as access layer security after receiving the security information request message from the ASU (S304); a proxy-call session control function (P-CSCF) receiving an IMS login request message from the WAPI terminal, inquiring about the security information of the WAPI terminal through the HSS, and allowing the WAPI terminal to execute an IMS service flow under the circumstance that the security information of the WAPI terminal is the access layer security (S306).

Claims

1. A security management method for a WAPI terminal accessing an IP multimedia subsystem (IMS) network, the method comprising:

sending, by an authentication service unit (ASU), responsive to an access point and the WAPI terminal passing the verification of the ASU, a security information request message to a home subscriber server (HSS), wherein the security information request message carries IMS account information of the WAPI terminal;

setting, by the HSS, security information corresponding to the IMS account information of the WAPI terminal as access layer security configuration information after receiving the security information request message from the ASU; and

receiving, by a proxy-call session control function (P-CSCF), an IMS login request message from the WAPI terminal, inquiring about the security information of the WAPI terminal through the HSS, and allowing the WAPI terminal to execute an IMS service flow responsive to the security information of the WAPI terminal being the access layer security configuration information.

2. The method according to claim 1, wherein the ASU verifying the access point and the WAPI terminal comprises:

verifying, by the ASU, a signature and a certificate of the access point, and further verifying a signature of the WAPI terminal responsive to the signature and the certificate of the access point passing the verification; and

determining, by the ASU, that the access point and the WAPI terminal pass the verification responsive to the signature of the WAPI terminal passing the verification.

3. The method according to claim 2, wherein responsive to the WAPI terminal terminating the services associated with the IMS service flow, the method also comprises:

receiving, by the ASU, a releasing link and verification request message from the access point, and sending a security information releasing request message to the HSS, wherein the security information releasing request message carries the IMS account information of the released WAPI terminal; and

receiving, by the HSS, the security information releasing request message from the ASU, and setting the access layer security configuration information of the security information corresponding to the IMS account information of the WAPI terminal as null.

4. The method according to claim 1, wherein before the ASU verifies the access point and the WAPI terminal, the method further comprises:

sending, by the access point, an authentication activating message to the WAPI terminal, wherein the authentication activating message carries a certificate of the access point, parameter information of an elliptic curve Diffie-Hellman (ECDH), identifier information of the ASU, and authentication identifier information of the ASU;

receiving, by the WAPI terminal, the authentication activating message, and sending an access authentication request message to the access point, wherein the access authentication request message carries a certificate of the WAPI terminal, a certificate of the access point, parameter information of the ECDH, and ECDH public key information of the WAPI terminal; and

sending, by the access point, a certificate authentication request message to the ASU, wherein the certificate authentication request message carries a signature and the certificate of the access point, and a signature of the WAPI terminal.

5. The method according to claim 4, wherein after the HSS sets the security information corresponding to the IMS account information of the WAPI terminal as access layer security configuration information, and before the WAPI terminal sends the IMS login request message to the P-CSCF, the method further comprises:

receiving, by the access point, a certificate authentication response message from the ASU, and sending an access authentication response message to the WAPI terminal; and

performing, by the access point and the WAPI terminal, unicast key agreement to determine a base key adopted during encrypted transmission of data between the access point and the WAPI terminal, wherein responsive to the agreement being successful, the data transmitted between the access point and the WAPI terminal is encrypted and decrypted by using the base key.

6. The method according to claim 4, wherein responsive to the WAPI terminal terminating the services associated with the IMS service flow, the method also comprises:

receiving, by the ASU, a releasing link and verification request message from the access point, and sending a security information releasing request message to the HSS, wherein the security information releasing request message carries the IMS account information of the released WAPI terminal; and

receiving, by the HSS, the security information releasing request message from the ASU, and setting the access layer security configuration information of the security information corresponding to the IMS account information of the WAPI terminal as null.

7. The method according to claim 5, wherein the access point and the WAPI terminal performing unicast key agreement comprises:

sending, by the access point, a unicast key agreement request message to the WAPI terminal; and

receiving, by the access point, a unicast key agreement response message from the WAPI terminal, and sending a unicast key agreement confirmation message to the WAPI terminal.

8. The method according to claim 5, wherein responsive to the WAPI terminal terminating the services associated with the IMS service flow, the method also comprises:

receiving, by the ASU, a releasing link and verification request message from the access point, and sending a security information releasing request message to the HSS, wherein the security information releasing request message carries the IMS account information of the released WAPI terminal; and

receiving, by the HSS, the security information releasing request message from the ASU, and setting the access layer security configuration information of the security information corresponding to the IMS account information of the WAPI terminal as null.

9. The method according to claim 7, wherein responsive to the WAPI terminal terminating the services associated with the IMS service flow, the method also comprises:

receiving, by the ASU, a releasing link and verification request message from the access point, and sending a security information releasing request message to the HSS, wherein the security information releasing request message carries the IMS account information of the released WAPI terminal; and

receiving, by the HSS, the security information releasing request message from the ASU, and setting the access layer security configuration information of the security information corresponding to the IMS account information of the WAPI terminal as null.

10. The method according to claim 1, wherein responsive to the WAPI terminal terminating the services associated with the IMS service flow, the method also comprises:

receiving, by the ASU, a releasing link and verification request message from the access point, and sending a security information releasing request message to the HSS, wherein the security information releasing request message carries the IMS account information of the released WAPI terminal; and

receiving, by the HSS, the security information releasing request message from the ASU, and setting the access layer security configuration information of the security information corresponding to the IMS account information of the WAPI terminal as null.

11. A security management system for a WAPI terminal accessing into an IP multimedia subsystem (IMS) network, the system comprising:

an authentication service unit (ASU), configured to verify an access point and the WAPI terminal, and send a security information request message to a home subscriber server (HSS) responsive to the access point and the WAPI terminal passing the verification, wherein the security information request message carries IMS account information of the WAPI terminal;

the HSS, configured to receive the security information request message from the ASU, and set security information corresponding to the IMS account information of the WAPI terminal as access layer security configuration information; and

a proxy-call session control function (P-CSCF), configured to inquire, responsive to receiving an IMS login request message from the WAPI terminal, about the security information of the WAPI terminal through the HSS, and perform subsequent processing according to the inquiry result.

12. The system according to claim 11, wherein the ASU further comprises:

a verification module, configured to verify the access point and the WAPI terminal; and

a sending module, configured to send the security information request message to the HSS responsive to the verification result of the verification module being that the access point and the WAPI terminal pass the verification, wherein the security information request message carries the IMS account information of the WAPI terminal.

13. The system according to claim 12, wherein the HSS further comprises:

a first receiving module, configured to receive the security information request message from the sending module; and

a setting module, configured to set the security information corresponding to the IMS account information of the WAPI terminal as access layer security configuration information according to the security information request message received by the first receiving module.

14. The system according to claim 13, wherein the P-CSCF further comprises:

a second receiving module, configured to receive the IMS login request message from the WAPI terminal; and

an inquiry module, configured to inquire about the security information of the WAPI terminal through the HSS, and perform subsequent processing according to the inquiry result.