Method and system for authentication in IP multimedia core network system (IMS)

• US 20040043756A1
• Filed: 02/21/2003
• Published: 03/04/2004
• Est. Priority Date: 09/03/2002
• Status: Abandoned Application

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: Bajko, Gabor, Niemi, Aki, Haukka, Tao
• Application Number:
  US10/369,497
• Publication Number:
  US 20040043756A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1045 Proxies, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

A method and communication system are provided for authenticating a first entity (such as a mobile device) in the communications network. This may include transmitting a register message from the first entity to a second entity. An authentication challenge may be transmitted from the second entity to the first entity. The authentication challenge may include security association parameters within a header field. The response of the challenge may be transmitted from the first entity to the second entity. The response of the challenge may include security association parameters within a header field. A security association may be set up based on the security association parameters.

Claims

1. A method of authenticating a first entity in a communication network, the method comprising:

transmitting a register message from the first entity to a second entity;

transmitting an authentication challenge from the second entity to said first entity, the authentication challenge including security association parameters; and

setting up a security association based on the security association parameters.

2. The method of claim 1, wherein after transmitting the authentication challenge, the method further comprises transmitting a further register message from the first entity to the second entity, the further register message including security association parameters of the first entity.

3. The method of claim 1, wherein the authentication challenge includes security association parameters of the second entity.

4. The method of claim 1, wherein security association parameters of the first entity are transmitted in the register message.

5. The method of claim 4, wherein the register message includes a header field, the header field to include security association parameters of the first entity.

6. The method of claim 4, wherein the authentication challenge includes security association parameters of the second entity.

7. The method of claim 6, wherein the authentication challenge includes a header field, the header field to include the security association parameters of the second entity.

8. The method of claim 7, wherein the header field further includes Digest parameters.

9. The method of claim 1, wherein the authentication challenge includes a header field, the header field to include the security association parameters.

10. The method of claim 9, wherein the header field further includes Digest parameters.

11. The method of claim 1, wherein communications between the first entity and the second entity use Session Initiated Protocol (SIP).

12. The method of claim 11, wherein the security association parameters accompany one of the headers “

WWW-Authenticate”

, “

Proxy-Authenticate”

, “

Authorization” and

“

Proxy-Authorization”

.

13. The method of claim 1, wherein the first entity comprises a mobile device.

14. A method comprising:

transmitting a first message from a first entity to a second entity;

transmitting a second message from the second entity to the first entity, wherein security association parameters are transmitted in at least one of the first message and the second message; and

creating a security association based on the transmitted security associated parameters.

15. The method of claim 14, wherein after transmitting the second message, the method further comprises transmitting a third message from the first entity to the second entity, the third message including security association parameters of the first entity.

16. The method of claim 14, wherein the second message includes security association parameters of the second entity.

17. The method of claim 14, wherein security association parameters of the first entity are transmitted in the first message.

18. The method of claim 17, wherein the first message includes a header field, the header field to include security association parameters of the first entity.

19. The method of claim 18, wherein the second message includes security association parameters of the second entity.

20. The method of claim 19, wherein the second message includes a header field, the header field to include the security association parameters of the second entity.

21. The method of claim 20, wherein the header field further includes Digest parameters.

22. The method of claim 14, wherein the second message includes a header field, the header field to include the security association parameters.

23. The method of claim 22, wherein the header field further includes Digest parameters.

24. The method of claim 14, wherein communications between the first entity and the second entity use Session Initiated Protocol (SIP).

25. The method of claim 24, wherein the security association parameters accompany one of the headers “

WWW-Authenticate”

, “

Proxy-Authenticate”

, “

Authorization” and

“

Proxy-Authorization”

.

26. The method of claim 14, wherein the first entity comprises a mobile device.

27. A communication system comprising:

a user equipment that transmits and receives communications and a control entity that provides control functions in the communication system, and wherein

the user equipment transmits a register message to the control entity;

the control entity transmits an authentication challenge to said user equipment, the authentication challenge including security association parameters; and

the communication network sets up a security association based on the security association parameters.

28. The communication system of claim 27, wherein after transmitting the authentication challenge, the user equipment further transmits a further register message to the control entity, the further register message including security association parameters of the user equipment.

29. The communication system of claim 27, wherein the authentication challenge includes security association parameters of the control entity.

30. The communication system of claim 27, wherein security association parameters of the user equipment are transmitted within the register message.

31. The communication system of claim 30, wherein the register message includes a header field, the header field to include security association parameters of the user equipment.

32. The communication system of claim 30, wherein the authentication challenge includes security association parameters of the control entity.

33. The communication system of claim 27, wherein the authentication challenge includes a header field, the header field to include the security association parameters.

34. The communication system of claim 33, wherein the header field further includes Digest parameters.

35. The communication system of claim 27, wherein communications between the user equipment and the control entity use Session Initiated Protocol (SIP).

36. The communication system of claim 35, wherein the security association parameters accompany one of the headers “

WWW-Authenticate”

, “

Proxy-Authenticate”

, “

Authorization” and

“

Proxy-Authorization”

.