Method for authenticating user terminal in IP multimedia sub-system

• US 20080045214A1
• Filed: 08/31/2007
• Published: 02/21/2008
• Est. Priority Date: 04/30/2005
• Status: Active Grant

• Current Assignee: INVT SPE LLC (SoftBank Group Corp.)
• Original Assignee: Inventergy, Inc. (Inventergy Global, Inc.)
• Inventors: Gu, Jiongjiong, Wen, Kai
• Granted Patent: US 8,335,487 B2
• Time in Patent Office: Days
• US Class Current: 455/435.1
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for authenticating user terminal in IMS network, the method includes: with regard to user request, Service-Call Session Control Function (S-CSCF) entity creates the authentication challenge utilizing Digest Authentication Algorithm, and sends the authentication challenge to user terminal through Proxy-Call Session Control Function (P-CSCF) entity; the user terminal creates the authentication response utilizing Digest Authentication Algorithm according to the user key and associated parameters with said authentication challenge, and sends the authentication response to S-CSCF entity through S-CSCF entity; S-CSCF entity authenticates said authentication response utilizing Digest Authentication Algorithm according to HA1 and associated parameters, if the authentication passes, determines that the user terminal is authenticated successfully, otherwise, determines that the user terminal is authenticated failure.

Claims

1. A method for authenticating a user equipment in an IP multimedia subsystem, comprising:

generating, by a Serving-Call Session Control Function (S-CSCF) entity, an authentication challenge through a Digest Authentication Algorithm in response to a subscriber request, and sending the authentication challenge to a user equipment through a Proxy-Call Session Control Function (P-CSCF) entity;

generating, by the user equipment, an authentication response through the Digest Authentication Algorithm in accordance with a subscriber key as well as related parameters in the authentication challenge, and sending the authentication response to the S-CSCF entity through the P-CSCF entity; and

verifying, by the S-CSCF entity, the authentication response through the Digest Authentication Algorithm in accordance with information HA1 related to the subscriber key as well as related parameters, and if the verification has been passed, determining that the authentication for the user equipment succeeds, otherwise determining that the authentication for the user equipment fails.

2. The method according to claim 1, wherein the subscriber request is a registration request.

3. The method according to claim 1, wherein the Digest Authentication Algorithm is a Digest MD5 algorithm, and the S-CSCF entity obtains the HA1 through interacting with a Home Subscriber Server (HSS) prior to generation of the authentication challenge or upon receipt of the authentication response.

4. The method according to claim 3, wherein the obtaining the HA1 comprises:

sending, by the S-CSCF entity, to the HSS a request message carrying a subscriber identity; and

generating, by the HSS, the HA1 in accordance with a domain name of a domain corresponding to the subscriber, the subscriber identity and the subscriber key, and returning to the S-CSCF entity the HA1 in a response message.

5. The method according to claim 1, wherein the Digest Authentication Algorithm is a Digest MD5-Sess algorithm.

6. The method according to claim 5, wherein the obtaining the HA1 comprises:

sending, by the S-CSCF, to an HSS a request message carrying a subscriber identity, a parameter “

nonce” and

a parameter “

cnonce”

upon receipt of the authentication response; and

generating, by the HSS, the HA1 in accordance with a domain name of a domain corresponding to the subscriber, the subscriber identity, the subscriber key, the parameter “

nonce” and

the parameter “

cnonce”

, and returning to the S-CSCF entity the HA1 in a response message.

7. The method according to claim 4, wherein the subscriber identity is a public user identity or a private user identity.

8. The method according to claim 2, wherein after the authentication for registration of the user equipment succeeds, a subsequent request message is authenticated in accordance with an authentication method for a subsequent request message configured at an HSS.

9. The method according to claim 8, wherein the authentication method for a subsequent request message comprises one of authenticating only a registration request message, authenticating only a registration request and a session request message, and authenticating each request message.

10. The method according to claim 9, wherein in the case of authentication for each request message, an authentication session for a subscriber request message is configured equal to a subscriber registration period or a subscriber session period.

17. The method according to claim 6, wherein the subscriber identity is a public user identity or a private user identity.

11. A method for authenticating a user equipment in an IP multimedia subsystem, comprising:

generating, by a Home Subscriber Server (HSS), parameters required during a Digest Authentication for generation of an authentication challenge in accordance with a subscriber identity in a request message sent from a Serving-Call Session Control Function (S-CSCF) entity, and sending the parameters to the S-CSCF entity;

generating, by the S-CSCF entity, an authentication challenge in accordance with the parameters, and sending the authentication challenge to a user equipment through a Proxy-Call Session Control Function (P-CSCF) entity;

generating, by the user equipment, an authentication response through a Digest Authentication Algorithm in accordance with a subscriber key as well as related parameters in the authentication challenge, and transferring the authentication response to the HSS through the P-CSCF entity and the S-CSCF entity; and

verifying, by the HSS, related contents in the authentication response through the Digest Authentication Algorithm in accordance with the subscriber key and related parameters, and if the verification has been passed, informing the S-CSCF entity that the authentication for the user equipment succeeds, otherwise informing the S-CSCF entity that the authentication for the user equipment fails.

12. The method according to claim 11, wherein the subscriber identity is a public user identity or a private user identity.

13. The method according to claim 11, wherein the subscriber request is a registration request.

14. The method according to claim 13, wherein after the authentication for registration of the user equipment succeeds, a subsequent request message is authenticated in accordance with an authentication method for a subsequent request message configured at the HSS.

15. The method according to claim 14, wherein the authentication method for a subsequent request message comprises one of authenticating only a registration request message, authenticating only a registration request and a session request message, and authenticating each request message.

16. The method according to claim 15, wherein in the case of authentication for each request message, an authentication session for a subscriber message is configured equal to a subscriber registration period or a subscriber session period.

18. The method according to claim 12, wherein the subscriber request is a registration request.