Authentication of messages in a communication system

• US 7,600,116 B2
• Filed: 01/21/2004
• Issued: 10/06/2009
• Est. Priority Date: 10/17/2003
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Kiss, Krisztian, Bajko, Gabor
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): TURCHEN, JAMES R
• Application Number:
  US10/760,521
• Publication Number:
  US 20050097363A1
• Time in Patent Office: 2,085 Days
• Field of Search: 713/166, 709/228
• US Class Current: 713/166
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1045 Proxies, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Abstract

In a communication system wherein a serving controller may be configured to support a first security mechanism and at least one other security mechanism. A request for registration is sent from a user equipment to the serving controller where after it is determined in a second controller that the user equipment supports another security mechanism than the first security mechanism. The second controller may then send to the serving controller an indication that another security mechanism than the first security mechanism is used by the user equipment. The serving controller then sends a challenge in accordance with the other security mechanism to the user equipment.

Claims

1. A method, comprising:

receiving a request for registration from a user equipment at a serving controller via a second controller, said request for registration including information indicative of at least one protocol supported by the user equipment;

determining, based on the information, in the second controller that the user equipment supports a second protocol other than a first protocol;

removing the information from the request for registration in the second controller, including in the request for registration an indication that the second protocol is used by the user equipment and forwarding the request for registration including said indication to the serving controller; and

sending a challenge in accordance with the second protocol from the serving controller to the user equipment via the second controller.

2. A method as claimed in claim 1, further comprising:

forwarding a response to the challenge in a message from the user equipment to the serving controller.

3. A method as claimed in claim 2, further comprising:

using the response for authentication of the message at the serving controller.

4. A method as claimed in claim 1, further comprising:

receiving at the second controller comprising a network entity providing proxy call state control functions between the user equipment and the serving controller.

5. A method as claimed in claim 1, wherein the sending of the request for registration from the user equipment to the serving controller comprises

sending a challenge from the serving controller to the user equipment, sending a response to the challenge from the user equipment, and

registering the user equipment to the serving controller only if a satisfactory response is received from the user equipment, and sending a further challenge to the user equipment after the registration is completed.

6. A method as claimed in claim 1, further comprising:

obtaining data for sending the challenge from a user information database.

7. A method as claimed in claim 1, wherein the sending of the challenge comprises sending the challenge comprising an authentication vector.

8. A method as claimed in claim 1, further comprising:

providing the first protocol comprising a protocol in accordance with a secure internet protocol.

9. A method as claimed in claim 1, further comprising:

providing the second protocol comprising a protocol in accordance with a hypertext transfer digest protocol.

10. A method as claimed in claim 1, further comprising:

sending of at least the challenge or a response in a message in accordance with a session initiation protocol.

11. A method as claimed in claim 1, further comprising:

registering the user equipment with a serving controller of an internet multimedia subsystem.

12. A method as claimed in claim 2, wherein said information comprises a list of protocols supported by the user equipment, the method further comprising:

including in a security-client header of the request for registration the list of protocols supported by the user equipment;

concluding at the second controller based on the list that the user equipment supports the second protocol instead of the first protocol;

removing the security-client header from the request and including into an authorization header of the request the indication that the second protocol is to be used; and

forwarding the request to the serving controller.

13. A method as claimed in claim 1, wherein the sending of the challenge comprises sending the challenge to the user equipment in an authentication information header of a message.

14. A method as claimed in claim 3, further comprising:

providing the message comprising a request for a service provided by an application server.

15. A system, comprising:

a serving controller configured to accept registrations of user equipments and to support at least two different protocols; and

a second controller configured to receive from a user equipment in a request for registration data indicative of at least one protocol that the user equipment supports, to remove said data from the request for registration, to provide the serving controller with information regarding a protocol supported by the user equipment that has requested to be registered to the serving controller, and to forward the request for registration to the serving controller, wherein the serving controller is configured to send a challenge in accordance with a determined protocol to the user equipment and to authenticate a message from the user equipment based on a response to the challenge included in the message.

16. A system as claimed in claim 15, wherein the second controller configured to provide information regarding the protocol is provided in a second controller.

17. A system as claimed in claim 16, wherein the second controller comprises a network entity providing proxy call state control functions between the user equipment and the serving controller.

18. A system as claimed in claim 15, further comprising:

a user information database configured to store data associated with challenges.

19. A system as claimed in claim 15, wherein the serving controller is configured to support a protocol in accordance with a secure internet protocol.

20. A system as claimed in claim 15, wherein the serving controller is configured to support a protocol in accordance with a hypertext transfer digest protocol.

21. A system as claimed in claim 15, the communication system comprising an internet multimedia subsystem.

22. A system as claimed in claim 15, further comprising:

a connection to an application server, wherein a message subjected to authentication by the servicing controller based on the response to the challenge comprises a request for a service provided by the application server.

23. A system as claimed in claim 15, wherein the message subjected to authentication by the servicing controller based on the response to the challenge comprises a request for registration to the serving controller.

24. An apparatus, comprising:

a receiver configured to receive a request for registration from a user equipment for forwarding to a serving controller, said request including data indicative of at least one protocol supported by said user equipment; and

a controller configured to determine based on said data a protocol supported by the user equipment that has requested to be registered to the serving controller, to remove the data from the request for registration in the second controller before forwarding said request to the serving controller, and to signal information to the serving controller regarding the protocol supported by the user equipment.

26. The apparatus according to claim 24, wherein the controller is further configured to send a response to the challenge from the user equipment to the serving controller.

27. The apparatus according to claim 26, wherein the controller is further configured to use the response for authentication of the message at the serving controller.

28. The apparatus according to claim 24, wherein the controller is comprised in a network entity providing proxy call state control functions between the user equipment and the serving controller.

29. The apparatus according to claim 24, wherein the controller is further configured to send a challenge from the serving controller to the user equipment, to send a response to the challenge from the user equipment, and to register the user equipment to the serving controller only if a satisfactory response is received from the user equipment, and to send a further challenge to the user equipment after the registration is completed.

30. The apparatus according to claim 29, wherein the controller is further configured to obtain data to send the challenge from a user information database.

31. The apparatus according to claim 24, wherein the controller is further configured to send challenge including an authentication vector.

25. An apparatus, comprising:

receiving means for receiving a request for registration from a user equipment for forwarding to a serving controller, said request including data indicative of at least one protocol supported by said user equipment;

determining means for determining, based on said data, a protocol supported by the user equipment that has requested to be registered to the serving controller;

removing means for removing the data from the request for registration in the second controller before forwarding said request to the serving controller; and

signalling means for signalling information to the serving controller regarding the protocol supported by the user equipment.

32. A computer program embodied on a computer readable storage medium, the computer program being configured to control a processor to perform:

receiving a request for registration from a user equipment at a serving controller via a second controller, said request for registration including information indicative of at least one protocol supported by the user equipment;

determining, based on the information, in the second controller that the user equipment supports a second protocol other than a first protocol;

removing the information from the request for registration in the second controller, including in the request for registration an indication that the second protocol is used by the user equipment and forwarding the request for registration including said indication to the serving controller; and

sending a challenge in accordance with the second protocol from the serving controller to the user equipment via the second controller.

33. A method, comprising:

receiving a request for registration from a user equipment for forwarding to a serving controller, said request including data indicative of at least one protocol supported by said user equipment;

determining, based on said data, a protocol supported by the user equipment that has requested to be registered to the serving controller;

removing the data from the request for registration in the second controller before forwarding said request to the serving controller; and

signaling information to the serving controller regarding the protocol supported by the user equipment.

34. The method according to claim 33, further comprising sending a response to the challenge from the user equipment to the serving controller.

35. The method according to claim 34, further comprising using the response for authentication of the message at the serving controller.

36. The method according to claim 33, wherein the second controller comprises a network entity providing proxy call state control functions between the user equipment and the serving controller.

37. The method according to claim 33, further comprising forwarding a challenge including an authentication vector.

38. A computer program embodied on a computer readable storage medium, the computer program being configured to control a processor to perform:

receiving a request for registration from a user equipment for forwarding to a serving controller, said request including data indicative of at least one protocol supported by said user equipment;

determining, based on said data, a protocol supported by the user equipment that has requested to be registered to the serving controller;

removing the data from the request for registration in the second controller before forwarding said request to the serving controller; and

signaling information to the serving controller regarding the protocol supported by the user equipment.