WO2008034377A1

WO2008034377A1 - Method and system of authentication consultation

Info

Publication number: WO2008034377A1
Application number: PCT/CN2007/070572
Authority: WO
Inventors: Bin Yu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-08-29
Filing date: 2007-08-28
Publication date: 2008-03-27
Also published as: CN100591012C; CN1913438A

Abstract

Method of the authentication consultation, said method includes: the service call session control (S-CSCF) requests the authentication kind to the HSS when it can't determine the authentication kind, the home user server(HSS) receives the extended Multimedia Authentication Request(MAR) from S-CSCF; the HSS judges the authentication kind required by the S-CSCF according to the MAR; the HSS reads the authentication kind signed by a user, the HSS provides the authentication kind which selects from the authentication kind signed by the user according to the authentication kind required by the S-CSCF. The invention also provides the system of authentication consultation and the home user server. The invention can improve the veracity and agility of authentication kind judgement.

Description

The invention relates to a Chinese patent application filed on August 29, 2006, the Chinese Patent Office, the application number is 200610127603.3, and the invention name is "an authentication negotiation method and a communication system." Priority, the entire contents of which are incorporated herein by reference.

The present invention relates to the field of communication security technologies, and in particular, to an authentication negotiation method and system. Background technique

In the Internet Protocol Multimedia Subsystem (IMS), the terminal has various modes, the capabilities of the terminal are different, and the authentication types are different. Therefore, the IMS core network is required to support multiple authentication types. . Currently, the authentication types supported by the IMS core network include IMS AKA authentication, Early IMS authentication, and HTTP Digest authentication.

A flow chart of an authentication method in the prior art is shown in Figure 1:

101-102, the user terminal sends a registration message to the Interrogating Call Session Control Function (I-CSCF) through a proxy call session control unit (P-CSCF, Proxy Call Session Control Function);

103. The I-CSCF sends a user status query request message to a User Subscriber Server (HSS).

104. The HSS feeds back the user status query response information to the I-CSCF.

105, I - CSCF selects a corresponding service call session control unit according to the response information (S -

CSCF, Serving Call Session Control Function );

106. After selecting the corresponding S-CSCF, the I-CSCF sends a registration message to the S-CSCF;

107. The S-CSCF initiates an authentication vector request to the HSS after receiving the registration message.

108. The HSS selects an corresponding authentication vector;

109. The HSS feeds back the selected authentication vector to the S-CSCF.

110 ~ 112, the S-CSCF sends an Unauthorized message to the user terminal through the I-CSCF and the P-CSCF, requesting the user to perform authentication; 113-114, the user terminal sends a registration message carrying the RES parameter to the I-CSCF through the P-CSCF;

115 ~ 116, I - CSCF requests the user status from the HSS and gets feedback from the HSS;

117, I - CSCF sends a registration message carrying the RES parameter to the S-CSCF;

118. The S-CSCF authenticates the user according to the RES parameter in the registration message and the locally stored RES parameter.

119. After the authentication is passed, the S-CSCF sends a user registration/logout request message to the HSS.

120. The HSS feeds back a user registration/logout response message to the S-CSCF;

121 ~ 123. After the user registration/deregistration is successful, the S-CSCF feeds back the success confirmation message to the user terminal through the I-CSCF and the P-CSCF.

3GPP TS 24.229 v6.9.0 specifies that the first registration message of the ISIM card user using AKA authentication (such as the registration message sent in step 101 of Figure 1) must have an Authorization header field, which will carry the user. Private identity and algorithm name.

3GPP TS33.978v630 specifies that the registration message of the user using Early IMS authentication must not carry the Authorization header field, and the IMS network supporting IMS AKA authentication and Early IMS authentication determines whether the registration message carries Authorization. The header field is used to determine what authentication the user expects to use.

In the HTTP Digest authentication process described in RFC2617 and RFC3261, the user's first registration message does not normally have an Authorization header field. The user's second registration message will always have Authorization, which will carry the user's username and algorithm name.

TISPAN Release 1 does not specify whether the registration message of the fixed network user carries Authorization. Therefore, the user equipment that follows TISPAN Release 1 may not carry the Authorization header field when performing NASS-Bundled authentication.

However, the prior art cannot distinguish between the registration messages of Early IMS authentication, HTTP Digest authentication, and NASS-Bundled authentication. If the SIP registration message sent by the user does not carry the Authorization header field, the IMS core network cannot know exactly which authentication mode the user expects to retrieve, and therefore cannot request the corresponding authentication data from the HSS. Summary of the invention

The invention provides an authentication negotiation method and a communication system using the same, which is used for improving the identification The accuracy of the weight type determination.

The present invention provides an authentication negotiation method, including:

When the serving call session control unit S-CSCF cannot determine that the authentication type requests the HSS to obtain the authentication type,

The home subscriber server HSS receives the extended authentication vector request MAR message sent by the S-CSCF;

The HSS determines, according to the received MAR message, that the S-CSCF needs to obtain an authentication type;

The HSS reads the authentication type of the user subscription, and selects an authentication type from the authentication type subscribed by the user according to the authentication type that the S-CSCF needs to obtain and provides the authentication type to the S-CSCF.

A home subscriber server provided by the present invention includes:

Receiving unit, receiving an extended authentication vector request MAR message sent by the serving call session control unit S-CSCF;

The determining unit determines, according to the received MAR message, that the S-CSCF needs to obtain an authentication type;

The obtaining unit reads the authentication type signed by the user and the corresponding authentication data;

a selecting unit, selecting an authentication type from the authentication types subscribed by the user according to the authentication type that the S-CSCF needs to acquire;

a sending unit, sending the selected authentication type and its corresponding authentication data to the S

CSCF.

The present invention provides a system with an authentication negotiation function, including: a home subscriber server HSS and a service call session control unit S-CSCF;

a serving call session control unit S-CSCF, transmitting an extended authentication vector request MAR message;

The home subscriber server HSS is configured to read an authentication type of the user subscription, and select an authentication type in the authentication type of the user subscription;

The home subscriber server HSS receives the extended authentication vector request MAR message sent by the S-CSCF, and selects an authentication type that is subscribed by the user according to the authentication type information carried by the extended MAR message. Type of authentication;

The home subscriber server HSS sends the selected authentication type and its corresponding authentication data Send to the service call session control unit S - CSCF;

The service call session control unit authenticates the user according to the received authentication data. In the technical solution provided by the present invention, when the service call session control unit S-CSCF cannot determine the authentication type, the home subscriber server stores the subscriber's subscription data and the authentication data, and the S-CSCF negotiates with the home subscriber server. The home subscriber server selects an authentication type from the authentication type subscribed by the user according to the authentication type that the S-CSCF needs to acquire, and provides the authentication type to the S-CSCF, and the home subscriber server sends the authentication type to the S-CSCF, so Determining the authentication type by the home subscriber server can improve the accuracy of the authentication type determination. DRAWINGS

1 is a prior art signaling flow chart;

2 is a general flowchart of an authentication negotiation method in an embodiment of the present invention;

3 is a detailed flowchart of an authentication negotiation method in an embodiment of the present invention;

4 is a schematic diagram of a system in an embodiment of the present invention. detailed description

The embodiment of the invention provides an authentication negotiation method and a communication system using the method, which are used for improving the accuracy of the authentication type determination.

Referring to FIG. 2, the overall process of the authentication negotiation method provided by the embodiment of the present invention is as follows: 201. Read an authentication type;

The HSS reads the authentication type when the user signs the contract from the local data.

202. Query the authentication type with the highest priority;

The HSS queries the authentication type with the highest priority among the authentication types read. If the MAR message carries multiple authentication types, the HSS needs to query the authentication type with the highest priority from the intersection of the set and the authentication type set that the user subscribes to.

203. Send authentication data.

The HSS sends the authentication data corresponding to the highest priority authentication type to the queried

S - CSCF.

The authentication data includes an authentication type.

204. Perform authentication.

The S-CSCF performs authentication according to the received authentication data. Referring to FIG. 3, the detailed process of the authentication negotiation method provided by the embodiment of the present invention is as follows:

301. Obtain a registration message;

The user terminal sends a registration message to the P-CSCF, and the P-CSCF forwards the received registration message to the I-CSCF, and the I-CSCF sends a user registration status query request message to the HSS, and the HSS feeds the user registration status query to the I-CSCF. In response to the message, the I-CSCF then selects the S-CSCF based on the obtained User Registration Status Query Response message and sends a registration message to the S-CSCF.

302, determine whether the S-CSCF can determine the authentication type, if yes, then go to step 307, if not, then go to step 303;

Among them, due to the IMS AKA authentication, the first registration message must be carried

In the Authorization header field, the registration message of the user in the Early IMS authentication must not carry the Authorization header field, and the registration message of the user in the HTTP Digest authentication and NASS Bundled authentication may have the Authorization header field, or may not Therefore, S-CSCF may not be able to determine the type of authentication the user needs to perform.

303. Request to obtain an authentication type.

Wherein, when the S-CSCF cannot determine the authentication type, it is required to obtain the authentication type from the HSS. In this embodiment, the extended authentication vector request message (MAR, Multimedia Auth Request) is sent to the HSS through the S-CSCF to implement the request. Type of authentication.

The specific extension can be achieved in the following two ways:

1. The attribute of the AVP: SIP-Authentication- Scheme in the MAR message is changed to an optional attribute. If the parameter is carried, it indicates that the S-CSCF can determine the authentication type, and the HSS is not required to perform the authentication type selection. If the parameter is carried, it indicates that the S-CSCF cannot determine the authentication type, and the HSS needs to select the authentication data corresponding to the authentication type and deliver it.

Change the MAR message to the format shown in the following table:

Table 1

Element Name AVP Mapping Optional / Required Description

Authentication Rule Session Initiation Protocol Optional When S-CSCF requires HSS selection

When the right rule is selected, the parameter should be

This should not be carried, otherwise it should be selected, and the authentication type is MS.

2. Extended AVP: The value of SIP-Authentication-Scheme, one possible value is "Unknown" (ie "unknown"), and the attribute of AVP: SIP-Authentication-Scheme is still mandatory. This requires both HSS and S-CSCF to understand the meaning of "Unknown", that is, if the value is "Unknown", it means that S-CSCF cannot determine the authentication type.

Change the MAR message to the format shown in the following table:

Table 2

After the MAR message is extended according to any of the above two extension manners, the S-CSCF sends the MAR message to the HSS, and the HSS determines, according to the received MAR message, that the S-CSCF needs to obtain the authentication type.

In particular, if the S-CSCF can confirm the scope of the user authentication according to the registration message of the user, for example, the S-CSCF can determine that the user can only use the Early IMS authentication or the HTTP Digest authentication, and it is impossible to use the IMS AKA. For authentication, the S-CSCF may carry a set of possible authentication types in the MAR message, indicating that the HSS may select in the intersection of the set of authentication types and the set of authentication types supported by the user, further improving the authentication selection. The accuracy.

The specific MAR message extension can be implemented in the following three ways:

I. Allowing AVP in the MAR message: The SIP-Authentication- Scheme appears multiple times. If multiple parameters are carried, it indicates that the S-CSCF determines that the authentication type that the user may use is multiple. The HSS needs to be supported according to the user. The authentication type is selected within the range, and the authentication data corresponding to the selected authentication type is delivered.

Change the MAR message to the format shown in Table 3 below:

table 3

Element Name AVP Mapping Optional/Required Description Authentication rule session initiation protocol must be selected... This element can appear multiple times, when S-CSCF can determine the usage rule

If the number of authentication types that the user may adopt is multiple, the number of authentication types that the user may adopt by the HSS is indicated by carrying a plurality of the elements.

2. Allow AVP in MAR message: SIP-Auth-Data-Item attribute appears multiple times, each AVP: AVP in SIP-Auth-Data-Item: SIP-Authorization- Scheme is mandatory, so when S-CSCF To determine that the user may use multiple authentication types, carry multiple AVPs by carrying multiple AVPs: SIP-Auth-Data-Item: SIP-Authorization- Scheme to HSS, and achieve the first extension The same purpose.

Change the MAR message to the format shown in Table 4 below:

Table 4

Third, expand the new AVP for MAR messages. In order to be compatible with the HSS that is fully compliant with the 3GPP TS 29.228 specification, a new AVP may be extended for the MAR message, and the 'M' position of the AVP is set to 0, and multiple new AVPs are carried to achieve multiple authentication types. purpose. This way, the original MAR message can be omitted, and the HSS that is not compatible with the new AVP can ignore the AVP. The extension method is to add an AVP with the same structure as AVP: SIP-Auth-Data-Item, for example, named Extended-SIP-Auth-Data-Item, and the AVP can appear multiple times.

Extend the MAR message to the format shown in Table 5 below:

table 5 Element Name AVP Mapping Optional/Required Description

Extended authentication Extended session initiation Required... This element can appear multiple times when the S-CSCF is able to determine the data protocol authentication data item

304, reading the authentication type;

Wherein, since the authentication type and authentication data supported by the user are all stored in the HSS by signing, the HSS knows which authentication mode the user supports. When the S-CSCF is unable to obtain the user's authentication type by registering the message, the HSS obtains all the authentication types supported by the locally stored user.

305. Query the authentication type with the highest priority;

The HSS queries the authentication type with the highest priority among all the authentication types supported by the user. If the user supports only one type of authentication, the authentication type has the highest priority.

If the S-CSCF specifies the set of authentication types that the user may use through the extended MAR message described above, the HSS needs to select from the set and the intersection of all sets of authentication types supported by the user.

The priority can be specified by the user when signing up, or by the HSS, and is valid for all users. If this priority is specified by the HSS, one possible priority is ranked according to the strength of the authentication algorithm, from high to low, IMS AKA authentication, Early IMS authentication, and HTTP Digest authentication.

306. Send an authentication type.

The HSS sends the queried authentication type with the highest priority to the S_CSCF.

307. Perform authentication.

The S-CSCF performs authentication according to the received authentication type.

Referring to FIG. 4, the communication system used in the embodiment of the present invention includes: a home subscriber server 404 and a service call session control unit 405; the home subscriber server 404 is configured to read the subscription authentication type, and the read authentication Querying the highest priority authentication type in the right type, and sending the highest priority authentication type to the service call session control unit 405; the service call session control unit 405 performs the user according to the received authentication type. Authentication. The system further includes: a proxy call session control unit 402, an inquiry call session control unit 403, and a user terminal 401; the user terminal 401 sends a registration message to the proxy call session control unit 402; the proxy call session control unit 402 Receiving the registration message sent by the user terminal 401 and forwarding the registration message to the inquiry call session control unit 403; the inquiry call session control unit 403 sends a user registration status inquiry request message to the home user server 404 according to the received registration message.

The embodiment of the invention further provides a home subscriber server, including:

CSCF.

It can be seen from the technical solution provided by the above embodiment that when the service call session control unit s -

When the CSCF cannot determine the authentication type, the home subscriber server stores the subscriber's subscription data and the authentication data, and the S-CSCF negotiates with the home subscriber server, and the home subscriber server obtains the authentication type according to the S-CSCF. The authentication type selected by the user is selected and provided to the S-CSCF, and the home subscriber server sends the authentication type to the S-CSCF, so determining the authentication type by the home subscriber server can improve the accuracy of the authentication type determination. . Moreover, when the user supports multiple authentication types, the home subscriber server sends the highest priority authentication type to the serving call session control unit according to the preset priority level, so the accuracy of the authentication can be improved. The priority can be set by the home user server, or can be set by the user according to actual needs, so the flexibility of obtaining the authentication type is improved.

In addition, the serving call session control unit can request the home subscriber server to obtain the authentication type in a variety of ways, thereby improving the flexibility of adaptation of the present invention.

Those skilled in the art can understand all or part of the units or steps in the above embodiments. The program can be implemented by instructing related hardware, and the program can be stored in a computer readable storage medium, such as a ROM/RAM, a magnetic disk, a compact disk, or the like. Alternatively, they may be fabricated into individual integrated circuit modules, or a plurality of units or steps thereof may be fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The foregoing detailed description of the method for authenticating an authentication negotiation method and a communication system provided by the present invention is only for helping to understand the method and core idea of the present invention; and, for those skilled in the art, The present invention is not limited by the scope of the present invention.

Claims

Rights request

An authentication negotiation method, which is characterized in that:

Determining, by the HSS, that the S-CSCF needs to acquire an authentication type according to the received MAR message;

The authentication negotiation method according to claim 1, wherein the selecting an authentication type according to the authentication type that the S-CSCF needs to obtain includes:

The HSS selects an authentication type from the intersection of a plurality of authentication types carried by the MAR message and a set of authentication types subscribed by the user, and provides the type to the S-CSCF.

The authentication negotiation method according to claim 1 or 2, further comprising:

Sending the authentication data corresponding to the selected authentication type to the serving call session control unit S - CSCF;

The service call session control unit authenticates the user based on the received authentication data.

The authentication negotiation method according to claim 1 or 2, wherein the selected authentication type is the authentication type with the highest priority.

The authentication negotiation method according to claim 1, further comprising: after receiving the extended MAR message, the HSS determines the S according to an attribute parameter carried by the MAR message. Can CSCF determine the type of authentication;

If the S-CSCF cannot determine the authentication type, the HSS obtains all the authentication types supported by the user stored locally, and selects the authentication type and its corresponding authentication data from the authentication data and sends the authentication data to the S_CSCF.

6. The authentication negotiation method according to claim 5, wherein the selected authentication is performed Type is the authentication type with the highest priority.

The authentication negotiation method according to claim 1, wherein the step of requesting the MAR message by the extended authentication vector comprises:

Set the authentication rule element AVP: SIP-Authentication-Scheme attribute in the MAR message to mandatory and allow multiple occurrences; or / and

Authentication data in the MAR message AVP: The SIP-Auth-Data-Item attribute is set to mandatory and allowed to appear multiple times; or / and

Extend new authentication parameters AVP; or / and for MAR messages

Extended authentication parameter AVP: The range of values for SIP-Authentication-Scheme.

8. A system having an authentication negotiation function, comprising: a home subscriber server HSS and a service call session control unit S-CSCF;

The home subscriber server HSS sends the selected authentication type and its corresponding authentication data to the serving call session control unit S - CSCF;

The service call session control unit authenticates the user according to the received authentication data.

9. The system according to claim 8, further comprising: a proxy call session control unit, an inquiry call session control unit, and a user terminal;

The user terminal sends a registration message to the proxy call session control unit;

The proxy call session control unit receives a registration message sent by the user terminal and forwards the registration message to the query call session control unit;

The inquiry call session control unit sends a user registration status query request message to the home subscriber server according to the received registration message.

10. A home subscriber server, comprising: Receiving unit, receiving an extended authentication vector request MAR message sent by the serving call session control unit S-CSCF;

CSCF.