WO2006136106A1 - A method and system for authenticating user terminal - Google Patents

A method and system for authenticating user terminal Download PDF

Info

Publication number
WO2006136106A1
WO2006136106A1 PCT/CN2006/001416 CN2006001416W WO2006136106A1 WO 2006136106 A1 WO2006136106 A1 WO 2006136106A1 CN 2006001416 W CN2006001416 W CN 2006001416W WO 2006136106 A1 WO2006136106 A1 WO 2006136106A1
Authority
WO
WIPO (PCT)
Prior art keywords
binding information
application service
ims terminal
service entity
hss
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2006/001416
Other languages
English (en)
French (fr)
Inventor
Yingxin Huang
Fenqin Zhu
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to CNA2006800123062A priority Critical patent/CN101160920A/zh
Priority to EP06742203A priority patent/EP1816825A4/en
Publication of WO2006136106A1 publication Critical patent/WO2006136106A1/zh
Priority to US11/735,541 priority patent/US20070249342A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1016—IP multimedia subsystem [IMS]

Definitions

  • the present invention relates to the field of mobile communication technologies, and in particular, to a method and an authentication system for authenticating an Early IMS terminal directly accessing an application service entity. Background of the invention
  • mobile communications are not limited to traditional voice communications, through data services such as presence, short messages, web browsing, location information, push services (PUSH), and file sharing.
  • data services such as presence, short messages, web browsing, location information, push services (PUSH), and file sharing.
  • PUSH push services
  • file sharing Combined, mobile communication enables multiple media types of audio, video, picture and text to meet the diverse needs of users.
  • IP-based Multimedia Subsystem IMS
  • 3GPP 3rd Generation Mobile Communications Standardization Partnership Project
  • 3GPP2 3rd Generation Mobile Communications Standardization Partnership Project 2
  • IMS IP-based Multimedia Subsystem
  • the IMS architecture is superimposed on a packet domain network (PS-Domain), and its authentication-related entities include a Call State Control Function (CSCF) entity and a Home Subscriber Server (HSS) functional entity.
  • the CSCF can be further divided into three logical entities: a service CSCF (S-CSCF) proxy CSCF (P-CSCF) and a query CSCF (I-CSCF).
  • S-CSCF service CSCF
  • P-CSCF proxy CSCF
  • I-CSCF query CSCF
  • the three logical entities can be different physical devices or the same physical device. Different functional modules.
  • the S-CSCF is a service control center of the IMS, which is used to perform session control, maintain session state, manage user information, and generate charging information.
  • the P-CSCF is an access point for the terminal user to access the IMS, and is used to complete the user.
  • I-CSCF Registration, service volume (QoS) control and security management
  • I-CSCF is responsible for interworking between IMS domains, managing the allocation of S-CSCF, hiding network topology and configuration information Interest, and generate billing data, etc.
  • the HSS is a very important user database that is used to support the processing of calls and sessions by various network entities.
  • 3GPP proposes a transitional authentication. Rights scheme, which provides certain security functions for IMS services on 2G.
  • the complete 3G-based authentication scheme is used to authenticate the access user. In this way, both the 2G user and the 3G user can apply the service in the IMS after the authentication is passed.
  • the complete 3G-based authentication scheme is called Full 3GPP IMS authentication mode
  • the transition authentication scheme is called Early IMS authentication mode
  • the Early IMS supporting terminal is called Early IMS terminal.
  • any 2G or 3G UE it can use the services provided by the IMS-based application server (AS), such as using the presence service, or some simple management of the IMS-based AS or AS agent (AP). Operations, such as managing some group list information on an AS or AP.
  • AS IMS-based application server
  • AP AS agent
  • the UE When the UE needs to use the service provided by the IMS-based AS, it needs to access the 3GPP packet domain first, and then the IMS authentication to use the service provided by the AS. At this time, for the Early IMS UE, the IMS will use the Early IMS authentication mode for authentication; for the 3G UE, the IMS will use the Full 3GPP IMS authentication mode for authentication.
  • the UE When the UE needs to perform management operations on the IMS-based AS or through the AP, it still needs to access the 3GPP packet domain first, and then the UE can directly access the AS or the AP through the Ut interface, so the IMS does not perform the UE again.
  • Authentication At the same time, in the existing protocol, the UE directly accessing the AS or the AP is authenticated by using a Common Authentication Framework (GAA). To access the AS or AP.
  • GAA Common Authentication Framework
  • the existing authentication mechanism based on the Common Authentication Framework is for 3G user terminals, which does not support authentication of Early IMS terminals such as 2G user terminals. Therefore, there must be such a situation: Early The IMS terminal cannot access or the Early IMS terminal can directly access without authentication.
  • an object of the present invention is to provide a method for authenticating a user terminal to implement authentication for an Early IMS terminal that directly accesses an application service entity.
  • a method for authenticating a user terminal is applicable to an Early IMS terminal that directly accesses an application service entity, and the Early IMS terminal accesses a third-generation 3G mobile communication system to obtain an IP address, and the method further includes the following steps:
  • the Early IMS terminal initiates an access request to the application service entity, where the request includes the user identity, and the application service entity obtains the IP address of the Early IMS terminal and its user identity from the home network server HSS according to the received access request. Binding information is formed, and the Early IMS terminal is authenticated according to the binding information and the access request.
  • the process of authenticating the Early IMS terminal according to the binding information and the access request includes:
  • the application service entity determines whether the IP address in the binding information matches the IP address of the Early IMS terminal that initiates the access request, and if it matches, the Early IMS terminal By authentication, otherwise the Early IMS terminal cannot pass authentication.
  • the process of authenticating the Early IMS terminal according to the binding information and the access request includes:
  • the application service entity determines whether the acquired IP address of the Early IMS terminal and the binding information of the user identity thereof match the IP address and the user identity of the Early IMS terminal that initiates the access request. If they match, the Early The IMS terminal passes the rights of the woman, otherwise the Early IMS terminal cannot pass the authentication.
  • the method further includes: saving the binding information.
  • the access request initiated by the Early IMS terminal further includes an authentication mode identifier
  • the application service entity When the authentication mode is identified as an early common authentication framework authentication mode, the application service entity obtains the IP address of the Early IMS terminal and the binding of the user identity thereof from the HSS by performing an entity BSF for initial authentication of the user identity. Information.
  • the process for the application service entity to obtain the binding information of the IP address of the Early IMS terminal and its user identity from the HSS through the BSF includes the following steps:
  • the application service entity sends a message requesting authentication information to the BSF, where the request message includes a user identity, and after receiving the request, the BSF requests the HSS for the IP address of the Early IMS terminal and its user identity according to the user identity in the request.
  • the binding information is identified, and the obtained binding information is directly returned to the application service entity, and the application service entity saves the received binding information.
  • the message that the BSF requests the binding information from the HSS includes an authentication scheme field, and the authentication scheme field indicates the early IMS.
  • the BSF is an early Early-BSF with only query function, or supports BSF with full 3G capability and Early-BSF capability.
  • the application service entity requests the binding information from the HSS through the BSF
  • the application service entity and the HSS that has saved the binding information belong to the same or different home network.
  • the access request initiated by the Early IMS terminal further includes an authentication mode identifier
  • the application service entity When the authentication mode is identified as the direct authentication mode, the application service entity directly sends a binding information request message to the HSS, and receives and saves the binding information of the IP address of the Early IMS terminal and the user identity of the returned by the HSS. .
  • the request message sent by the application service entity to the HSS is carried by the user data request UDR message, and the attribute information in the message indicates the request binding information; the response message returned by the HSS to the application service entity is answered by the user data UDA The message is carried, and the attribute information in the message indicates the request binding information.
  • the application service entity directly requests the binding information from the HSS
  • the application service entity and the HSS that has saved the binding information belong to the same home network.
  • the access request initiated by the Early IMS terminal to the application service entity is carried by the HTTP GET-based request message HTTP GET;
  • the authentication mode identifier in the request message is carried by a user agent user agent field in the HTTP GET.
  • the user identity identifier in the access request is a user public identity identifier IMPU;
  • the binding information of the IP address of the Early IMS terminal and the user identity of the application service entity obtained from the HSS is: a correspondence between an IMPU included in the access request and an IP address of the Early IMS terminal; or an initiation connection Correspondence between all IMPUs owned by the requested Early IMS terminal and the IP address of the Early IMS terminal.
  • the application service entity further includes: determining whether the binding information corresponding to the user identity in the access request exists in the application service entity, and if yes, acquiring the binding Determining the information, and continuing to perform the authentication operation; otherwise, continuing to perform the operation of acquiring the binding information from the HSS.
  • the method further comprises: establishing a transport layer secure TLS tunnel between the Early IMS terminal and the application service entity, and then performing an operation of the Early IMS terminal to initiate an access request to the application service entity.
  • the authentication system of the present invention includes: an Early IMS terminal, an application service entity, and a user home network server HSS, where
  • the Early IMS terminal obtains an IP address after accessing the third-generation 3G mobile communication system, and the terminal is configured to initiate an access request including the user identity to the application service entity;
  • the application service entity is configured to receive an access request from the Early IMS terminal, and notify the HSS to provide the binding information formed by the IP address of the Early IMS terminal and the user identity, and the binding request and the access request are performed according to the binding information.
  • the Early IMS terminal performs authentication;
  • the HSS is configured to return the binding information formed by the IP address of the Early IMS terminal and the user identity to the application service entity according to the notification of the application service entity.
  • the Early IMS terminal includes:
  • the link establishing module is configured to initiate an access request including the user identity to the application service entity.
  • the Early IMS terminal further includes:
  • the service communication module is configured to receive a notification about authentication through the link establishment module, and perform service communication with the application service entity.
  • the application service entity includes: receiving a request module and a security information request and Check module, where
  • the receiving request module is configured to receive an access request from the Early IMS terminal, notify the security information requesting and checking module to obtain the binding information formed by the IP address of the terminal and the user identity, and receive the request from the security information request and the checking module.
  • the security information requesting and checking module is configured to request and receive the binding information formed by the HSS providing the IP address of the terminal and the user identity according to the obtained IP address of the terminal and the identity of the user identity according to the notification of the receiving request module.
  • the information is matched with the IP address and the user identity of the Early IMS terminal that initiated the access request, the terminal is authenticated, and the authentication result is sent to the receiving request module.
  • the security information requesting and checking module is further configured to save the binding information formed by the IP address and the user identity of the terminal provided by the HSS, and after receiving the access request from the Early IMS terminal, Determining whether there is binding information corresponding to the user identity in the access request, and directly performing authentication in the presence of the binding information; and requesting and receiving the HSS in the absence of the binding information Bind information.
  • the service application entity further includes:
  • the service communication module is configured to receive an authentication result from the receiving request module, and perform service communication with the Early IMS terminal when the terminal passes the authentication.
  • the HSS includes: a security binding information storage module, configured to hold binding information composed of an IP address of the Early IMS terminal and its user identity, and find Early in itself according to the notification from the application service entity. Binding information corresponding to the IMS, and returning the found binding information to the application service entity.
  • a security binding information storage module configured to hold binding information composed of an IP address of the Early IMS terminal and its user identity, and find Early in itself according to the notification from the application service entity. Binding information corresponding to the IMS, and returning the found binding information to the application service entity.
  • the system further comprises:
  • the BSF with the Early-BSF function is configured to receive a notification from the application service entity regarding the binding information of the IP address and the user identity requesting to provide the Early IMS terminal, forward the notification to the HSS, and receive the HSS from the HSS. IP of the Early IMS terminal The binding information formed by the address and the user identity is forwarded to the application service entity.
  • the application service entity is an application server AS or an application server proxy AP.
  • the key point of the present invention is: after receiving the access request containing the user identity from the Early IMS terminal, the application service entity obtains the IP address of the Early IMS terminal from the HSS according to the user identity in the access request and Binding information of the user identity; Afterwards, the application service entity authenticates the Early IMS terminal according to the binding information of the obtained Early IMS terminal's IP address and its user identity and the access request.
  • the Early IMS terminal directly accessing the application service entity is authenticated, which ensures that the legitimate user can access and ensures the security of the network. Especially for early application of IMS-based services, it can be deployed and run normally.
  • Embodiment 1 is a schematic flow chart showing Embodiment 1 of the present invention.
  • FIG. 2 is a schematic flow chart of a second embodiment to which the present invention is applied;
  • FIG. 3 is a schematic structural diagram of an authentication system to which an embodiment of the present invention is applied.
  • FIG. 4 is a schematic structural diagram of an authentication system to which another embodiment of the present invention is applied. Mode for carrying out the invention
  • the method for authenticating a user terminal is applicable to an Early IMS terminal that directly accesses an application service entity, and the Early IMS terminal obtains after accessing the 3GPP network. IP address, the method includes the following steps:
  • the Early IMS terminal initiates an access request to the application service entity, where the request includes a user identity, and the application service entity obtains, from the HSS, the binding of the IP address of the Early IMS terminal and its user identity according to the received access request. Determining information, and authenticating the Early IMS terminal according to the binding information and the access request.
  • the method of the present invention will be described in detail below by taking the Early IMS terminal as a 2G user terminal as an example.
  • FIG. 1 is a schematic flow chart showing a first embodiment of the present invention.
  • the UE of the 2G has accessed the 3GPP packet domain, and obtains the IP address assigned by the packet network gateway node (GGSN) of the packet network, and the GGSN uses the telephone number (MSISDN) of the user of the UE,
  • MSISDN packet network gateway node
  • IMSI International Mobile Subscriber Identity
  • the information about the International Mobile Subscriber Identity (IMSI) and the IP address of the packet domain is sent to the HSS.
  • the HSS finds the user identity IMPI of the user in the IMS system through the MSISDN or IMSI of the user, and the IMPI of the UE, the IMPI.
  • the corresponding user's public identity (IMPU), MSISD, and the IP address of the UE are bound and saved.
  • This embodiment uses a 2G UE to access the AS as an example for description.
  • Step 101 The UE of the 2G initiates an access request to the AS, where the request includes the user identity of the UE, such as an IMPU; the request message further includes an authentication mode identifier supported by the UE, and the existing Http-based protocol is used.
  • the Ut interface can use the user agent field in the Http GET message to carry the authentication mode identifier.
  • the authentication mode supported by the 2G UE is the Ut interface authentication mode used in the early application of the GAA.
  • the identifier of the authentication mode is recorded as an early universal authentication framework authentication method (Early-GAA-Ut), then the authentication mode identifies the user that Early-GAA-Ut will be added in the Http message. In the agent field.
  • the AS determines, according to the received access request, that the authentication mode identifier in the request message is Early-GAA-Ut, and determines whether there is binding information corresponding to the user identity in the access request, and if yes, The binding information is obtained by itself, and the process proceeds to step 106; otherwise, in step 102, the AS sends a message requesting authentication information to the entity (BSF) that performs the initial authentication of the user identity, where the message includes the user identity.
  • the BSF in this step can be an Early-BSF with only the query function, or a BSF with Full 3G function and Earl y-BSF function.
  • the AS Since the AS requests the authentication information from the BSF during the execution of the 3G GAA, the AS needs to carry the BSF-assigned user session identifier (B-TID), and in the Early-GAA-Ut authentication mode, there is no BSF-assigned B. -TID, so for a BSF that supports the full 3G function and has the Early-BSF function, after receiving the message requesting authentication information from the AS, it can determine whether the message carries the B-TID or the user identity. The distinction is whether the normal 3G GAA authentication method or the Early-GAA-Ut authentication authentication method.
  • B-TID BSF-assigned user session identifier
  • Step 103 After receiving the message requesting the authentication information of the AS, and determining that the request carries the user identity, the BSF requests the HSS to bind the IP address of the UE and the binding identifier of the user identity.
  • the request information also includes the user identity of the UE, and the message requesting the binding information to the HSS includes an authentication scheme field, and the authentication scheme field indicates the early IMS.
  • Step 104 The HSS queries the binding information required by the BSF according to the user identity identifier in the received request information, and returns the binding information to the BSF.
  • the process of the HSS querying the binding information is: the HSS searches for the IMPI corresponding to the IMPU and the IP address corresponding to the IMPI through the received IMPU.
  • the returned binding information refers to the correspondence between the IMPU and the IP address of the UE.
  • the binding information returned by the HSS is the binding information of the IMPI and the IP address or the binding information of the IMSI and the IP address, or returns the required IMPI and/or IMPU and the IP address of the user terminal according to the needs of the network system to which the application is applied.
  • Binding information That is to say, the binding information returned by the HSS is the correspondence information between the user identity of the UE that initiated the request and the IP address currently owned by the UE.
  • Step 105 After receiving the binding information, the BSF does not save but directly forwards the binding information to the AS.
  • the advantage of the BSF is that when the AS requests the binding information from the BSF again, the BSF needs to go to the HSS to query. This ensures that the information returned by the BSF to the AS is always up to date.
  • Step 106 The AS authenticates the 2G terminal according to the obtained binding information and the access request.
  • the method for authenticating here may be: the AS determines whether the binding information of the IP address of the UE and its user identity saved by the AS matches the IP address and the user identity of the UE that initiated the access request, that is, whether they are identical. If the match is met, the 2G UE passes the authentication, otherwise the 2G UE cannot pass the authentication.
  • the authentication method may also be: the AS determines whether the IP address in the binding information matches the IP address of the 2G UE that initiates the access request, and if yes, the 2G UE passes the authentication, otherwise the 2G UE Cannot pass authentication.
  • the GGSN will notify the HSS to update the binding information or delete the binding information.
  • the HSS does not need to notify the BSF, because usually after the IP address changes or logs off, the connection-based application layer protocol will be disconnected and the connection will be re-established later, and the AS disconnects.
  • the saved binding information will be deleted.
  • the AS will re-request the binding information to the BSF.
  • the AS that receives the access request and the HSS that has saved the binding information may belong to the same home network, or may belong to different home networks.
  • FIG. 2 is a schematic flow chart showing the application of the second embodiment of the present invention.
  • the UE has accessed the 3GPP packet domain and obtained the IP address assigned by the GGSN.
  • the GGSN sends the MSISDN, IMSI and IP address of the UE to the HSS.
  • the HSS finds the user in the IMS through the MSISDN or IMSI of the user.
  • the user identity in the system identifies the IMPI, and binds and stores the IMPI of the UE, the public identity (IMU) of the user corresponding to the IMPI, the MSISDN, and the IP address of the UE.
  • IMU public identity
  • Step 201 The UE of the 2G initiates an access request to the AS, where the request includes the user identity of the UE itself, such as an IMPU.
  • the message of the request further includes an authentication mode identifier supported by the UE.
  • the Ut interface can use the user agent field in the Http GET message to carry the authentication mode identifier.
  • the authentication mode supported by the 2G UE is a direct reference of the Sh interface between the application AS and the HSS.
  • Right mode, here, the identifier of the authentication mode is recorded as a direct authentication mode (Ut-Sh-Authentication), then the authentication mode identifier Ut-Sh-Authentication will be added in the user agent field in the Http message. .
  • the AS determines, according to the received access request, that the authentication mode identifier in the request message is Ut-Sh-Authentication, it determines whether there is binding information corresponding to the user identity in the access request, and if yes, The binding information is obtained by itself, and the process proceeds to step 204. Otherwise, in step 202, the AS sends a message requesting the IP address of the UE and its user identity binding information to the HSS through the Sh interface.
  • the request message sent by the AS to the HSS also contains the user identity information.
  • the request message sent by the AS to the HSS through the Sh interface is carried by a User Data Request (UDR) message, and the attribute information Avp ( Attribute-Value Pair ) in the request message is used to describe the requesting user. What kind of data.
  • the address binding information is requested through the Sh interface by adding an Avp attribute that requires binding of the address information.
  • Step 203 The HSS queries the binding information required by the AS according to the user identity identifier in the received request information, and returns the binding information directly to the AS.
  • the HSS uses a User Data Answer (UDA, User-Data-Answer) message in the Sh interface as a response message to the UDR message.
  • UDA User Data Answer
  • the Avp attribute information added in step 202 is also used in the UDA message.
  • the process of the HSS querying the binding information is: the HSS searches for the IMPI corresponding to the IMPU and the IP address corresponding to the IMPI through the received IMPU.
  • the returned binding information refers to the correspondence between the IMPU and the IP address of the UE.
  • the binding information returned by the HSS is the binding information of the IMPI and the IP address or the binding information of the IMSI and the IP address, or according to the applied
  • the network system needs to return information about the required IMPI and/or the binding of the IMPU to the IP address of the user terminal. That is to say, the binding information returned by the HSS is the correspondence information of the user identity of the UE that initiated the request and the IP address currently owned by the UE.
  • Step 204 The AS authenticates the 2G terminal according to the obtained binding information and the access request.
  • the authentication method may be: the AS determines whether the acquired IP address of the UE and the binding information of the user identity match the IP address and the user identity of the UE that initiated the access request, that is, whether they are identical. If the match is met, the 2G UE passes the authentication, otherwise the 2G UE cannot pass the authentication.
  • the AS may perform authentication only according to whether the IP address in the binding information is the same as the IP address of the UE that initiates the access request.
  • the GGSN will notify the HSS to update the binding information or delete the binding information.
  • the HSS does not need to notify the AS, because usually after the IP address changes or logs off, the connection-based application layer protocol will be disconnected and the connection will be re-established later.
  • the AS will delete the saved binding information after the connection is disconnected.
  • the UE re-establishes the connection, the AS will re-request the binding information to the HSS.
  • the AS that receives the access request and the HSS that has saved the binding information must belong to the same home network.
  • the correspondence between the user's public identity IMPU and the private identity IMPI is a many-to-one relationship. Therefore, for the above two embodiments, when the HSS returns the binding information, the IMPI may also be returned. Binding information of all IMPUs to the IP address of the UE. The advantage of this is that after the UE connects to the AS, the subsequent messages may change to use other IMPUs, so the AS can save the correspondence between all IMPUs of the UE and the IP address.
  • Such a process is particularly useful when the AS in the above embodiment is replaced by an AP, because the AP can have multiple ASs behind it, and the AP performs the authentication function for the ASs, and the UE uses the request when sending requests to different ASs.
  • the IMPU is likely to be different.
  • the application service entity can also perform the authentication operation directly after receiving the binding information from the HSS without saving.
  • the UE and the AS may first establish a transport layer security (TLS Transport Layer Security) tunnel based on transport layer protection. Since TLS is a transport layer protection protocol, after the tunnel is established, it is executed.
  • TLS Transport Layer Security
  • the application layer-based authentication process can ensure sufficient security protection for application layer communication between the UE and the AS.
  • the above embodiments all allow the network side to adapt to the UE, that is, enable the network side to authenticate the 2G UE.
  • the UE can also be adapted to the network side, that is, the 2G user can load a software module, so that the 2G UE can fully support the 3G function, that is, the 2G UE can support the 3G authentication mode.
  • the network side can still authenticate the UE by using a standard 3G authentication mode.
  • the software module can be downloaded from the Internet or directly from the operator.
  • the authentication mode in the foregoing embodiments may be applied when the UE of the 2G UE directly accesses the AS, or may be applied to the message sent by the UE that is accessed by the UE.
  • the present invention also provides an authentication system capable of authenticating an Early IMS terminal that directly accesses an application service entity.
  • Figure 3 illustrates an embodiment of an authentication system.
  • the authentication system includes: an Early IMS terminal, an application service entity, and an HSS.
  • the Early IMS terminal obtains an IP address after accessing the 3G mobile communication system, the terminal is configured to initiate an access request including the user identity to the application service entity, and the application service entity is configured to receive the access request from the Early IMS terminal.
  • the HSS notifying the HSS to provide the binding information formed by the IP address of the Early IMS terminal and the user identity, and authenticating the Early IMS terminal according to the binding information and the access request; the HSS is used according to the application service entity.
  • the notification returns the binding information formed by the IP address of the Early IMS terminal and the user identity to the application service entity.
  • the Early IMS terminal in FIG. 3 includes a link establishment module for initiating an access request including a user identity to an application service entity. Further, the terminal further includes a service communication module, configured to receive, by the link establishment module, a notification about the authentication by the application service entity, and perform service communication with the application service entity.
  • the application service entity includes a receiving request module and a security information request and checking module. among them
  • the receiving request module is configured to receive an access request from the Early IMS terminal, notify the security information requesting and checking module to obtain the binding information formed by the IP address and the user identity of the terminal, and receive the information from the security information request and the checking module.
  • the security information request and check module is configured to request and receive the binding information formed by the HSS providing the IP address of the terminal and the user identity according to the notification of the receiving request module, according to the obtained IP address of the terminal and the user thereof.
  • the binding information of the identity and the access request are used to authenticate the terminal, and the authentication result is sent to the receiving request module.
  • the security information requesting and checking module can also save the binding information formed by the IP address and the user identity of the terminal provided by the HSS in itself, and determine the self after receiving the access request from the Early IMS terminal. Whether the binding information corresponding to the user identity in the access request exists, and if the binding information exists, the authentication is directly performed; if the binding information does not exist, the binding provided by the HSS is requested and received. information.
  • the service application entity further includes a service communication module, configured to receive an authentication result from the receiving request module, and perform service communication with the Early IMS terminal when the terminal passes the authentication.
  • the HSS includes a security binding information storage module, configured to store the binding information formed by the IP address of the Early IMS terminal and its user identity, and find the binding information corresponding to the Early IMS according to the notification from the application service entity. And return the found binding information to the application business entity.
  • Fig. 4 shows still another embodiment of the authentication system of the present invention.
  • the authentication system in this embodiment differs from FIG. 3 in that a BSF having an Early-BSF function is added.
  • the BSF is configured to receive a notification from the application service entity regarding the binding information of the IP address and the user identity requesting to provide the Early IMS terminal, forward the notification to the HSS, and receive the IP of the Early IMS terminal from the HSS.
  • the binding information formed by the address and the user identity is forwarded to the application service entity.
  • the above-mentioned Early IMS terminal and the application service entity may not include the service communication module.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

对用户终端进行鉴权的方法及鉴权系统
技术领域
本发明涉及移动通信技术领域， 特别是指对直接接入应用业务实体 的 Early IMS终端进行鉴权的方法及鉴权系统。 发明背景
随着宽带网络的发展， 移动通信不仅仅局限于传统的话音通信， 通 过与呈现业务（presence )、 短消息、 网页 （ WEB )浏览、 定位信息、 推 送业务（PUSH ) 以及文件共享等数据业务的结合， 移动通信能够实现 音频、 视频、 图片和文本等多种媒体类型的业务， 以满足用户的多种需 求。
第三代移动通信标准化伙伴项目 ( 3GPP )以及第三代移动通信标准 化伙伴项目 2 ( 3GPP2 )等组织都先后推出了基于 IP 的多媒体子系统 ( IMS )架构， 其目的是在移动网络中使用一种标准化的开放结构来实 现多种多样的多媒体应用， 以给用户提供更多的选择和更丰富的感受。
IMS 架构叠加在分组域网络 ( PS-Domain )之上， 其与鉴权相关的 实体包括呼叫状态控制功能（ CSCF )实体和归属签约用户服务器（ HSS ) 功能实体。 CSCF又可以分成服务 CSCF( S-CSCF ) 代理 CSCF( P-CSCF ) 和查询 CSCF ( I-CSCF )三个逻辑实体， 该三个逻辑实体可以是不同的 物理设备， 也可以是同一个物理设备中不同的功能模块。 其中， S-CSCF 是 IMS的业务控制中心， 用于执行会话控制， 维持会话状态， 管理用户 信息， 产生计费信息等； P-CSCF是终端用户接入 IMS的接入点， 用于 完成用户注册， 服务 量（QoS )控制和安全管理等； I-CSCF负责 IMS 域之间的互通， 管理 S-CSCF的分配， 对外隐藏网络拓朴结构和配置信 息， 并产生计费数据等。 HSS是非常重要的用户数据库， 用于支持各个 网络实体对呼叫和会话的处理。
IMS在初始推出时， 即 R5 版本协议只考虑在第三代移动通信网络 中使用。 由于 IMS上的业务非常丰富， 所以出现了运营商在 2G的网络 上使用 IMS的需求。 但在 2G的网络上无法支持基于 3G网络的 IMS的 安全相关功能， 例如五元组鉴权 /网络认证等， 为解决 2G用户使用 IMS 网络面临的用户鉴权问题， 3GPP提出了一种过渡鉴权方案， 该方案为 2G上的 IMS业务提供一定的安全功能。 当用户支持 3G鉴权方案时， 再采用完整的基于 3G的鉴权方案对接入用户进行鉴权。 这样， 无论是 2G用户还是 3G用户， 都可以在鉴权通过后应用 IMS中的业务。 通常， 将完整的基于 3G的鉴权方案称为 Full 3GPP IMS鉴权方式，将过渡鉴权 方案称为 Early IMS的鉴权方式，并且将支持 Early IMS的终端称为 Early IMS终端。
对于任何一个 2G或 3G的 UE,其既可以使用基于 IMS的应用服务 器（AS )所提供的业务， 如使用 presence业务， 也可以对基于 IMS的 AS或 AS的代理（ AP )进行一些简单的管理操作， 如管理 AS或 AP上 的一些組列表 ( group list )信息等。
当 UE需要使用基于 IMS的 AS所提供的业务时， 其需要首先接入 3GPP分组域， 然后经过 IMS的鉴权后才能使用 AS所提供的业务。 此 时，对于 Early IMS的 UE, IMS将使用 Early IMS的鉴权方式进行鉴权； 对于 3G的 UE, IMS将使用 Full 3GPP IMS的鉴权方式进行鉴权。
当 UE需要对基于 IMS的 AS或通过 AP对 AS进行管理操作时，其 仍然要首先接入 3GPP分组域， 然后该 UE可通过 Ut接口直接接入 AS 或 AP, 因而 IMS不再对该 UE进行鉴权。 同时在现有的协议中规定， 该直接接入 AS或 AP的 UE采用通用鉴权框架（GAA )的方式鉴权后， 才能接入 AS或 AP。
但是， 现有的基于通用鉴权框架（GAA ) 的鉴权方式是针对 3G用 户终端的，其不支持对诸如 2G用户终端的 Early IMS终端的鉴权，这样， 必然会存在这样的情况： Early IMS终端不能接入或 Early IMS终端不需 鉴权就可直接接入。
如果不让 Early IMS终端接入， 不但使运营商损失很多业务， 还会 导致用户对运营商的满意度下降。
如果 Early IMS终端不需鉴权就可直接接入，显然无法保证 AS和整 个网络的安全。 发明内容
有鉴于此， 本发明的一个目的在于提供一种对用户终端进行鉴权的 方法， 以对直接接入应用业务实体的 Early IMS终端实现鉴权。
为达到上述目的， 本发明的技术方案是这样实现:
一种对用户终端进行鉴权的方法， 适用于直接接入应用业务实体的 Early IMS终端， 所述 Early IMS终端接入第三代 3G移动通信系统后获 取 IP地址， 该方法还包括以下步骤：
Early IMS终端向应用业务实体发起接入请求，该请求中包含用户身 份标识， 应用业务实体根据接收到的接入请求， 从归属网络服务器 HSS 获取由该 Early IMS终端的 IP地址及其用户身份标识构成的绑定信息， 并才艮据所述绑定信息与所述接入请求对所述 Early IMS终端进行鉴权。
较佳地， 根据所述绑定信息与所述接入请求对所述 Early IMS终端 进行鉴权的过程包括：
应用业务实体判断所述绑定信息中的 IP 地址与发起接入请求的 Early IMS终端的 IP地址是否相匹配， 如果匹配， 则该 Early IMS终端 通过鉴权， 否则该 Early IMS终端不能通过鉴权。
较佳地， 根据所述绑定信息与所述接入请求对所述 Early IMS终端 进行鉴权的过程包括：
应用业务实体判断获取到的该 Early IMS终端的 IP地址及其用户身 份标识的绑定信息， 与发起接入请求的 Early IMS终端的 IP地址及用户 身份标识是否相匹配， 如果匹配， 则该 Early IMS终端通过婆权， 否则 该 Early IMS终端不能通过鉴权。
较佳地， 当所述应用业务实体从 HSS获取由该 Early IMS终端的 IP 地址及其用户身份标识构成的绑定信息后， 还包括： 将所述绑定信息进 行保存。
较佳地， 所述 Early IMS终端发起的接入请求中还包括鉴权方式标 识，
所述鉴权方式标识为早期的通用鉴权框架鉴权方式时， 所述应用业 务实体通过执行用户身份初始检查验证的实体 BSF从 HSS获取该 Early IMS终端的 IP地址及其用户身份标识的绑定信息。
较佳地，所述应用业务实体通过 BSF从 HSS获取该 Early IMS终端 的 IP地址及其用户身份标识的绑定信息的过程包括以下步骤：
应用业务实体向 BSF发送请求鉴权信息的消息，该请求消息中包含 用户身份标识， BSF 接收到该请求后， 根据请求中的用户身份标识向 HSS请求该 Early IMS终端的 IP地址及其用户身份标识的绑定信息， 并 将得到的绑定信息直接返回给应用业务实体, 应用业务实体保存接收到 的绑定信息；
所述 BSF向 HSS请求绑定信息的消息中包含鉴权方案字段， 该鉴 权方案字段指示为 early IMS。
较佳地， 所述 BSF为早期的仅具备查询功能的 Early-BSF, 或支持 完全 3G功能且具备 Early-BSF功能的 BSF。
较佳地， 当所述应用业务实体通过 BSF向 HSS请求绑定信息时， 所述应用业务实体与已保存绑定信息的 HSS 属于相同或不同的归属网 络。
较佳地， 所述 Early IMS终端发起的接入请求中还包括鉴权方式标 识，
所述鉴权方式标识为直接鉴权方式时， 所述应用业务实体直接向 HSS发送绑定信息请求消息，接收并保存 HSS返回的该 Early IMS终端 的 IP地址及其用户身份标识的绑定信息。
较佳地，所述应用业务实体向 HSS发送的请求消息由用户数据请求 UDR消息承载，且该消息中的属性信息指明请求绑定信息； HSS给应用 业务实体返回的响应消息由用户数据应答 UDA消息承载， 且该消息中 的属性信息指明请求绑定信息。
较佳地， 当所述应用业务实体直接向 HSS请求绑定信息时， 所述应 用业务实体与已保存绑定信息的 HSS属于相同的归属网络。
较佳地， 所述 Early IMS终端向应用业务实体发起的接入请求由基 于 HTTP协议的请求消息 HTTP GET承载；
所述请求消息中的鉴权方式标识由 HTTP GET 中的用户代理 user agent字段承载。
较佳地， 所述接入请求中的用户身份标识为用户公共身份标识 IMPU;
所述应用业务实体从 HSS获取的该 Early IMS终端的 IP地址及其用 户身份标识的绑定信息为： 接入请求中所包含的 IMPU和该 Early IMS 终端的 IP地址的对应关系； 或发起接入请求的 Early IMS终端所拥有的 所有 IMPU和该 Early IMS终端的 IP地址的对应关系。 较佳地， 所述应用业务实体接收到接入请求之后， 进一步包括： 判断该应用业务实体中是否存在所述接入请求中的用户身份标识对 应的绑定信息， 如果是， 则获取该绑定信息， 并继续执行所述鉴权操作； 否则， 继续执行所述从 HSS获取绑定信息的操作。
较佳地，该方法进一步包括： Early IMS终端与应用业务实体之间建 立传输层安全 TLS隧道， 然后再执行所述 Early IMS终端向应用业务实 体发起接入请求的操作。
本发明的又一目的在于：提供一种对用户终端进行鉴权的鉴权系统， 以对直接接入应用业务实体的 Early IMS终端实现鉴权。
为达到上述目的， 本发明的鉴权系统包括： Early IMS终端、应用业 务实体和用户归属网络服务器 HSS, 其中，
Early IMS终端在接入第三代 3G移动通信系统后获取 IP地址， 该 终端用于向应用业务实体发起包含用户身份标识的接入请求;
应用业务实体用于接收来自于 Early IMS终端的接入请求，通知 HSS 提供 Early IMS终端的 IP地址及用户身份标识构成的绑定信息， 并根据 所述绑定信息与所述接入请求对所述 Early IMS终端进行鉴权；
HSS用于根据应用业务实体的通知， 将 Early IMS终端的 IP地址及 用户身份标识构成的绑定信息返回给应用业务实体。
较佳地， 所述 Early IMS终端包括：
链接建立模块， 用于向应用业务实体发起包含用户身份标识的接入 请求。
较佳地， 所述 Early IMS终端进一步包括：
业务通信模块， 用于接收来自于链接建立模块的关于通过鉴权的通 知， 并与应用业务实体进行业务通信。
较佳地， 所述应用业务实体包括： 接收请求模块和安全信息请求及 检查模块， 其中，
接收请求模块用于接收来自于 Early IMS终端的接入请求， 通知安 全信息请求及检查模块获取该终端的 IP地址及用户身份标识构成的绑 定信息， 接收来自于安全信息请求及检查模块的養权结果；
安全信息请求及检查模块用于根据接收请求模块的通知， 请求并接 收 HSS提供该终端的 IP地址及用户身份标识构成的绑定信息根据所获 取的该终端的 IP 地址及其用户身份标识的绑定信息与发起接入请求的 Early IMS终端的 IP地址及用户身份标识是否相匹配， 对该终端进行鉴 权， 并将鉴权结果发送给接收请求模块。
其中，所述安全信息请求及检查模块进一步用于对所述 HSS提供的 该终端的 IP地址及用户身份标识构成的绑定信息进行保存，并且在接收 到来自于 Early IMS终端的接入请求后判断自身是否存在该接入请求中 用户身份标识对应的绑定信息， 在存在该绑定信息的情况下, 直接进行 鉴权；在不存在该绑定信息的情况下，请求并接收 HSS提供的绑定信息。
较佳地， 所述业务应用实体进一步包括：
业务通信模块， 用于接收来自于接收请求模块的鉴权结果, 并在该 终端通过鉴权时， 与 Early IMS终端进行业务通信。
较佳地，所述 HSS包括： 安全绑定信息存储模块,用于保存由 Early IMS终端的 IP地址及其用户身份标识构成的绑定信息，根据来自于应用 业务实体的通知， 在自身查找 Early IMS对应的绑定信息， 并将查找到 的绑定信息返回给应用业务实体。
较佳地， 所述系统进一步包括：
具有 Early-BSF功能的 BSF, 用于接收来自于应用业务实体的关于 请求提供 Early IMS终端的 IP地址及用户身份标识构成的绑定信息的通 知， 将该通知转发给 HSS， 并且接收来自于 HSS的 Early IMS终端的 IP 地址及用户身份标识构成的绑定信息， 将该绑定信息转发给应用业务实 体。
较佳地，所述应用业务实体为应用服务器 AS或应用服务器代理 AP。 本发明的关键之处在于： 应用业务实体接收到来自 Early IMS终端 的包含用户身份标识的接入请求后， 根据接入请求中的用户身份标识， 从 HSS获取该 Early IMS终端的 IP地址及其用户身份标识的绑定信息； 之后， 应用业务实体根据所获取该 Early IMS终端的 IP地址及其用户身 份标识的绑定信息与接入请求对 Early IMS终端进行鉴权。应用本发明， 实现了对直接接入应用业务实体的 Early IMS终端进行鉴杈， 既保证了 合法的用户能够接入， 又保证了网絡的安全。 特别对于早期应用的基于 IMS的业务， 能够正常部署和运行。 附图简要说明
下面将通过参照附图详细描述本发明的示例性实施例 , 使本领域的 普通技术人员更清楚本发明的上述及其它特征和优点， 附图中：
图 1所示为应用本发明的实施例一的流程示意图；
图 2所示为应用本发明的实施例二的流程示意图；
图 3所示为应用本发明的一个实施例的鉴权系统的结构示意图； 图 4所示为应用本发明的又一实施例的鉴权系统的结构示意图。 实施本发明的方式
为使本发明的目的、 技术方案更加清楚明白， 以下参照附图并举实 施例， 对本发明做进一步的详细说明。
依据本发明思想的对用户终端进行鉴权的方法， 适用于直接接入应 用业务实体的 Early IMS终端， Early IMS终端在接入 3GPP网络后获取 IP地址， 该方法包括以下步骤：
Early IMS终端向应用业务实体发起接入请求，该请求中包含用户身 份标识， 应用业务实体根据接收到的接入请求， 从 HSS获取由该 Early IMS终端的 IP地址及其用户身份标识构成的绑定信息，并根据所述绑定 信息与所述接入请求对所述 Early IMS终端进行鉴权。
下面以 Early IMS终端为 2G用户终端为例，对本发明的方法进行详 细说明。
图 1所示为应用本发明的实施例一的流程示意图。 在本实施例中， 2G 的 UE已接入到 3GPP分組域， 并获得分組网络的分組网络网关节 点（ GGSN )为其分配的 IP地址， 同时 GGSN将该 UE的用户的电话号 码（MSISDN )、 分组域的国际移动用户身份标识（IMSI )及 IP地址等 相关信息发送给 HSS, HSS通过用户的 MSISDN或 IMSI查找到用户在 IMS系统中的用户身份标识 IMPI, 并将该 UE的 IMPI、 该 IMPI所对应 的用户的公共身份标识 ( IMPU )、 MSISD 以及该 UE的 IP地址等信息 进行绑定保存。 本实施例以 2G的 UE接入 AS为例进行说明。
步骤 101 , 2G的 UE向 AS发起接入请求， 该请求中包含该 UE 自 身的用户身份标识， 如 IMPU; 该请求消息中还包含自身所支持的鉴权 方式标识, 在现有基于 Http协议的 Ut接口， 可以利用 Http GET消息中 的用户代理（user agent )字段来承载该鉴权方式标识， 在本实施例中， 该 2G的 UE所支持的鉴权方式为早期应用 GAA的 Ut接口认证方式， 在此， 将该鉴权方式的标识记为早期的通用鉴权框架鉴权方式 ( Early-GAA-Ut ),那么该鉴权方式标识 Early-GAA-Ut将被添在 Http消 息中的 user agent字段中。
另外， 如果 UE仿冒其他 UE的身份， 则在接入请求中携带的用户 身份标识不是该 UE的用户身份标识。 此后， AS根据接收到的接入请求，确定请求消息中的鉴权方式标识 为 Early-GAA-Ut后， 判断自身是否存在接入请求中用户身份标识对应 的绑定信息， 如果是， 则从自身获取该绑定信息， 并继续执行步骤 106; 否则， 执行步骤 102， AS向执行用户身份初始检查验证的实体（BSF ) 发送请求鉴权信息的消息，该消息中包含用户身份标识。本步骤中的 BSF 可以为早期的仅具备查询功能的 Early-BSF，也可以是支持完全 3G功能 且具有 Earl y-BSF功能的 BSF。
由于在 3G GAA的执行过程中， AS向 BSF请求鉴权信息时， 需要 携带 BSF分配的用户会话标识（B-TID ), 而在 Early-GAA-Ut鉴权方式 中是不存在 BSF分配的 B-TID的， 因此对于支持完全 3G功能且具备 Early-BSF功能的 BSF,其接收到来自 AS的请求鉴权信息的消息后， 可 以通过判断该消息中携带的是 B-TID还是用户身份标识来区分是正常 3G GAA的鉴权方式还是 Early-GAA-Ut的鉴权鉴权方式。
步骤 103 , BSF收到 AS的请求鉴权信息的消息， 并确定该请求中 携带的是用户身份标识后 , 向 HSS请求该 UE的 IP地址及其用户身份 标识的绑定信息。 该请求信息中同样包含 UE的用户身份标识， 并且， 该向 HSS请求绑定信息的消息中包含鉴权方案字段，且该鉴权方案字段 中指示为 early IMS。
步骤 104, HSS根据接收到的请求信息中的用户身份标识，查询 BSF 所需的绑定信息， 并将该绑定信息返回给 BSF。
通常 UE所发接入请求中的用户身份标识为 IMPU, 因此， HSS查 询绑定信息的过程为： HSS通过收到的 IMPU查找与该 IMPU所对应的 IMPI,以及与该 IMPI所对应的 IP地址，所述返回的绑定信息是指 IMPU 与该 UE的 IP地址的对应关系。
如果发起接入请求的 UE所携带的用户身份标识是 IMPI或 IMSI， 则 HSS返回的绑定信息是 IMPI与 IP地址的绑定信息或 IMSI与 IP地址 的绑定信息， 或根据其所应用的网络系统的需要返回需要的 IMPI和 /或 IMPU与该用户终端 IP地址的绑定的信息。 也就是说， HSS所返回的绑 定信息是发起请求的 UE的用户身份标识与该 UE当前所拥有 IP地址的 对应信息。
步驟 105， BSF收到该绑定信息后， 不进行保存而是将该绑定信息 直接转发给 AS, 这样做的好处是当 AS再次向 BSF请求绑定信息时， BSF需要到 HSS去查询，从而保证了 BSF返回给 AS的信息总是最新的。
步骤 106， AS根据获取到的绑定信息与接入请求， 对 2G终端进行 鉴权。
这里鉴权的方法可以为： AS判断自身保存的该 UE的 IP地址及其 用户身份标识的绑定信息与该发起接入请求的 UE的 IP地址及用户身份 标识是否相匹配， 即是否完全相同， 如果匹配， 则该 2G的 UE通过鉴 权， 否则该 2G的 UE不能通过鉴权。 该鉴权方法也可以为： AS判断绑 定信息中的 IP地址与发起接入请求的 2G的 UE的 IP地址是否相匹配， 如果匹配， 则该 2G的 UE通过鉴权， 否则该 2G的 UE不能通过鉴权。
对于上述实施例， ^ UE的 IP地址改变或注销后， GGSN将通知 HSS更新该绑定信息或删除该绑定信息。而当 HSS所保存的绑定信息变 化后， HSS不需要通知 BSF， 因为通常在 IP地址变化或注销后， 基于 连接的应用层协议就会断开并在以后重新建立连接， AS 在连接断开后 将删除保存的绑定信息， 当 UE重新建立连接时， AS会重新向 BSF请 求绑定信息。
对于上述实施例， 接收到接入请求的 AS与已保存绑定信息的 HSS 可以属于同一归属网络， 也可以属于不同的归属网络。
图 2所示为应用本发明的实施例二的流程示意图。 在本实施例中， UE已接入到 3GPP分组域， 并获得 GGSN为其分配的 IP地址， 同时 GGSN将该 UE的 MSISDN、 IMSI及 IP地址等相关信息发送给 HSS, HSS通过用户的 MSISDN或 IMSI查找到用户在 IMS系统中的用户身份 标识 IMPI， 并将该 UE的 IMPI、 该 IMPI所对应的用户的公共身份标识 ( IMPU )、 MSISDN以及该 UE的 IP地址等信息进行绑定保存。 本实施 例以 2G的 UE接入 AS为例进行说明。
步驟 201 , 2G的 UE向 AS发起接入请求， 该请求中包含该 UE自 身的用户身份标识， 如 IMPU; 该请求的消息中还包含自身所支持的鉴 权方式标识， 在现有基于 Http协议的 Ut接口， 可以利用 Http GET消息 中的 user agent字段来承载该鉴权方式标识， 在本实施例中， 该 2G的 UE所支持的鉴权方式为应用 AS与 HSS之间 Sh接口的直接鉴权方式, 在此， 将该鉴权方式的标识记为直接鉴权方式 ( Ut-Sh- Authentication )， 那么该鉴权方式标识 Ut-Sh- Authentication将被添在 Http消息中的 user agent字段中。
之后， AS根据接收到的接入请求，确定请求消息中的鉴权方式标识 为 Ut-Sh-Authentication后， 判断自身是否存在接入请求中用户身份标识 对应的绑定信息， 如果是， 则从自身获取该绑定信息， 并继续执行步骤 204; 否则， 执行步骤 202, AS通过 Sh接口向 HSS发送请求该 UE的 IP地址及其用户身份标识绑定信息的消息。
AS向 HSS发出的请求消息中同样包含用户身份标识信息。 通常， AS 通过 Sh接口向 HSS 发送的请求消息由用户数据请求 （UDR, User-Data-Request ) 消息来承载， 且通过该请求消息中的属性信息 Avp ( Attribute- Value Pair )来描述请求用户的何种数据。 在本实施例中， 通 过增加要求绑定地址信息的 Avp属性， 来实现通过 Sh接口请求地址绑 定信息。 步骤 203， HSS根据接收到的请求信息中的用户身份标识， 查询 AS 所需的绑定信息， 并将该绑定信息直接返回给 AS。 通常， HSS在 Sh接 口中使用用户数据应答（ UDA, User-Data-Answer )消息作为 UDR消息 的响应消息。 在本实施例中， 由于是对请求绑定消息的响应， 因此该 UDA消息中也使用步骤 202中增加的 Avp属性信息。
通常 UE所发接入请求中的用户身份标识为 IMPU, 因此， HSS查 询绑定信息的过程为： HSS通过收到的 IMPU查找与该 IMPU所对应的 IMPI,以及与该 IMPI所对应的 IP地址，所述返回的绑定信息是指 IMPU 与该 UE的 IP地址的对应关系。
如果发起接入请求的 UE所携带的用户身份标识是 IMPI或 IMSI, 则 HSS返回的绑定信息是 IMPI与 IP地址的绑定信息或 IMSI与 IP地址 的绑定信息， 或根据其所应用的网络系统的需要返回需要的 IMPI和 /或 IMPU与该用户终端 IP地址的绑定的信息。 也就是说， HSS所返回的绑 定信息是发起请求的 UE的用户身份标识与该 UE当前所拥有 IP地址的 对应信息。
步骤 204, AS根据获取到的绑定信息与接入请求， 对 2G终端进行 鉴权。
这里鉴权的方法可以为: AS判断获取到的该 UE的 IP地址及其用 户身份标识的绑定信息与该发起接入请求的 UE的 IP地址及用户身份标 识是否相匹配， 即是否完全相同， 如果匹配， 则该 2G的 UE通过鉴权， 否则该 2G的 UE不能通过鉴权。 当然与具体实施例 1相同， AS也可以 仅根据绑定信息中的 IP地址与发起接入请求的 2G的 UE的 IP地址是否 相同进行鉴权。
对于上述实施例， 当 UE的 IP地址改变或注销后， GGSN将通知 HSS更新该绑定信息或删除该绑定信息。而当 HSS所保存的绑定信息变 化后， HSS不需要通知 AS, 因为通常在 IP地址变化或注销后， 基于连 接的应用层协议就会断开并在以后重新建立连接， AS 在连接断开后将 删除保存的绑定信息， 当 UE重新建立连接时， AS会重新向 HSS请求 绑定信息。
对于上述实施例， 接收到接入请求的 AS与已保存绑定信息的 HSS 必须属于同一归属网络。
以上所述实施例均是以 UE接入 AS为例进行说明的， 当然， 上述 所有实施例中的 AS均可以直接替换为 AP, 由该 AP代理 AS完成对接 入的 UE进行鉴权的操作， 且一个 AP的后面可以有一个或一个以上的 AS。 在此， 将所有类似 AS或 AP的实体称为应用业务实体。
再有， 众所周知， 用户的公共身份标识 IMPU与私有标识 IMPI对 应关系是多对一的关系， 因此针对上述两个实施例而言，在 HSS返回绑 定信息时， 也可以返回这个 IMPI所关联的所有 IMPU与该 UE的 IP地 址的绑定信息。 这样做的好处是， UE连接到 AS后， 其后面消息有可能 变化为使用其它的 IMPU, 因此 AS可以保存该 UE所有 IMPU与该 IP 地址的对应关系。 当上述实施例中的 AS被替换为 AP时， 这样的处理 尤为有用， 因为 AP后面可以有多个 AS， 且由 AP替这些 AS完成鉴权 功能， 则 UE向不同的 AS发出请求的时候使用的 IMPU很可能是不同 的， 这时， 如果 AP已经保存了该 UE所有 IMPU与该 UE的 IP地址的 对应关系， 则可以迅速准确的完成其代理的鉴权的操作， 而不必向 HSS 进行多次查询。 当然，应用业务实体也可以在接收到来自于 HSS的绑定 信息后， 不进行保存， 而是直接执行鉴权操作。
在上面两个实施例执行之前， UE和 AS可以先建立基于传输层保护 的传输层安全（ TLS Transport Layer Security )隧道， 由于 TLS就是一种 传输层保护协议， 因此在建立这个隧道后， 再执行上面两个实施例中描 述的基于应用层的认证过程， 可以使 UE和 AS之间的应用层通信得到 充分的安全保护。
以上所述实施例均是让网络侧来适应 UE,即让网络侧能够对 2G的 UE进行鉴权。 当然， 也可以让 UE来适应网络侧， 即让 2G的用户加载 一软件模块， 从而使得该 2G的 UE能够完全地支持 3G的功能， 也就是 使 2G的 UE能够支持 3G的鉴权方式。 这样， 网络侧可以仍然采用标准 的 3G的鉴权方式对该 UE进行鉴权。 该软件模块可以从网上下载， 也 可以从运营商处直接获得。
以上所迷实施例中的鉴权方式，既可以在 2G的 UE直接接入 AS时 应用， 也可以在该接入的 UE后续发送的消息中应用。
本发明还提供了能够对直接接入应用业务实体的 Early IMS终端实 现鉴权的鉴权系统。 图 3示出了鉴权系统的一个实施例。 参见图 3, 该 鉴权系统包括： Early IMS终端、应用业务实体和 HSS。其中， Early IMS 终端在接入 3G移动通信系统后获取 IP地址， 该终端用于向应用业务实 体发起包含用户身份标识的接入请求； 应用业务实体用于接收来自于 Early IMS终端的接入请求， 通知 HSS提供 Early IMS终端的 IP地址及 用户身份标识构成的绑定信息， 并根据所述绑定信息与所述接入请求对 所述 Early IMS终端进行鉴权； HSS用于根据应用业务实体的通知， 将 Early IMS终端的 IP地址及用户身份标识构成的绑定信息返回给应用业 务实体。
更加具体地说， 图 3中的 Early IMS终端包括链接建立模块， 用于 向应用业务实体发起包含用户身份标识的接入请求。 进一步， 该终端还 包括业务通信模块， 用于通过链接建立模块接收来自于应用业务实体的 关于通过鉴权的通知， 并与应用业务实体进行业务通信。
应用业务实体包括接收请求模块和安全信息请求及检查模块。 其中 接收请求模块用于接收来自于 Early IMS终端的接入请求， 通知安全信 息请求及检查模块获取该终端的 IP地址及用户身份标识构成的绑定信 息， 接收来自于安全信息请求及检查模块的鉴权结果； 安全信息请求及 检查模块用于根据接收请求模块的通知，请求并接收 HSS提供该终端的 IP地址及用户身份标识构成的绑定信息， 根据所获取的该终端的 IP地 址及其用户身份标识的绑定信息与接入请求， 对该终端进行鉴权， 并将 鉴权结果发送给接收请求模块。 另外， 安全信息请求及检查模块还能够 将 HSS提供的该终端的 IP地址及用户身份标识构成的绑定信息保存在 自身中， 并且在接收到来自于 Early IMS终端的接入请求后 , 判断自身 是否存在该接入请求中用户身份标识对应的绑定信息， 在存在该绑定信 息的情况下， 直接进行鉴权; 在不存在该绑定信息的情况下， 请求并接 收 HSS提供的绑定信息。
进一步， 业务应用实体还包括业务通信模块， 用于接收来自于接收 请求模块的鉴权结果， 并在该终端通过鉴权时， 与 Early IMS终端进行 业务通信。
HSS包括安全绑定信息存储模块， 用于保存由 Early IMS终端的 IP 地址及其用户身份标识构成的绑定信息, 根据来自于应用业务实体的通 知， 在自身查找 Early IMS对应的绑定信息， 并将查找到的绑定信息返 回给应用业务实体。
图 4示出了本发明中鉴权系统的又一实施例。 如图 4所示， 该实施 例中的鉴权系统与图 3的区别在于：增加了具有 Early-BSF功能的 BSF。 该 BSF用于接收来自于应用业务实体的关于请求提供 Early IMS终端的 IP地址及用户身份标识构成的绑定信息的通知， 将该通知转发给 HSS, 并且接收来自于 HSS的 Early IMS终端的 IP地址及用户身份标识构成的 绑定信息， 将该绑定信息转发给应用业务实体。 图 3和图 4所示的鉴权系统中， 上述 Early IMS终端和应用业务实 体中也可以不包括业务通信模块。
以上所述仅为本发明的较佳实施例而已， 并不用以限制本发明， 凡 在本发明的精神和原则之内， 所做的任何修改、 等同替换、 改进等， 均 应包含在本发明的保护范围之内。

Claims

权利要求书
1、一种对用户终端进行鉴权的方法，适用于直接接入应用业务实体 的 Early IMS终端， 所述 Early IMS终端接入第三代 3G移动通信系统后 获取 IP地址， 该方法包括以下步骤:
Early IMS终端向应用业务实体发起接入请求，该请求中包含用户身 份标识， 应用业务实体根据接收到的接入请求， 从归属网络服务器 HSS 获取由该 Early IMS终端的 IP地址及其用户身份标识构成的绑定信息， 并根据所述绑定信息与所述接入请求对所述 Early IMS终端进行鉴权。
2、根据权利要求 1所述的方法， 其特征在于，根据所述绑定信息与 所述接入请求对所述 Early IMS终端进行鉴权的过程包括：
应用业务实体判断所述绑定信息中的 IP 地址与发起接入请求的 Early IMS终端的 IP地址是否相匹配， 如果匹配， 则该 Early IMS终端 通过鉴权， 否则该 Early IMS终端不能通过鉴权。
3、根据权利要求 1所述的方法， 其特征在于， 根据所述绑定信息与 所述接入请求对所述 Early IMS终端进行鉴权的过程包括：
应用业务实体判断获取到的该 Early IMS终端的 IP地址及其用户身 份标识的绑定信息， 与发起接入请求的 Early IMS终端的 IP地址及用户 身份标识是否相匹配， 如果匹配， 则该 Early IMS终端通过鉴权， 否则 该 Early IMS终端不能通过鉴权。
4、根据权利要求 2或 3所述的方法， 其特征在于， 当所述应用业务 实体从 HSS获取由该 Early IMS终端的 IP地址及其用户身份标识构成的 绑定信息后， 还包括： 将所述绑定信息进行保存。
5、 根据权利要求 1所述的方法， 其特征在于， 所述 Early IMS终端 发起的接入请求中还包括鉴权方式标识， 所述鉴权方式标识为早期的通用鉴权框架鉴权方式时， 所述应用业 务实体通过执行用户身份初始检查验证的实体 BSF从 HSS获取该 Early IMS终端的 IP地址及其用户身份标识的绑定信息。
6、根据权利要求 5所述的方法， 其特征在于， 所述应用业务实体通 过 BSF从 HSS获取该 Early IMS终端的 IP地址及其用户身份标识的绑 定信息的过程包括以下步骤：
应用业务实体向 BSF发送请求鉴权信息的消息，该请求消息中包含 用户终端的用户身份标识， BSF接收到该请求后， 根据请求中的用户终 端的用户身份标识向 HSS请求该 Early IMS终端的 IP地址及其用户身份 标识的绑定信息， 并将得到的绑定信息直接返回给应用业务实体， 应用 业务实体保存接收到的绑定信息；
所述 BSF向 HSS请求绑定信息的消息中包含鉴权方案字段， 该鉴 权方案字段指示为 early IMS。
7、 根据权利要求 6所述的方法， 其特征在于， 所述 BSF为早期的 仅具备查询功能的 Early-BSF, 或支持完全 3G功能且具备 Early-BSF功 能的 BSF。
8、根据权利要求 6所述的方法， 其特征在于， 所述应用业务实体与 已保存绑定信息的 HSS属于相同或不同的归属网络。
9、 根据权利要求 1所述的方法， 其特征在于， 所述 Early IMS终端 发起的接入请求中还包括鉴权方式标识，
所述鉴权方式标识为直接鉴权方式时， 所述应用业务实体直接向 HSS发送绑定信息请求消息，接收并保存 HSS返回的该 Early IMS终端 的 IP地址及其用户身份标识的绑定信息。
10、 根据权利要求 9所述的方法， 其特征在于， 所述应用业务实体 向 HSS发送的请求消息由用户数据请求 UDR消息承载， 且该消息中的 属性信息指明请求绑定信息； HSS给应用业务实体返回的响应消息由用 户数据应答 UDA消息承载，且该消息中的属性信息指明请求绑定信息。
11、 根据权利要求 9所述的方法， 其特征在于， 所述应用业务实体 与已保存绑定信息的 HSS属于相同的归属网络。
12、 根据权利要求 5或 9所述的方法， 其特征在于，
所述 Early IMS终端向应用业务实体发起的接入请求由基于 HTTP 协议的请求消息 HTTP GET承载；
所述请求消息中的鉴权方式标识由 HTTP GET 中的用户代理 user agent字段承载。
13、 根据权利要求 1所述的方法， 其特征在于， 所述接入请求中的 用户身份标识为用户公共身份标识 IMPU;
所述应用业务实体从 HSS获取的该 Early IMS终端的 IP地址及其用 户身份标识的绑定信息为： 接入请求中所包含的 IMPU和该 Early IMS 终端的 IP地址的对应关系； 或发起接入请求的 Early IMS终端所拥有的 所有 IMPU和该 Early IMS终端的 IP地址的对应关系。
14、 如权利要求 1所述的方法， 其特征在于， 所述应用业务实体接 收到接入请求之后， 进一步包括：
判断该应用业务实体中是否存在所述接入请求中的用户身份标识对 应的绑定信息， 如果是， 则获取该绑定信息， 并继续执行所述鉴权操作； 否则， 继续执行所述从 HSS获取绑定信息的操作。
15、根据权利要求 1所述的方法， 其特征在于， 该方法进一步包括： Early IMS终端与应用业务实体之间建立传输层安全 TLS隧道， 然后再 执行所述 Early IMS终端向应用业务实体发起接入请求的操作。
16、 一种对用户进行鉴权的鉴权系统, 其特征在于， 该系统包括： Early IMS终端、 应用业务实体和用户归属网络服务器 HSS, 其中， Early IMS终端在接入第三代 3G移动通信系统后获取 IP地址， 该 终端用于向应用业务实体发起包含用户身份标识的接入请求；
应用业务实体用于接收来自于 Early IMS终端的接入请求，通知 HSS 提供 Early IMS终端的 IP地址及用户身份标识构成的绑定信息， 并根据 所述绑定信息与所述接入请求对所述 Early IMS终端进行鉴权；
HSS用于^^据应用业务实体的通知， 将 Early IMS终端的 IP地址及 用户身份标识构成的绑定信息返回给应用业务实体。
17、 如权利要求 16所述的系统， 其特征在于， 所述 Early IMS终端 包括：
链接建立模块， 用于向应用业务实体发起包含用户身份标识的接入 请求。
18、 如权利要求 17所述的系统， 其特征在于， 所述 Early IMS终端 进一步包括：
业务通信模块， 用于通过所述链接建立模块接收来自于应用业务实 体的关于通过鉴权的通知， 并与应用业务实体进行业务通信。
19、 如权利要求 16所述的系统， 其特征在于， 所述应用业务实体包 括： 接收清求模块和安全信息请求及检查模块， 其中，
接收请求模块用于接收来自于 Early IMS终端的接入请求， 通知安 全信息请求及检查模块获取该终端的 IP地址及用户身份标识构成的绑 定信息， 接收来自于安全信息请求及检查模块的鉴权结果；
安全信息请求及检查模块用于根据接收请求模块的通知， 请求并接 收 HSS提供的该终端的 IP地址及用户身份标识构成的绑定信息， 根据 所获取的该终端的 IP地址及其用户身份标识的绑定信息与接入请求，对 该终端进行鉴权， 并将鉴权结果发送给接收请求模块。
20、如权利要求 19所述的系统， 其特征在于， 所述安全信息请求及 检查模块进一步用于对所述 HSS提供的该终端的 IP地址及用户身份标 识构成的绑定信息进行保存， 并且在接收到来自于 Early IMS终端的接 入请求后判断自身是否存在该接入请求中用户身份标识对应的绑定信 息， 在存在该绑定信息的情况下， 直接进行鉴权； 在不存在该绑定信息 的情况下， 请求并接收 HSS提供的绑定信息。
21、如权利要求 19所述的系统， 其特征在于， 所述业务应用实体进 一步包括：
业务通信模块， 用于接收来自于接收请求模块的鉴权结果， 并在该 终端通过鉴权时， 与 Early IMS终端进行业务通信。
22、 如权利要求 16所述的系统， 其特征在于， 所述 HSS包括： 安 全绑定信息存储模块， 用于保存由 Early IMS终端的 IP地址及其用户身 份标识构成的绑定信息， 根据来自于应用业务实体的通知， 在自身查找 Early IMS对应的绑定信息, 并将查找到的绑定信息返回给应用业务实 体。
23、 如权利要求 16至 22任意一项所述的系统， 其特征在于， 所述 系统进一步包括：
具有 Early-BSF功能的 BSF, 用于接收来自于应用业务实体的关于 请求提供 Early IMS终端的 IP地址及用户身份标识构成的绑定信息的通 知， 将该通知转发给 HSS, 并且接收来自于 HSS的 Early IMS终端的 IP 地址及用户身份标识构成的绑定信息， 将该绑定信息转发给应用业务实 体。
24、根据权利要求 16所述的方法， 其特征在于， 所述应用业务实体 为应用服务器 AS或应用服务器代理 AP。
PCT/CN2006/001416 2005-06-21 2006-06-21 A method and system for authenticating user terminal Ceased WO2006136106A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CNA2006800123062A CN101160920A (zh) 2005-06-21 2006-06-21 对用户终端进行鉴权的方法及鉴权系统
EP06742203A EP1816825A4 (en) 2005-06-21 2006-06-21 METHOD AND SYSTEM FOR AUTHENTICATING USER TERMINAL
US11/735,541 US20070249342A1 (en) 2005-06-21 2007-04-16 Method, system and application service entity for authenticating user equipment

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200510077476.6 2005-06-21
CNB2005100774766A CN100379315C (zh) 2005-06-21 2005-06-21 对用户终端进行鉴权的方法

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US11/735,541 Continuation US20070249342A1 (en) 2005-06-21 2007-04-16 Method, system and application service entity for authenticating user equipment

Publications (1)

Publication Number Publication Date
WO2006136106A1 true WO2006136106A1 (en) 2006-12-28

Family

ID=36811707

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2006/001416 Ceased WO2006136106A1 (en) 2005-06-21 2006-06-21 A method and system for authenticating user terminal

Country Status (4)

Country Link
US (1) US20070249342A1 (zh)
EP (1) EP1816825A4 (zh)
CN (2) CN100379315C (zh)
WO (1) WO2006136106A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101945102A (zh) * 2010-07-26 2011-01-12 中兴通讯股份有限公司 基于ims的iptv用户合法性认证的方法、服务器及系统
US11409851B2 (en) 2016-11-08 2022-08-09 Huawei Technologies Co., Ltd. Authentication method and electronic device

Families Citing this family (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101030853B (zh) * 2006-03-02 2010-04-14 华为技术有限公司 一种用户终端的鉴权方法
CN101102186B (zh) * 2006-07-04 2012-01-04 华为技术有限公司 通用鉴权框架推送业务实现方法
CN101072326B (zh) * 2007-06-20 2011-12-21 华为技术有限公司 访问非归属签约iptv业务提供者业务的方法、系统和设备
CN101946455B (zh) * 2008-02-21 2012-09-05 上海贝尔股份有限公司 用于异构网络的一次通过认证机制和系统
US8359031B2 (en) * 2008-09-19 2013-01-22 Clear Channel Management Services, Inc. Computer based method and system for logging in a user mobile device at a server computer system
CN102917342B (zh) * 2008-09-28 2015-11-25 华为技术有限公司 用户设备活动信息通知方法、系统及网元设备、服务器
CN101715173B (zh) * 2008-10-06 2013-06-05 华为技术有限公司 用户设备活动信息通知方法、系统及网元设备、服务器
CN101729578B (zh) * 2008-10-27 2013-01-23 华为技术有限公司 应用业务接入鉴权方法及接入鉴权代理
CN101478755B (zh) * 2009-01-21 2011-05-11 中兴通讯股份有限公司 一种网络安全的http协商的方法及其相关装置
KR101094577B1 (ko) 2009-02-27 2011-12-19 주식회사 케이티 인터페이스 서버의 사용자 단말 인증 방법과 그 인터페이스 서버 및 사용자 단말
CN102238211A (zh) * 2010-04-23 2011-11-09 上海博泰悦臻电子设备制造有限公司 车载通信服务提供、获取方法和装置及系统
EP2418815B1 (en) 2010-08-12 2019-01-02 Deutsche Telekom AG Managing Session Initiation Protocol communications towards a user entity in a communication network
EP2418817B1 (en) 2010-08-12 2018-12-12 Deutsche Telekom AG Application server for managing communications towards a set of user entities
EP2418818B1 (en) * 2010-08-12 2018-02-14 Deutsche Telekom AG Network entity for managing communications towards a user entity over a communication network
CN102469448B (zh) * 2010-11-08 2016-12-28 中兴通讯股份有限公司 一种机器类通信接入控制的方法、系统及装置
CA2853867A1 (en) * 2011-10-31 2013-05-10 Nokia Technologies Oy Security mechanism for external code
EP2805450B1 (en) * 2012-01-19 2019-05-15 Nokia Solutions and Networks Oy Detection of non-entitlement of a subscriber to a service in communication networks
US20130212653A1 (en) * 2012-02-09 2013-08-15 Indigo Identityware Systems and methods for password-free authentication
CN103888415B (zh) * 2012-12-20 2017-09-15 中国移动通信集团公司 Ims用户的游牧控制方法及装置
CN104468464B (zh) * 2013-09-12 2018-07-06 深圳市腾讯计算机系统有限公司 验证方法、装置和系统
CN104753872B (zh) * 2013-12-30 2018-10-12 中国移动通信集团公司 认证方法、认证平台、业务平台、网元及系统
US10791496B2 (en) * 2016-06-30 2020-09-29 T-Mobile Usa, Inc. Restoration of serving call session control and application server function
CN108024248B (zh) * 2016-10-31 2022-11-08 中兴通讯股份有限公司 一种物联网平台的鉴权方法和装置
CN106599622A (zh) * 2016-12-06 2017-04-26 福建中金在线信息科技有限公司 一种应用软件接口程序过滤的方法及装置
CN109756450B (zh) 2017-11-03 2021-06-15 华为技术有限公司 一种物联网通信的方法、装置、系统和存储介质
CN109962878B (zh) 2017-12-14 2021-04-16 大唐移动通信设备有限公司 一种ims用户的注册方法及装置
US10721621B2 (en) * 2018-05-23 2020-07-21 Cisco Technology, Inc. Updating policy for a video flow during transitions
CN112422479B (zh) * 2019-08-22 2024-05-14 北京奇虎科技有限公司 一种设备绑定方法及装置、系统
WO2021093997A1 (en) * 2019-11-15 2021-05-20 Telefonaktiebolaget Lm Ericsson (Publ) A method for supporting authentication of a user equipment
CN114125836B (zh) * 2020-08-10 2024-08-09 中国移动通信有限公司研究院 鉴权方法、装置、设备及存储介质
US11638134B2 (en) * 2021-07-02 2023-04-25 Oracle International Corporation Methods, systems, and computer readable media for resource cleanup in communications networks
US11709725B1 (en) 2022-01-19 2023-07-25 Oracle International Corporation Methods, systems, and computer readable media for health checking involving common application programming interface framework

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030159067A1 (en) * 2002-02-21 2003-08-21 Nokia Corporation Method and apparatus for granting access by a portable phone to multimedia services
US20040122934A1 (en) * 2001-04-03 2004-06-24 Ilkka Westman Registering a user in a communication network
US20040230697A1 (en) * 2003-05-13 2004-11-18 Nokia Corporation Registrations in a communication system

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
ATE405123T1 (de) * 2004-05-12 2008-08-15 Ericsson Telefon Ab L M Authentifizierungssystem
GB0414421D0 (en) * 2004-06-28 2004-07-28 Nokia Corp Authenticating users
US20060020791A1 (en) * 2004-07-22 2006-01-26 Pekka Laitinen Entity for use in a generic authentication architecture
US7715822B2 (en) * 2005-02-04 2010-05-11 Qualcomm Incorporated Secure bootstrapping for wireless communications
MX2007009705A (es) * 2005-02-11 2007-10-04 Nokia Corp Metodo y aparato para proporcionar procedimientos de carga inicial en una red de comunicacion.
GB0504865D0 (en) * 2005-03-09 2005-04-13 Nokia Corp User authentication in a communications system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040122934A1 (en) * 2001-04-03 2004-06-24 Ilkka Westman Registering a user in a communication network
US20030159067A1 (en) * 2002-02-21 2003-08-21 Nokia Corporation Method and apparatus for granting access by a portable phone to multimedia services
US20040230697A1 (en) * 2003-05-13 2004-11-18 Nokia Corporation Registrations in a communication system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1816825A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101945102A (zh) * 2010-07-26 2011-01-12 中兴通讯股份有限公司 基于ims的iptv用户合法性认证的方法、服务器及系统
CN101945102B (zh) * 2010-07-26 2014-07-16 中兴通讯股份有限公司 基于ims的iptv用户合法性认证的方法、服务器及系统
US11409851B2 (en) 2016-11-08 2022-08-09 Huawei Technologies Co., Ltd. Authentication method and electronic device
US11860986B2 (en) 2016-11-08 2024-01-02 Huawei Technologies Co., Ltd. Authentication method and electronic device

Also Published As

Publication number Publication date
CN101160920A (zh) 2008-04-09
US20070249342A1 (en) 2007-10-25
EP1816825A1 (en) 2007-08-08
EP1816825A4 (en) 2008-03-05
CN100379315C (zh) 2008-04-02
CN1802016A (zh) 2006-07-12

Similar Documents

Publication Publication Date Title
CN100379315C (zh) 对用户终端进行鉴权的方法
JP5529889B2 (ja) 加入者装置のグローバルに一意的な識別子の生成
CN101002446B (zh) 在混合电信网络中用于提供相关通信会话信息的方法和系统
WO2006047925A1 (en) A method for selecting the authentication manner at the network side
WO2006010312A1 (en) A method of informing the capability change of the terminal to the network
WO2006102830A1 (en) A method for terminal identifying capability interaction route control while ims and cs are coinstantaneous
WO2006136097A1 (en) A method for processing the register abnormality during the user register procedure
US8661097B2 (en) Service node, control method thereof, user node, and control method thereof
WO2006099815A1 (en) A method for implementing the user registering in the ip multimedia subsystem and the system thereof
CN1610441B (zh) 通信系统中消息的验证
WO2008000192A1 (en) Network access method of terminals, network access system and gateway equipment
CN100493227C (zh) 一种网络侧对更新ip地址的用户的处理方法
US20110173687A1 (en) Methods and Arrangements for an Internet Multimedia Subsystem (IMS)
WO2019184717A1 (zh) 一种通信方法、及相关产品
CN101573934A (zh) 在通信网络中的鉴别
CN114667751A (zh) 一种支持对用户设备认证的方法
US20070055874A1 (en) Bundled subscriber authentication in next generation communication networks
CN101401476B (zh) 通信网络中的接入控制
WO2014114088A1 (zh) 一种ngn下实现宽带业务功能的方法及业务平台
CN101800945A (zh) 区分共享同一公共用户标识的多个用户设备的方法及装置
WO2015192559A1 (zh) Ims、ims中的业务开通方法及装置
WO2007090348A1 (en) A method, apparatus and system for checking the validity for globally routable user agent uri
JP2006521717A5 (zh)
US9692835B2 (en) Method and apparatuses for the provision of network services offered through a set of servers in an IMS network
CN101521930B (zh) 一种策略控制方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 11735541

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2006742203

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2006742203

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 200680012306.2

Country of ref document: CN

WWP Wipo information: published in national office

Ref document number: 11735541

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWW Wipo information: withdrawn in national office

Country of ref document: DE