WO2007098669A1

WO2007098669A1 - A method, system and apparatus for user terminal authentication

Info

Publication number: WO2007098669A1
Application number: PCT/CN2007/000234
Authority: WO
Inventors: Hui Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-03-02
Filing date: 2007-01-22
Publication date: 2007-09-07
Also published as: CN101030853B; CN101030853A

Abstract

A method for user terminal authentication which comprises: when received a request message from the user terminal, judging whether the address information of the user terminal is included in the said request message, if included, comparing the address information of the user terminal carried by the request message with the stored address information of the user terminal, if the address information match, the user terminal authentication passes. The invention also provides an user terminal Authentication System a Register Authentication Control Function and a Call Session Function, which promote the security of user terminal, simplify the authentication process and reduce the processing spending at the same time.

Description

Method, system and device for authenticating user terminal

The present invention relates to the field of communications, and in particular, to a system and apparatus for authenticating a user terminal. Background of the invention

The IP Multimedia Subsystem (IMS) is a subsystem that 3GPP superimposes on a packet network. The IMS uses the packet domain as its bearer channel for control signaling and media transmission, and introduces Session Initiation Protocol (SIP) as its service control protocol. IMS utilizes the characteristics of simple SIP, easy to expand, and convenient media combination to provide rich multimedia services by separating service control from bearer control. The main functional entities in the IMS include Call Session Control Function (CSCF), which controls user registration, session control, etc. ^ The Home Subscriber Server (HSS) that centrally manages user subscription data and provides various The application server (AS, Application Server) of the business logic control function.

In the IMS application, in order to complete the registration function of the user terminal, and the calling or called service, the 3GPP defines the user public identity (IMPU, IM Public Identity) and the private identity (IMPI, IM Private Identity), and the user uses the IMPU. Communication, use ΙΜΡΙ to authenticate the user terminal. According to the current definition of 3GPP, the standard IMS terminal authenticates the user terminal by using the IMS authentication and key agreement (AKA) authentication and key agreement.

The IMS AKA authentication method establishes a secure channel in the access network between the IMS terminal and the P-CSCF through the registration process to protect the integrity and confidentiality of subsequent messages. But given the current IMS The processing power of the terminal makes it difficult to provide a secure channel. If the terminal does not establish a secure channel, the re-registration and session request initiated by the IMS terminal cannot be secured. The existing solution is that when the IMS terminal initiates a re-registration request, a logout request, and a dialog request and a non-registered independent transaction request, the network initiates an authentication process to ensure user reliability. As the network authenticates each request of the IMS terminal, the request processing delay increases, which affects the user experience. At the same time, the network message traffic increases and the processing overhead increases. Other authentication methods, such as HTTP Digest, etc., use the per-session authentication method to ensure the reliability of the user request after the initial authentication is passed, so the same problem exists. Summary of the invention

The embodiment of the invention provides a user terminal authentication method and system, which simplifies the authentication process, ensures the reliability of the user terminal, and enhances the user experience.

The authentication method of the user terminal in the embodiment of the present invention includes the following steps:

Receiving the request message sent by the user terminal, comparing whether the address information of the user terminal carried in the request message and the stored address information of the user terminal match, and if yes, the user terminal authenticates.

A user terminal authentication system, comprising: a network access control entity, a registration authentication control entity;

The network access control entity is configured to receive the request message of the user terminal, and carry the address information of the user terminal in the request message, and forward the request message carrying the user terminal address information to the registration authentication control entity;

The registration authentication control entity stores the address information of the user terminal, and after receiving the request message, compares whether the address information of the user terminal carried in the request message matches the stored address information of the user terminal, and if yes, determines the user terminal The right to pass.

A user terminal authentication system, comprising: a network access control entity, and a registration authentication control Entity, session control entity;

The registration authentication control entity stores the address information of the user terminal;

The network access control entity is configured to receive the request message of the user terminal, and carry the address information of the user terminal in the request message, and send the request message carrying the user terminal address information to the session control entity;

The session control entity is configured to receive a request message that carries the user terminal address information sent by the network access control entity, obtain the saved address information of the user terminal from the registration authentication control entity, and compare the address information and the saved address information in the request message. Whether it matches, if it matches, it determines that the user terminal is authenticated.

A registration authentication control entity is configured to store address information of a user terminal, receive a request message of the user terminal, and compare whether the address information of the user terminal carried in the request message matches the stored address information of the user terminal, and if so, Then, the user terminal is determined to pass the authentication.

A session control entity is configured to receive a request message carrying user terminal address information, obtain the stored address information of the user terminal, and compare whether the address information in the request message matches the saved address information, and if yes, determine the user terminal The authentication was passed.

The authentication method of the embodiment of the present invention enables the user terminal to initiate a re-registration request, a logout request, and a dialog request without establishing a secure channel while ensuring the reliability of the user terminal and the integrity and confidentiality of subsequent messages. The non-registered independent transaction request is authenticated by comparing the address information of the user terminal in the request message with the stored address information of the user terminal, so that the network does not need to perform initial authentication for each request of the IMS terminal. The authentication process simplifies the corresponding authentication process, so that the traffic of the network message is controlled, the network processing overhead is reduced, the delay of processing the request message is reduced, and the user experience is enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a network logical structure diagram of a user terminal authentication system according to an embodiment of the present invention. FIG. 2 is a flowchart of an initial registration authentication request process when the IMS AKA authentication mode is adopted in the embodiment of the present invention.

FIG. 3 is a flowchart of a user terminal initiating a re-registration authentication request when the IMS AKA authentication mode is adopted in the embodiment of the present invention.

FIG. 4 is a flow chart of the user terminal initiating re-authentication in the process of re-registering the authentication request when the IMS AKA authentication mode is adopted in the embodiment of the present invention.

FIG. 5 is a flowchart of a user terminal initiating a non-registration authentication request when the IMS AKA authentication mode is used in the embodiment of the present invention.

FIG. 6 is a flow chart of initial authentication when the BA authentication mode is adopted in the embodiment of the present invention. Mode for carrying out the invention

In order to make the technical solutions of the embodiments of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

Generally, the user terminal obtains an access address after being authenticated by the access network, and the access address is reliable. On the premise that the terminal access address is reliable, the network can retain the address information of the user terminal when the authentication of the user terminal is passed. For the subsequent re-registration request, the logout request, the dialog request, and the non-registered independent transaction request message, the address information of the user terminal carried in the request message and the address information of the user terminal saved when the authentication is passed may be compared, if If yes, the user terminal is determined to pass the authentication; if different, the network initiates a re-authentication process to the user terminal, or returns a failure response. The address information of the user terminal may be an IP address, a port number, or a Full Qualified Domain Name (FQDN).

The network logical structure of the user terminal authentication system in the embodiment of the present invention is as shown in FIG. 1, and includes a user terminal 101, a network access control entity 102, a registration authentication control entity 103, and a session control entity 104. among them: The user terminal 101 is a communication terminal that can access a packet network, such as an IMS terminal, a PC, or the like.

The network access control entity 102 is a network entity that provides access control to the user terminal 101, and is responsible for proxy control such as registration, authentication, and session of the user terminal, and can access the user terminal 101 and the network according to the authentication information of the user. A secure channel is established between the control entities 102.

The registration authentication control entity 103 provides a user with a registration mechanism and an authorization control function, and can control the network access control entity 101 to establish a secure channel for the authenticated user in the access network.

The session control entity 104 provides functions such as session control, routing connection, and service triggering for registered and authorized users.

In the embodiment of the present invention, the address information of the user terminal 101 takes an IP address as an example. When the user terminal 101 initiates an initial registration request, the request message carries its IP address, and forwards the registration authentication request message carrying the user terminal IP address to the registration authentication control entity 103;

The registration authentication control entity 103 authenticates the user terminal 101 using the authentication mode supported by the user terminal 101. If the authentication is passed, the registration authentication control entity 103 saves the IP address carried in the registration authentication request message it receives.

During the registration lifetime of the user terminal 101, when the user terminal 101 initiates a re-registration request, a logout request message, a dialog request message, or an independent transaction request message, the request message carries the IP address of the user terminal, and the user terminal is carried. The request message of the IP address is forwarded to the registration authentication control entity 103;

After receiving the request message, the registration authentication control entity 103 compares whether the saved IP address and the IP address in the request message are consistent. If they are consistent, the authentication is passed. Otherwise, if the authentication fails, the user terminal may be re-authenticated, and after the re-authentication is passed, the saved IP address is refreshed.

The method of the embodiment of the present invention is described in detail below by taking the IMS AKA authentication in the IMS network as an example.

First, the address information of the user terminal is obtained during the initial registration process, and the initial authentication is performed. After saving, the address information of the user terminal is saved, as shown in FIG. 2:

Step 201: The user terminal sends a registration request to the P-CSCF, where the registration request indicates that the terminal supports the IP address authentication method.

Step 202: The P-CSCF receives the registration request sent by the user terminal, and checks the IP address IP1 included in the "sent-by" parameter of the Via header field in the registration request. If the "sent-by" parameter contains a domain name, or if the IP address it contains and the source address received by the IP packet are different, the P-CSCF will add the parameter "received" in the Via header field, which contains the IP address IP2 used to receive the request. . Then forward the registration request to the I-CSCF.

Step-209: The I-CSCF receives the registration request forwarded by the P-CSCF, and then forwards the registration request to the S-CSCF.

Step 204: The S-CSCF receives the registration request forwarded by the I-CSCF. If the registration request includes the indication that the terminal supports the IP address authentication method, the S-CSCF considers that the terminal supports the IP address authentication method. The S-CSCF sends an authentication challenge (401 Challenge) to the user terminal according to the user authentication information obtained by the HSS query.

Step 205: The I-CSCF forwards the registration authentication challenge.

Step 206: After receiving the registration authentication <challenge, the P-CSCF forwards the registration authentication challenge to the user terminal.

Step 207: After receiving the registration authentication challenge, the user terminal does not need to establish a secure channel. The network is authenticated and the authentication response is calculated, and the registration process is re-initiated.

Step 208: The P-CSCF forwards the registration request.

Step 209: The I-CSCF forwards the registration request.

Step 210: The S-CSCF receives the registration request, and performs matching according to the authentication response of the user terminal. If the matching is successful, the user status is set to the registered state. Then check whether the Via header field in the registration message contains the "sent-by" parameter. If it contains, the corresponding IP1 in the "sent-by" parameter is saved. If the Via header field also contains the "received" parameter, it is also saved. IP2 in the "received" parameter. The S-CSCF sends a successful acknowledgement to the user terminal.

Step 211: The I-CSCF forwards the successful confirmation.

Step 212: The P-CSCF forwards the successful confirmation.

So far, the user terminal completes the initial registration authentication process, and saves the address information IP 1 or IP 1 and IP 2 when the user terminal passes the authentication in the S-CSCF.

When the user terminal initiates a re-registration request during the registration lifetime, the authentication process includes the following steps, as shown in Figure 3:

Step 301: The user terminal sends a re-registration request to the P-CSCF, where the registration message indicates that the terminal supports the IP address-based authentication method.

Step 302: The P-CSCF checks the IP address IP1 included in the "sent-by" parameter of the Via header field in the registration message. If the IP address of the "sent-by" parameter is different from the source address received by the IP packet, the P-CSCF will add the parameter "accepted" in the Via header field, and the parameter contains the source IP address IP2 received by the IP packet. The re-registration request is then forwarded to the I-CSCF.

Step 303: The I-CSCF receives the re-registration request forwarded by the P-CSCF, and then forwards the re-registration request to the S-CSCF.

Step 304: The S-CSCF receives the re-registration request, and the S-CSCF first checks whether the Via header field in the re-registration request includes a "sent-by" parameter and a "received" parameter. If included, the parameter value in the request message is The corresponding initial authentication is compared by the parameter values saved when the initial authentication is passed. If the matching is performed, the user terminal is deemed to have passed the authentication, and the successful confirmation is returned.

Step 305, the I-CSCF forwards the successful confirmation.

Step 306, the P-CSCF forwards the successful confirmation.

If the parameter values do not match in step 304, the user terminal fails to authenticate, and the user terminal needs to initiate re-authentication. The process is as follows, as shown in Figure 4:

Steps 401 to 403 are the same as steps 301 to 303.

Step 404, the S-CSCF receives the re-registration request, and the S-CSCF first checks the registration request. Whether the Via header field contains the "sent-by" parameter and the "received" parameter. If yes, compare the parameter value in the request message with the corresponding initial registered parameter value. If it does not match, the user terminal needs to be re-authenticated. Then, the S-CSCF initiates re-authentication (401 challenge) to the user terminal according to the user authentication information obtained by the HSS query.

Steps 405 - 409 are the same as steps 205 ~ 209.

Step 410: The S-CSCF receives the registration request, and performs matching according to the authentication response of the user terminal. If the matching is successful, the user state is set to the registered state. Then check whether the Via header field in the registration message contains the "sent-by" parameter and the "received" parameter. If it contains, the corresponding IP2 in the "sent-by" parameter and the IP2 in the "received" parameter are saved. The IP address IP1 or EP1 and IP2 saved when the last authentication was passed. The S-CSCF sends a successful acknowledgement to the user terminal.

Step 411, the I-CSCF forwards the successful confirmation.

Step 412: The P-CSCF forwards the successful confirmation.

In addition to the re-authentication after the authentication of the user terminal fails, it is also possible to determine whether the user terminal needs to be re-authenticated according to the running status of the network or the registration information of the user or the configuration information of the operator.

When the user terminal initiates a non-registration authentication request, the processing process of the calling side is as shown in FIG. 5: Step 501: The user terminal sends a non-registered authentication request, including a dialog request or a non-registered independent transaction request, and a non-registered authentication request. The terminal is instructed to support an IP address based authentication method.

Step 502: The P-CSCF forwards the non-registered authentication request to the requested S-CSCF.

Step 503: The S-CSCF receives the request message, and first checks whether the Via header field in the request message includes a "sent-by" parameter and a "received" parameter, if included, and a parameter value and corresponding in the non-registered authentication request message. If the parameter values saved when the user terminal authentication succeeds, the S-CSCF continues to perform the service logic processing; otherwise, the S-CSCF returns a 403 (Forbidden) response.

If the HTTP Digest is used in the IMS network, the user terminal initiates an initial registration request using the HTTP Digest authentication method. The initial registration authentication process is basically the same as the IMS AKA. The same is not repeated here.

If NBA authentication is used in the IMS network, the initial registration authentication process is as follows, as shown in Figure 6:

Step 601: The user terminal initiates an initial registration request according to the NBA authentication method, and the registration request indicates that the terminal supports the IP address authentication method.

Steps 602 to 603 are the same as steps 202 to 203.

Step 604: The S-CSCF receives the registration request forwarded by the I-CSCF. If the registration request includes the indication that the terminal supports the IP address authentication method, the S-CSCF considers that the terminal supports the IP address authentication method. The S-CSCF compares the user authentication information (user location information) obtained by the HSS query with the location information in the user registration request, and if the comparison passes, saves the IP address in the user registration message, and then returns a registration success response.

Step 605: The I-CSCF forwards the registration success response.

Step 606: After receiving the registration success response, the P-CSCF forwards the registration success response to the user terminal.

The IMS network adopts the Digest or the BA authentication mode. The process of the user terminal to initiate the re-registration request is the same as that of the IMS AKA, and is not described here.

The network implemented by the present invention includes, but is not limited to, an IP Multimedia Subsystem (IMS) network, a packet network such as a Next Generation Network (GN), and an Internet network. The signaling implemented includes but is not limited to The initial session protocol (SIP, Session Initial Protocol), Hypertext Transmission Protocol (HTTP), etc.; the authentication mode of the network to the terminal includes but is not limited to the authentication methods such as IMS AKA and HTTP Digest; The secure channels established between the ingress control entities include, but are not limited to, IPSec secure channels, Transport Layer Security (TLS) channels, or no secure channels.

In summary, the above description is only a preferred embodiment of the present invention, and is not intended to limit the present invention. The scope of protection. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A method for authenticating a user terminal, the method comprising the steps of: receiving a request message sent by a user terminal, and comparing whether address information of the user terminal carried in the request message and the stored address information of the user terminal match If it matches, the user terminal is authenticated.

The method according to claim 1, wherein the address information of the user terminal carried in the request message and the stored address information of the user terminal are both IP addresses of the user terminal, if the request message The IP address carried in the request is different from the source IP address received by the request message, and the source IP address received by the request message is also saved in the request message.

The method of claim 2, wherein the step of matching the address information of the user terminal carried in the comparison request message with the stored address information of the user terminal comprises: - in the request message When the IP address of the user terminal is the same as the source IP address received by the request message, the IP address of the user terminal carried in the request message is the same as the saved IP address.

When the IP address of the user terminal carried in the request message is different from the source IP address received by the request message, the IP address of the user terminal carried in the request message and the source IP address received by the request message are saved and saved. Whether the IP address of the user terminal and the source IP address received by the request message are the same.

4. The method according to claim 1, wherein the method further comprises: if the address information does not match, initiating re-authentication to the user terminal, or returning an authentication failure response.

5. The method of claim 4, further comprising: After the authentication is passed, the address information of the user terminal is refreshed.

The method according to claim 1, wherein the saved address information is saved when the initial authentication of the user terminal is passed.

The method according to claim 1, wherein the method further comprises: before comparing the address information of the user terminal carried in the request message with the stored address information of the user terminal, the method further comprising:

Determining whether the user terminal supports the authentication method based on the user terminal address information. If the user terminal supports the authentication method based on the user terminal address information, compares the address information of the user terminal carried in the request message with the saved address information of the user terminal. match.

8. The method according to claim 1, wherein the authentication method is applicable to: IMS authentication and key agreement (IMS AKA, IP Multimedia Subsystem Authentication and key agreement), HTTP Digest or NBA authentication the way.

A user terminal authentication system, comprising: a network access control entity and a registration authentication control entity;

The network access control entity is configured to receive the request message of the user terminal, and carry the address information of the user terminal in the request message, and send the request message carrying the user terminal address information to the registration authentication control entity;

The registration authentication control entity stores the address information of the user terminal, and receives the odd message from the network access control entity, and compares whether the address information of the user terminal carried in the request message matches the stored address information of the user terminal, if it matches Then, the user terminal is judged to pass the authentication.

The system according to claim 9, wherein the address information is an IP address of the user terminal, and the network access control entity is further configured to compare the IP address carried in the request message with the request message. If the source IP address is different, the source IP address received by the request message is also saved in the request message. The registration authentication control entity is further configured to compare the IP address of the user terminal carried in the request message when the IP address of the user terminal carried in the request message is the same as the source IP address received by the request message. Is it the same as the saved IP address;

The system according to claim 9, wherein the registration authentication control entity is further configured to initiate a re-authentication after the user terminal fails to authenticate, and refresh the saved after the re-authentication is passed. Address information of the user terminal.

12. A user terminal authentication system, comprising: a network access control entity, a registration authentication control entity, and a session control entity; wherein

The system according to claim 12, wherein the address information is an IP address of the user terminal, and the network access control entity is further configured to compare the IP address carried in the request message with the request message. If the source IP address is different, the source IP address received by the request message is also saved in the request message.

The session control entity is further configured to: when the user terminal carried in the request message When the IP address is the same as the source IP address received by the request message, the IP address of the user terminal carried in the message is the same as the saved IP address.

The system according to claim 12, wherein the registration authentication control entity is further configured to initiate a re-authentication after the user terminal fails to authenticate, and refresh the saved after the re-authentication is passed. Address information of the user terminal.

A registration authentication control entity, configured to store address information of a user terminal, receive a request message of the user terminal, compare address information of the user terminal carried in the request message with address information of the saved user terminal Whether it matches, if it matches, it determines that the user terminal is authenticated.

The registration authentication control entity according to claim 15, wherein the address information is an IP address of the user terminal, and the registration authentication control entity is further configured to: carry in the request message When the IP address of the user terminal is the same as the source IP address received by the request message, the IP address of the user terminal carried in the request message is the same as the saved IP address.

The registration authentication control entity according to claim 15, further configured to: after the user terminal fails to authenticate, initiate a re-authentication right, and after the re-authentication right is passed, refresh the saved user terminal address. information.

A session control entity, configured to receive a request message carrying user terminal address information, and obtain the stored address information of the user terminal, and compare whether the address information in the request message matches the saved address information, if Match, then judge the user terminal to pass the authentication

The session control entity according to claim 18, wherein the address information is an IP address of the user terminal, and the session control entity is further configured to:: an IP of the user terminal carried in the request message When the address is the same as the source IP address received by the request message, the IP address of the user terminal carried in the comparison request message is the same as the saved IP address;