JP2013135255A - Terminal authentication method based on switching of ip subsystem network and proxy subscriber information server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a terminal authentication method and a proxy subscriber information server which allow a number of user terminals to switch IMS networks at a time without placing a heavy processing load on a specific HSS.SOLUTION: First, a user terminal 1 executes a position registration sequence between itself and a first S-CSCF41 of a first IMS network. At this time, the first S-CSCF41 transmits a position registration request to a proxy HSS7. The proxy HSS7 acquires authentication information of the user terminal 1 from a proxy HSS6 and retains it. Next, the user terminal 1 transmits a position registration request to a second S-CSCF42 when switching the first IMS network to a second IMS network. The second S-CSCF42 acquires the authentication information based on the user terminal 1 from the proxy HSS7 and retains it.

Description

  The present invention relates to a technique of a terminal authentication sequence executed when switching an IP (Internet Protocol) subsystem network (hereinafter referred to as an “IMS” (IP Multimedia Subsystem) network).

  Conventionally, there is a technique related to an authentication method and a key distribution method as a security architecture in a third generation mobile communication system (see, for example, Non-Patent Document 1). There is also a technology related to security in an IMS network constructed on a third generation mobile communication system (see, for example, Non-Patent Document 2).

  The IMS network is a standardized service control method for providing multimedia applications (voice, video and data) via an IP network. This is a core technology that realizes the next generation mobile phone network or NGN (Next Generation Network). As a result, the fixed network and the mobile network are integrated, and all-IP communication is realized in which all terminals communicate on an IP basis. Specifically, the IMS network is for performing necessary network resource allocation and gate control using a plurality of SIP (Session Initiation Protocol) servers. SIP is a call control protocol in IP, which negotiates an IP address, a port number, and encoding necessary for communication between terminals, and controls outgoing and incoming calls.

  FIG. 1 is a system configuration diagram of an IMS network in the prior art.

  According to the system of FIG. 1, first and second IMS networks are provided for managing network resources in a transport network. The first IMS network is used during normal times, and the second IMS network is used during backup. Thus, the fault tolerance of the whole system can be improved by configuring the IMS network redundantly.

  The transport network is interconnected with the access network via the gateway 2. The access network is, for example, a mobile phone network or a wireless / wired broadband access network, and is connected from the user terminal 1 such as a mobile phone or a smartphone. The user terminal 1 can establish a session with the counterpart terminal by connecting to the transport network via the access network and communicating with the SIP server in the IMS network.

  Each IMS network has P-CSCF (Proxy-CSCF) 3, S-CSCF (Serving-CSCF) 4, and I-CSCF (Interrogating-CSCF) as a call session control function (CSCF). And 5. Further, it has an HSS (Subscriber Information Server, Home Subscriber Server) 6 that can be commonly accessed from all the IMS networks and stores subscriber information (subscriber profile UP, UserProfile).

  The P-CSCF 3 is directly accessed from the user terminal 1 via the gateway 2. The P-CSCF 3 extracts media information for each session and instructs gate control and resource control for the gateway 2 when the session is established. The P-CSCF 3 is determined at the time of location registration from the user terminal, and establishes a secure IPsec tunnel with the gateway 2 (or SIP compatible terminal). Therefore, when a failure occurs in the first IMS network and switching to the second IMS network, the user terminal 1 needs to re-establish a session toward the second IMS network.

  The S-CSCF 4 is a central SIP server for service execution and call session control. The S-CSCF 4 has a domain of a home network managed by the S-CSCF 4 and manages a SIP-URI (SIP-Uniform Resource Identifier) of terminals within the domain. In addition, the S-CSCF 4 performs user authentication by communicating with the HSS 6. The S-CSCF 4 can provide various services to the user terminal 1 by communicating with various application servers (AS).

  When the user terminal 1 is registered, the I-CSCF 5 specifies the HSS 6 that stores the subscriber information of the user terminal, for example, by accessing the subscriber locator function. And according to the instruction | indication from HSS6, the registration process is taken over to S-CSCF4 in charge of the user terminal 1. FIG. The I-CSCF 5 distributes a plurality of HSSs 6 and conceals the configuration in the network from the outside.

  FIG. 2 is an authentication sequence in a prior art IMS network.

(S201) The user terminal normally transmits a Register message to the P-CSCF 31 of the first IMS network via the access network. The Register message includes a user terminal identifier called IMPI (IMS Private User Identity). The IMPI is a unique identifier in the IMS network and is expressed in the same format as the SIP URI. The P-CSCF 31 transfers the Register message to the I-CSCF 51, and the I-CSCF 51 transfers the Register message to the S-CSCF 41.

(S202) On the other hand, the S-CSCF 41 transmits an AV-Req to the HSS 6 in order to acquire an AV (Authentication Vector) as authentication information (information necessary for authentication and key generation). AV includes, for example, the following elements.
AV: = RAND || XRES || CK || IK || AUTN
RAND: random number 128bit
XRES: Expected response 32-128bit
CK: Encryption key 128bit
IK: Integrity key 128bit
AUTN: Authentication token 128bit
SQN: Sequence number based on AUTN (monotonically increasing each time an AV is generated)

(S203) Here, the HSS 6 normally generates N (N> 1) AVs at a time. Then, the HSS 6 responds to the S-CSCF 41 with AV-Req-Resp including these N AVs. Accordingly, the S-CSCF 41 holds AV as authentication information.

(S204) Then, the S-CSCF 41 responds 401 Auth_Challenge to the I-CSCF 51. 401 Auth_Challenge includes at least RAND, AUTN, and SQN. The I-CSCF 51 responds with the 401 Auth_Challenge to the P-CSCF 41, and the P-CSCF 41 responds with the 401 Auth_Challenge to the user terminal 1. Thereby, the user terminal can decode and hold the SQN.

(S205) Next, the user terminal 1 transmits a Register message to the P-CSCF 41 again. The P-CSCF 41 transfers the Register message to the I-CSCF 51, and the I-CSCF 51 transfers the Register message to the S-CSCF 41.

(S206) On the other hand, S-CSCF41 transmits UP-Req to HSS6 in order to acquire the subscriber information UP (User Profile) of the said user terminal (Cx-Pull).

(S207) Here, the HSS 6 searches for the subscriber information UP in the user terminal. Then, UP-Req-Resp including the subscriber information UP is returned to the S-CSCF 41. As a result, the S-CSCF 41 holds the subscriber information UP of the user terminal 1.

(S208) Finally, the S-CSCF 41 responds to the I-CSCF 51 with 200 Auth_Ok indicating a successful authentication. Then, the I-CSCF 51 responds with the 200 Auth_Ok message to the P-CSCF 31, and the P-CSCF 31 responds with the 200 Auth_Ok message to the user terminal 1. As a result, the user terminal 1 completes the authentication process for the first IMS network.

(S220) Here, it is assumed that a failure or disaster occurs in the first IMS network, and the user terminal 1 needs to perform location registration again in the second IMS network prepared for backup.

(S221 to S228) The same sequence as S201 to S208 described above is executed between the user terminal 1 and the second IMS network. As a result, the user terminal 1 completes the authentication process for the second IMS network.

3GPP TS33.102, "3G Security; Securityarchitecture" 3GPP TS33.203, "3G security; Access security for IP-based services"

  According to FIG. 2, if a failure occurs in the first IMS network, all user terminals 1 connected to the first IMS network must switch to the second IMS network. That is, all the user terminals 1 need to execute the authentication process in the location registration sequence again with the second IMS network. At this time, there has been a problem that the traffic load on the HSS 6 is rapidly increased by the authentication process executed for each user terminal 1. In particular, according to HSS6, the processing load amount related to the generation of AV is large. Therefore, in the HSS 6, when a large number of AV-reqs in a large number of user terminals 1 are received from the S-CSCF, the processing load becomes enormous and a processing delay is greatly generated.

  Of course, as described above, the HSS 6 can generate N AVs at a time. However, all these AVs are stored in the S-CSCF 41 of the first IMS network at the normal time. That is, the S-CSCF 42 of the second IMS network at the time of backup cannot use these AVs and needs to transmit AV-req to the HSS 6 again.

  Therefore, an object of the present invention is to provide a terminal authentication method and a proxy subscriber information server in which a large number of user terminals can switch an IMS network at a time without enormous processing load on a specific HSS. .

According to the present invention,
A first session control server located in the first IP subsystem network;
A second session control server located in the second IP subsystem network;
A subscriber information server accessible from the first and second IP subsystem networks;
A method of switching an IP subsystem network in a system having user terminals capable of communicating via a transport network interconnected to a first and second IP subsystem network,
The system further comprises a proxy subscriber information server accessible from the first and second IP subsystem networks,
A first step in which a user terminal executes a location registration sequence with a first session control server of a first IP subsystem network;
A second step in which the first session control server transmits a location registration request to the proxy subscriber information server;
A third step in which the proxy subscriber information server acquires and holds authentication information in the user terminal from the subscriber information server;
A fourth step of transmitting a location registration request to the second session control server when the user terminal switches from the first IMS network to the second IMS network;
The second session control server includes a fifth step of acquiring and holding authentication information based on the user terminal from the proxy subscriber information server.

According to another embodiment of the IP subsystem network switching method of the present invention,
A proxy subscriber information server acquires and holds subscriber information based on the user terminal from the subscriber information server;
A seventh step in which the user terminal transmits the location registration request again to the second session control server of the second IP subsystem network;
It is also preferable that the second session control server further includes an eighth step of acquiring and holding the subscriber information from the proxy subscriber information server.

According to another embodiment of the IP subsystem network switching method of the present invention,
The first session control server and the second session control server are S-CSCF (Serving-Call Session Control Function),
The subscriber information server is an HSS (Home Subscriber Server),
The proxy subscriber information server is a proxy HSS,
The authentication information is AV (Authentication Vector),
Regarding the second step, it is also preferable that the first S-CSCF transmits a 3rd-Party Register location registration request to the proxy HSS by iFC (initial Filter Criteria).

According to another embodiment of the IP subsystem network switching method of the present invention,
For the first step, the subscriber information server assigns N pieces of authentication information (AV _{0 to} AV _N-1 ) to the session control server,
For the third step, the subscriber information server assigns N pieces of authentication information (AV _{N to} AV _2N-1 ) to the proxy subscriber information server,
It is also preferable that the third step is not executed as long as kN−1 <L for the predetermined value L.

According to another embodiment of the IP subsystem network switching method of the present invention,
The proxy subscriber information server divides a plurality of pieces of authentication information into R sets,
It is also preferable to store the authentication information in a storage device arranged in a geographically different place in units of sets.

  According to another embodiment of the IP subsystem network switching method of the present invention, the proxy subscriber information server divides each piece of authentication information into R pieces and arranges them at geographically different locations in units of division of the authentication information. It is also preferable to store in a stored storage device.

According to the present invention,
A first session control server located in the first IP subsystem network;
A second session control server located in the second IP subsystem network;
A subscriber information server accessible from the first and second IP subsystem networks;
A proxy subscriber information server located in the second IP subsystem network, capable of communicating with user terminals capable of communicating via a transport network interconnected to the first and second IP subsystem networks There,
A location registration request receiving means for receiving a location registration request from the first session control server of the first IP subsystem network;
An authentication information requesting means for transmitting an authentication information request to the subscriber information server and receiving an authentication information response including the authentication information when receiving the location registration request;
Authentication information storage means for storing the acquired authentication information for a certain period;
An authentication information request is received from the second session control server of the second IP subsystem network, authentication information is selected from the authentication information storage means, and an authentication information response including the authentication information is sent to the second session control server. And an authentication information response means for responding to.

According to another embodiment of the proxy subscriber information server of the present invention,
After the authentication information response means is executed, a subscriber information request means for transmitting a subscriber information request to the subscriber information server and receiving a subscriber information response including the subscriber information of the user terminal;
Subscriber information storage means for storing the acquired subscriber information for a certain period;
A subscriber information request is received from the second session control server of the second IP subsystem network, subscriber information is selected from the subscriber information storage means, and a subscriber information response including the subscriber information is sent to the second session control server. It is also preferable to have subscriber information response means for responding to the second session control server.

According to another embodiment of the proxy subscriber information server of the present invention,
The first session control server and the second session control server are S-CSCFs,
The subscriber information server is HSS,
The proxy subscriber information server is a proxy HSS,
The authentication information is AV,
The location registration request receiving means also preferably receives a location registration request for a 3rd-Party Register based on iFC from the first S-CSCF.

  According to the terminal authentication method and proxy subscriber information server of the present invention, a large number of user terminals can switch the IMS network at a time without imposing a huge processing load on a specific HSS.

It is a system block diagram of the IMS network in a prior art. It is an authentication sequence in the IMS network of a prior art. It is a system configuration diagram of an IMS network in the present invention. It is a location registration sequence in the IMS network at the normal time of the present invention. It is an authentication sequence in the IMS network at the time of backup of the present invention. It is a functional block diagram of the proxy HSS in this invention. It is explanatory drawing showing the output progress of the authentication information from HSS. It is the 1st explanatory view which distributes and manages authentication information AV by proxy HSS. It is the 2nd explanatory view which distributes and manages authentication information AV by proxy HSS.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 3 is a system configuration diagram of the IMS network in the present invention.

  According to the system of FIG. 3, as compared with FIG. 1, the proxy HSS 7 is further connected to the second IMS network for backup. Accordingly, the S-CSCF 42 of the second IMS network performs user authentication by communicating with the proxy HSS 7 instead of the HSS 6. When the proxy HSS 7 receives the registration request (Register) from the S-CSCF 41 of the first IMS network, the proxy HSS 7 acquires the authentication information (AV) from the HSS 6. Then, the proxy HSS 7 holds the authentication information for an authentication information request from the S-CSCF 42.

  FIG. 4 is a location registration sequence in a normal IMS network according to the present invention.

(S401 to S408) In the normal state, the same sequence as S201 to S208 described above is executed between the user terminal 1 and the first IMS network. Here, the subscriber information UP acquired from the HSS 6 includes iFC (initial Filter Criteria) information as a calling condition for the application server. According to FIG. 4, the iFC information is defined to transmit a location registration request for the 3rd-Party Register to the proxy HSS 6 as the application server.

(S411) After executing the location registration sequence of the user terminal 1, the first S-CSCF 41 transmits a location registration request for the 3rd-Party Register to the proxy HSS 7 by iFC processing.

(S412) When the proxy HSS 7 does not hold the authentication information in the user terminal 1, the proxy HSS 7 inquires the HSS 6 about the authentication information using the Diameter protocol. The Diameter protocol is a next-generation AAA (Authentication, Authorization and Accounting) standard protocol that replaces RADIUS (Remote Authentication Dial In User Service). The proxy HSS 7 transmits DiameterMAR to the HSS 6 in order to acquire the authentication information of the user terminal 1.

(S413) The HSS 6 further generates N (N> 1) AVs based on the received DiameterMAR. In S403, which is a normal location registration sequence, AV _{0 to} AV _N-1 are generated. Therefore, in S413, the following AV _{N to} AV _2N-1 are generated. Then, the HSS 6 responds to the proxy HSS 7 with the DiameterMAA including these N AVs.

(S414) Then, the proxy HSS 7 holds the AV received from the HSS 6 in an unused state. Finally, the proxy HSS 7 responds to the S-CSCF 41 with 401 Ok for the third party register in S411.

  Thus, the location registration sequence of the present invention further includes S411 to S414 in addition to S401 to S408.

(S420) Here, it is assumed that a failure or disaster occurs in the first IMS network, and the user terminal 1 needs to switch to the second IMS network prepared for backup. That is, the user terminal 1 needs to execute the location registration sequence again for the second IMS network.

  FIG. 5 is an authentication sequence in the IMS network at the time of backup according to the present invention.

(S501) At the time of backup, the user terminal transmits a Register message to the P-CSCF 32 of the second IMS network via the access network. The P-CSCF 32 transfers the Register message to the I-CSCF 52, and the I-CSCF 52 transfers the Register message to the S-CSCF 42.

(S502) On the other hand, the S-CSCF 42 transmits AV-Req to the proxy HSS 7 in order to acquire the AV of the authentication information.

(S503) Here, the proxy HSS 7 selects the N AVs stored in the normal time. Then, the proxy HSS 7 responds to the S-CSCF 42 with AV-Req-Resp including these N AVs. Accordingly, the S-CSCF 41 holds AV as authentication information. As described above, when the proxy HSS 7 normally holds the authentication information in a normal state, the S-CSCF 42 can acquire the authentication information from the proxy HSS 7 instead of the specific HSS 6 at the time of backup. Load and processing time can be reduced.

(S504) At this time, the proxy HSS 7 transmits UP-Req to the HSS 6 in order to acquire and hold the subscriber information UP in advance.

(S505) In response to this, the HSS 6 searches for the subscriber information UP, and responds to the proxy HSS 7 with UP-Req-Resp including the subscriber information UP. Accordingly, the proxy HSS 7 can hold the subscriber information UP before the authentication sequence is successful.

(S506) After S503, the S-CSCF 42 responds to the I-CSCF 52 with 200 Auth_Ok indicating successful authentication. Then, the I-CSCF 52 responds with the 200 Auth_Ok message to the P-CSCF 32, and the P-CSCF 32 responds with the 200 Auth_Ok message to the user terminal 1.

(S507) Next, the user terminal 1 transmits a Register message to the P-CSCF 42 again. The P-CSCF 42 transfers the Register message to the I-CSCF 52, and the I-CSCF 52 transfers the Register message to the S-CSCF 42.

(S508) On the other hand, the S-CSCF 42 transmits UP-Req to the proxy HSS 7 in order to acquire the subscriber information UP of the user terminal (Cx-Pull).

(S509) Here, the proxy HSS 7 responds to the S-CSCF 42 with UP-Req-Resp including the subscriber information UP. As a result, the S-CSCF 42 holds the subscriber information UP of the user terminal 1. As described above, the proxy HSS 7 can acquire the subscriber information UP from the HSS 6 in advance before the authentication sequence is successful, and the registration time can be shortened.

(S510) Then, the S-CSCF 42 responds to the I-CSCF 52 with 200 Auth_Ok indicating a successful authentication. Then, the I-CSCF 52 responds with the 200 Auth_Ok message to the P-CSCF 32, and the P-CSCF 32 responds with the 200 Auth_Ok message to the user terminal 1.

  FIG. 6 is a functional configuration diagram of the proxy HSS in the present invention.

  According to FIG. 6, the proxy HSS 7 includes a location registration request receiving unit 71, an authentication information requesting unit 72, an authentication information storing unit 73, an authentication information responding unit 74, a subscriber information requesting unit 75, and subscriber information. A storage unit 76 and a subscriber information response unit 77 are provided. These functional components are realized by executing a program that causes a computer installed in the application server to function, and function as a proxy HSS.

  The location registration request receiving unit 71 receives a location registration request for the 3rd Party Register from the first S-CSCF 41 of the first IMS network (see S411 in FIG. 4). The location registration request of the 3rd Party Register is based on iFC (initial Filter Criteria) in the first S-CSCF 41. The fact that the location registration request has been received is output to the authentication information request unit 72.

  When receiving the location registration request, the authentication information request unit 72 transmits an authentication information request (Diameter MAR) to the HSS 6 and receives an authentication information response (Diameter MAA) including the authentication information (S412 in FIG. 4). And S413). The received authentication information AV is output to the authentication information storage unit 73.

  The authentication information storage unit 73 stores the acquired authentication information AV for a certain period (see S414 in FIG. 4).

  The authentication information response unit 74 receives the authentication information request AV-Req from the second S-CSCF 42 of the second IMS network, selects the authentication information from the authentication information storage unit 73, and includes the authentication information. The response AV-Req-Resp is returned to the second S-CSCF 42 (see S502 and S503 in FIG. 5).

  After the authentication information response unit 74 is executed, the subscriber information request unit 75 transmits a subscriber information request UP-Req to the HSS 6, and a subscriber information response UP-Req- including the subscriber information of the user terminal. Resp is received (see S504 and S505 in FIG. 5). The received subscriber information UP is output to the subscriber information storage unit 76.

  The subscriber information storage unit 76 stores the acquired subscriber information UP for a certain period.

  The subscriber information response unit 77 receives the subscriber information request UP-Req from the second S-CSCF 42 of the second IMS network, selects the subscriber information from the subscriber information storage unit 76, and receives the subscriber information. The subscriber information response UP-Req-Resp including the information is returned to the second S-CSCF 42 (see S508 and S509 in FIG. 5).

  FIG. 7 is an explanatory diagram showing the output progress of authentication information from the HSS.

According to FIG. 7, the output process of the authentication information AV that the HSS 6 assigns to the S-CSCF 41 and the proxy HSS 7 at the normal time is shown.
(S71) First, when receiving the AV-Req from the S-CSCF 41 of the first IMS network, the HSS 6 generates N pieces of authentication information (AV _{0 to} AV _N-1 ). When authentication information AV _{(k-1) N to} AV _kN-1 is expressed, k = 1. k = sequence number SQN is updated every time the authentication information AV is generated. Then, the HSS 6 responds to the S-CSCF 41 with AV-Req-Resp including these authentication information.

(S72) Next, according to the present invention, the HSS 6 generates N pieces of authentication information (AV _{N to} AV _2N-1 ) when receiving the AV-Req from the proxy HSS 7. When authentication information AV _{(k-1) N to} AV _kN-1 is expressed, k = 2. Then, the HSS 6 responds to the proxy HSS 7 with AV-Req-Resp including these authentication information.

(S73) Next, when AV-Req is received from the S-CSCF 41 of the first IMS network, N pieces of authentication information (AV _{2N to} AV _3N-1 ) are generated. When authentication information AV _{(k-1) N to} AV _kN-1 is expressed, k = 3. Then, the HSS 6 responds to the S-CSCF 41 with AV-Req-Resp including these authentication information.

(S74) Here, as long as kN-1 <L with respect to the predetermined value L, the HSS 6 does not execute S72 (S411 to S414 in FIG. 4).

(S75) Upon receiving AV-Req from the S-CSCF 41 of the first IMS network, N pieces of authentication information (AV _{(K-1) N to} AV _KN-1 ) are generated. Here, k = K (predetermined maximum value). Then, the HSS 6 responds to the S-CSCF 41 with AV-Req-Resp including these authentication information, and resets k = 0.

(S76) Next, when receiving the AV-Req from the S-CSCF 41 of the first IMS network, the HSS 6 generates N pieces of authentication information (AV _{0 to} AV _N-1 ). When authentication information AV _{(k-1) N to} AV _kN-1 is expressed, k = 1. Then, the HSS 6 responds to the S-CSCF 41 with AV-Req-Resp including these authentication information.

(S77) Next, when receiving the AV-Req from the proxy HSS 7, the HSS 6 generates N pieces of authentication information (AV _{N to} AV _2N-1 ). When authentication information AV _{(k-1) N to} AV _kN-1 is expressed, k = 2. Then, the HSS 6 responds to the proxy HSS 7 with AV-Req-Resp including these authentication information.

The HSS 6 updates the sequence number SQN every time the authentication information AV is generated. The latest SQN is also maintained by the user terminal. When a new SQN is always used, SQN> SQN _MS is assumed, but according to the description in Patent Document 1, an allowable value L is defined. The user terminal accepts the AV as long as “(SQN _MS− SQN) <L”. Therefore, the authentication information AV ^* for the second IMS network for backup need not be generated every time AV-Req is received from the first S-CSCF of the first IMS network. That is, the authentication information AV ^* for the second IMS network for backup is not generated until AV-Req is received a certain number of times.

  FIG. 8 is a first explanatory diagram in which the authentication information AV is distributed and managed by the proxy HSS.

  When the proxy HSS 7 receives N pieces of authentication information for backup from the HSS 6, the proxy HSS 7 distributes and manages these pieces of authentication information to a plurality of remotely located database servers. According to FIG. 8, N AV [1] to AV [N] are divided into R (R> 1) as the number of databases. Then, each divided AV is transferred to each database and distributedly managed. Even if a failure occurs in one database and the authentication information AV cannot be acquired by being distributed to R databases, new authentication information can be obtained for the HSS 6 by referring to another database. There is no need to request generation of AV, and reliability in accumulating authentication information is improved.

  FIG. 9 is a second explanatory diagram in which the authentication information AV is distributed and managed by the proxy HSS.

  As another embodiment different from FIG. 8, one piece of authentication information AV is divided into R pieces, and the r-th plurality of blocks of each AV are distributed and managed in R pieces of databases as one block. As a result, even if the contents of one database are disclosed to a malicious third party, the authentication information AV cannot be completely restored unless the other R-1 databases are referred to. Safety is improved.

  As described above in detail, according to the terminal authentication method and proxy subscriber information server of the present invention, a large number of user terminals can switch an IMS network at a time without imposing a huge processing load on a specific HSS. Can do.

  Various changes, modifications, and omissions of the above-described various embodiments of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

1 User terminal 2 Gateway 3, 31, 32 P-CSCF
4, 41, 42 S-CSCF
5, 51, 52 I-CSCF
6 HSS
7 Proxy HSS
71 Location Registration Request Reception Unit 72 Authentication Information Request Unit 73 Authentication Information Storage Unit 74 Authentication Information Response Unit 75 Subscriber Information Request Unit 76 Subscriber Information Storage Unit 77 Subscriber Information Response Unit

Claims (9)

A first session control server located in the first IP subsystem network;
A second session control server located in the second IP subsystem network;
A subscriber information server accessible from the first and second IP subsystem networks;
A method of switching an IP subsystem network in a system having user terminals capable of communicating via a transport network interconnected to a first and second IP subsystem network,
The system further includes a proxy subscriber information server accessible from the first and second IP subsystem networks,
A first step in which the user terminal executes a location registration sequence with a first session control server of a first IP subsystem network;
A second step in which a first session control server transmits a location registration request to the proxy subscriber information server;
A third step in which the proxy subscriber information server obtains and holds authentication information in the user terminal from the subscriber information server;
A fourth step of transmitting a location registration request to the second session control server when the user terminal switches from the first IMS network to the second IMS network;
A second session control server has a fifth step of acquiring and holding the authentication information based on the user terminal from the proxy subscriber information server, and a method for switching an IP subsystem network. A sixth step in which the proxy subscriber information server acquires and holds subscriber information based on the user terminal from the subscriber information server;
A seventh step in which the user terminal again transmits a location registration request to the second session control server of the second IP subsystem network;
2. The IP subsystem network switching according to claim 1, further comprising an eighth step in which the second session control server acquires and holds the subscriber information from the proxy subscriber information server. 3. Method. The first session control server and the second session control server are S-CSCF (Serving-Call Session Control Function),
The subscriber information server is an HSS (Home Subscriber Server),
The proxy subscriber information server is a proxy HSS;
The authentication information is AV (Authentication Vector),
3. The second step, wherein the first S-CSCF transmits a location registration request for a 3rd-Party Register to the proxy HSS by iFC (initial Filter Criteria). IP subsystem network switching method. For the first step, the subscriber information server assigns N pieces of authentication information (AV _{0 to} AV _N-1 ) to the session control server,
For the third step, the subscriber information server assigns N pieces of authentication information (AV _{N to} AV _2N-1 ) to the proxy subscriber information server,
4. The IP subsystem network switching according to claim 1, wherein the third step is not executed as long as kN−1 <L with respect to the predetermined value L. 5. Method. The proxy subscriber information server divides a plurality of the authentication information into R (R> 1) sets,
5. The IP subsystem network switching method according to claim 1, wherein the authentication information is stored in a storage device arranged in a geographically different place in units of the authentication information. The proxy subscriber information server divides each authentication information into R (R> 1) pieces,
5. The method of switching an IP subsystem network according to claim 1, wherein the authentication information is stored in a storage device arranged in a geographically different place in units of division of the authentication information. 6. A first session control server located in the first IP subsystem network;
A second session control server located in the second IP subsystem network;
A subscriber information server accessible from the first and second IP subsystem networks;
A proxy subscriber information server located in the second IP subsystem network, capable of communicating with user terminals capable of communicating via a transport network interconnected to the first and second IP subsystem networks There,
A location registration request receiving means for receiving a location registration request from the first session control server of the first IP subsystem network;
An authentication information requesting means for transmitting an authentication information request to the subscriber information server when receiving the location registration request and receiving an authentication information response including the authentication information;
Authentication information storage means for storing the acquired authentication information for a certain period;
An authentication information request is received from the second session control server of the second IP subsystem network, the authentication information is selected from the authentication information storage means, and an authentication information response including the authentication information is sent to the second session. A proxy subscriber information server comprising authentication information response means for responding to the control server. After the authentication information response means is executed, a subscriber information request means for transmitting a subscriber information request to the subscriber information server and receiving a subscriber information response including subscriber information of the user terminal;
Subscriber information storage means for storing the acquired subscriber information for a predetermined period;
A subscriber information request is received from the second session control server of the second IP subsystem network, the subscriber information is selected from the subscriber information storage means, and a subscriber information response including the subscriber information is received. The proxy subscriber information server according to claim 7, further comprising subscriber information response means for responding to the second session control server. The first session control server and the second session control server are S-CSCFs,
The subscriber information server is an HSS;
The proxy subscriber information server is a proxy HSS;
The authentication information is AV;
9. The proxy subscriber information server according to claim 7, wherein the location registration request receiving unit receives a location registration request of a 3rd-Party Register based on iFC from the first S-CSCF.

Images