WO2007056925A1

WO2007056925A1 - A session control method and equipment in ims network

Info

Publication number: WO2007056925A1
Application number: PCT/CN2006/002799
Authority: WO
Inventors: Yajuan Wu; Fenqin Zhu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-11-15
Filing date: 2006-10-20
Publication date: 2007-05-24
Also published as: CN1968262A; CN1968262B

Abstract

A session control method and equipment in IMS network, it configures the authority information of AS (application server) which represents user to initiate session, during the AS represents the user to initiate the session, the IMS network function entity obtains the authority information, and controls the session process initiated by AS representing the user according to the authority information. The present invention detects the authority whether AS has representing the user to initiate the session by IMS network function entity, so that it can effectively control the session process initiated by AS representing the user, and avoids that AS make bold to represent the other users to initiate the session, so the security hidden trouble existed in network is removed; the set manner of the authority information that AS represents the user to initiate the session is flexible, and many of the authority detect realization process that AS represents the user to initiate the session are provided, it makes the present invention meets the all sorts of detect need in the real network, and realizes the intent of improving the network security and user’s satisfaction.

Description

Session control method and device in IMS network

The present invention relates to the field of network communication technologies, and in particular, to a session control method and apparatus in an IMS network. Background of the invention

With the development of broadband networks, mobile communications will not only be limited to traditional voice communications, multimedia services combining multiple media types such as audio, video, pictures and text will be gradually developed, through with presence (presentation services), groups Management, short message, WEB (web) browsing, location information, PUSH (push service), file sharing and other data services can meet the diverse needs of users.

IP Multimedia Subsystem (IMS), IMS (IP Multimedia Subsystem), IMS superimposed on the packet domain network, CSCF (Call Session Control Function), MGCF (Media Gateway Control Function, Media) The gateway control function), the MR Multimedia Resource Function, and the HSS (Home Subscriber Server) are composed of functional entities, such as: CSCF can be further divided into S-CSCF (Serving CSCF, Serving CSCF), P- CSCF (Proxy CSCF, Proxy CSCF) and I-CSCF (Interrogating CSCF, Query CSCF) three functional entities. The S-CSCF is the service switching center of the IMS, performs session control, maintains session state, is responsible for managing user information, and generates charging information. The P-CSCF is an access point for the terminal user to access the IMS, completes user registration, and is responsible for QoS. For control and security management, the I-CSCF is responsible for interworking between MS domains, managing the allocation of S-CSCFs, hiding network topology and configuration, and generating billing data. The MGCF controls the gateway to implement interworking between the IMS network and other networks. The MRF provides media resources such as audio and video, codec and multimedia conference bridge. The HSS is a user database that stores subscription data and configuration information of IMS users.

Since the structure of the IMS network is independent of the underlying bearer network, the IMS network can also be applied to other packet networks outside the 3GPP defined packet domain network.

Each user who has signed an IMS service is assigned one or more private user identifiers IMPI by the home network operator for use in the registration, authorization, management, and accounting processes. IMPI uses NAI (Network Access Identifier). In the identification format, each IMS user also has one or more public user identifiers IMPU, which are used to identify themselves and find each other when communicating with other users. Private user IDs are generally not publicly available, and public user IDs are publicly available and used during conversations using various types of services.

As the business capabilities of PRESENCE, MESSAGING, CONFERENCING, and group services are componentized and standardized, and applied in the IMS network, a new PSI (Public Service Identitity, Public Service Identity) was introduced.

The difference between the public service identifier and the public user identifier is that the public user identifier is used to identify the user and find the identity of the other party in the use of various services, and the public service identifier is the service, and the services generally reside in the service. The application server AS, such as a local service, can also be used to identify a group. For example, in a chat room service, a public service identifier such as sip:chatlist_X@example.com can It is used to represent a chat group. Each user can establish a session with this PSI, and send and receive messages through the AS where the PSI is located and other participants in the chat session.

The format of the PSI can be a SIP URI or a TEL URL.

At present, the AS in the IMS network can initiate a call on behalf of a user represented by a public user identifier or a service represented by a public service identifier. When the AS initiates a session establishment on behalf of the user, the request message indicates that the domain of the initiator is filled. The identity of the user.

When the AS initiates a session on behalf of the IMPUL (IP Multimedia Public User Identity) or the PSI, the AS needs to obtain the address of the S-CSCF. If the AS initiates a session request on behalf of the user, the AS cannot obtain one for the IMPU. The address of the serving S-CSCF, the AS cannot initiate this session request on behalf of the user. If the AS initiates a session request using the PSI and the PSI is not assigned an S-CSCF address, the AS uses a mechanism such as DNS to complete the routing process of the SIP message and directly sends the session initiation request to the called network. If the AS obtains the address of the S-CSCF serving the IMPU or PSI, the AS sends a session initiation request to the S-CSCF.

Since it is necessary to prevent the service request initiated by the AS and the subsequent service traffic from being fraudulent or insecure, it is necessary to perform necessary security and authentication procedures for the AS. The security and authentication process of the IMS network to the AS is implemented through the AS permission list.

The AS allows the list to check whether the AS that sends the query request is allowed to perform the query. The check is performed in the AS granularity. Only the AS that has passed the check of the list can process the subsequent messages.

However, if the AS initiates a service request on behalf of the user, if an AS located in the AS allow list obtains user information in some way, the AS can replace other users in the IMS network according to the user information obtained by the AS. Initiating a call, although the AS may only be able to initiate a call request on the IMS network on its own behalf, such as an advertisement push service. Other users or application servers in the network will receive call requests initiated by the user in the AS, which will cause hidden dangers to the network security and damage the legitimate interests of the users. Summary of the invention T/CN2006/002799 The object of the present invention is to provide a session control method and device in an MS network, which can detect the security risks existing in the network and ensure the legality of the user by detecting the authority of the AS to initiate a session on the user. The benefits are not compromised.

In order to achieve the above object, the method for controlling a session in an IMS network provided by the present invention includes: Having an AS on the IMS network to perform the permission information of the user on behalf of the user, the method specifically includes: initiating a session process on the AS on behalf of the user The IMS network function entity obtains the rights information, and determines, according to the obtained rights information, the rights of the AS that initiates the session on behalf of the user, and the IMS network function entity performs the session process initiated by the AS on behalf of the user according to the determined rights. control.

The method includes: the IMS network function entity determining, according to the obtained rights information, whether the AS that initiates the session on behalf of the user has the right to initiate a session on behalf of the user. If the AS has the right to initiate a session on behalf of the user, the IMS network function entity allows the AS representative The user initiates a session. If the AS does not have the right to initiate a session on behalf of the user, the IMS network function entity prohibits the AS from initiating a session on behalf of the user.

The IMS network function entity is: HSS or S-CSCF.

The AS is set in the HSS on behalf of the user to initiate the session.

Adding user identification information that allows and/or prohibits the AS to initiate a session on behalf of the user in the AS allow list of the HSS; the method includes:

The AS sends a query request for user data to the HSS;

The HSS checks and controls the session process initiated by the AS on behalf of the user according to the information carried in the query request and the information stored in the AS allow list.

The query request of the user data includes: a query request for address information of the S-CSCF corresponding to the user; and the step of checking and controlling the HSS includes:

The HSS obtains the corresponding entry in the AS allowed list according to the user data index information carried in the query request;

The HSS determines whether the query is successful according to the AS identifier information, the user identifier, and the entry information carried in the query request.

If it is determined that the S-CSCF address information is allowed to be queried, and the AS is allowed to initiate a session on behalf of the user, the S-CSCF address information is carried in the response message of the successful query and transmitted to the AS;

If it is determined that the S-CSCF address information is not allowed to be queried, or the S-CSCF address information is not queried, or the AS is not allowed to initiate a session on behalf of the user, the S-CSCF address information is carried in the response message of the query failure and transmitted to the AS.

The predetermined field in the User Profile of the HSS is set to the authority information of the AS to initiate a session on behalf of the user. The predetermined field is AS information, and the method includes:

The S-CSCF determines, according to the SIP session establishment request message sent by the AS, that the session to be established is an AS originating session, and determines whether the AS profile downloaded from the HSS includes the AS information.

If the AS information is included, determining that the AS has the right to initiate a session on behalf of the user, allowing subsequent processing of the SIP session establishment request message;

If the AS information is not included, it is determined that the AS does not have the right to initiate a session on behalf of the user, and the subsequent processing of the SIP session establishment request message is refused.

Set the AS ID information that allows the AS to initiate a session on behalf of the user in the User Profile of the HSS.

Set the AS identity information that allows the AS to initiate a session on behalf of the user in the User Profile in the registered state; or

Set the AS identity information that allows the AS to initiate a session on behalf of the user in the unregistered User Profile; or

Set the AS identification information that allows the AS to initiate a session on behalf of the user in both the registered and unregistered user profiles; or

Set the AS identification information that allows the AS to initiate a session on behalf of the user in the User Profile that is not related to the registration status. The method includes:

The S-CSCF determines, according to the SIP session establishment request message sent by the AS, the information carried in the SIP session establishment request message and the filtering rule in the User Profile downloaded from the HSS when the session to be established is the AS originating session. The information is matched, and it is determined whether the AS identification information that allows the AS to initiate the session on behalf of the user and the AS that sends the SIP session establishment request message are successfully matched;

If the matching is successful, determining that the AS that initiates the session on behalf of the user has the right to initiate a session on behalf of the user, and allows subsequent processing of the SIP session establishment request message;

If the matching is unsuccessful, it is determined that the AS that initiates the session on behalf of the user does not have the authority to initiate the session on behalf of the user, and the subsequent processing of the SIP session establishment request message is refused.

The step of determining that the session to be established is an AS originating session specifically includes:

The session to be established is determined to be an AS originating session according to the contents of the orig field, the record route header field, and the p-asserted-identity in the SIP session establishment request message.

The present invention also provides a session control apparatus in an IMS network, including: an acquisition authority information module: in the process of the AS initiating a session on behalf of the user, obtaining the authority information of the AS on behalf of the user to initiate the session, and transmitting the permission information to the determining permission module; T N2006/002799 determining the privilege module: determining, according to the privilege information received by the AS, the information carried in the request message transmitted by the AS, whether the AS is allowed to initiate a session on behalf of the user, and transmitting the permitted or prohibited information to the session control module;

The session control module: performs corresponding control processing on the process in which the AS initiates a session on behalf of the user according to the information that is allowed or prohibited.

The device is: S-CSCF or HSS. According to the description of the foregoing technical solution, the present invention can enable the IMS network function entity to detect whether the AS has the authority to initiate a session on behalf of the user according to the authority information, so that the AS representative can effectively control the AS representative. The session initiated by the user avoids the phenomenon that the AS arbitrarily initiates a call on the IMS network on behalf of other users, and eliminates the security risks existing in the network. The AS information of the present invention can be set in the HSS on behalf of the user to initiate the session, and the setting is set. The method is flexible, such as setting user identification information that allows and/or prohibits the AS to initiate a session on the user in the AS allow list or the User Profile, and uses the original field content in the User Profile, etc.; the present invention provides multiple ASs to initiate a session on behalf of the user. The privilege detection implementation process enables the present invention to meet various detection requirements in an actual network, such as detecting the user's initiation of session authority on behalf of the user in the process of querying the user data that the AS is allowed to read, and then sending a SIP session on the AS. When creating a request message to the S-CSCF The AS initiates the detection of the session authority on behalf of the user; thus, the technical solution provided by the invention achieves the purpose of improving network security and improving user satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic diagram of a session control device of the present invention. Mode for carrying out the invention

If the AS can check the eligibility of the user to initiate a session on behalf of the user, the AS can effectively prevent the AS from initiating a call on the IMS network on behalf of the user, thus avoiding the security risks in the network. , so that the legitimate interests of users are effectively guaranteed.

Therefore, the main technical content of the present invention is: setting the privilege information of the AS on behalf of the user to initiate the session in the IMS network, and the IMS network function entity acquires the privilege information, and the AS is based on the privilege information. Controls the session process initiated on behalf of the user.

The technical solutions provided by the embodiments of the present invention are further described below.

The IMS network of the present invention is provided with the privilege information that the AS initiates the session on behalf of the user, and the privilege information can be set in the HSS, such as in the AS allow list or in the User Profile. Right The limit information may be information newly added for the permission. For example, when the permission information is set in the AS allow list of the HSS, the extended AS allow list is set, and the new field content is set in the AS' allow list. The content of the field is the authority information of the AS on behalf of the user to initiate the session, such as setting the user identification information that allows the AS to initiate the session on behalf of the user, or setting the user identification information that prohibits the AS from initiating the session on behalf of the user, or setting the user identification information that allows the AS to initiate the session on behalf of the user. And user identification information that prohibits the AS from initiating a session on behalf of the user. The user identification information set by the above may be: IMPU or MSISDN (Mobile Subscriber ISDN Number) information. The privilege information can also utilize the original information content, such as when the privilege information is set in the User Profile, using the original AS information, and the like.

When the AS determines that the rights information of the user initiated the session is set in the AS allow list, the present invention can fully utilize the process in which the AS queries the HSS for the user data that is allowed to be read by the AS to implement the session control of the present invention. The basic implementation principle is :

When the AS needs to initiate a session establishment request on behalf of the user, the AS sends a query request to the HSS to obtain user data, the HSS receives the query request, and obtains index information of the user data from the query request, and determines the AS allow list according to the index information. The corresponding entry is determined according to the user data that the AS allows to read and the authority information of the AS on behalf of the user to initiate the session. The AS is allowed to initiate a session on behalf of the user, and returns a corresponding response message to the AS according to the judgment result.

The session control process of the present invention is described in detail below by taking the S-CSCF address information of the calling party user as an example.

The AS is allowed to add user identification information that allows the AS to initiate a session on behalf of the user, such as IMPU or MSISDN information. The AS needs to initiate a session on behalf of the user IMPUa.

Since the S-CSCF allocated for the user is dynamically changed according to the registration status of the user, the AS first needs to send a query request to the HSS to obtain the address of the S-CSCF currently serving the user. The user here is a user with an IMPU.

The AS sends a query request message to the HSS through the sh interface. The query request message carries the public user identifier IMPUa of the user, indicating that the user data that the AS needs to query is the S-CSCF address currently serving the IMPUa.

After receiving the query request from the AS on the Sh interface, the HSS determines the corresponding entry in the AS allow list according to the index of the user data to be queried carried in the query request message, and then, according to the AS identifier carried in the query request message. And the IMPUA to determine whether the AS is allowed to read the S-CSCF address information of the user IMPUA, and the user identification information of the entry that allows the AS to initiate the session on the user includes the IMPUA; if the S-CSCF address information is allowed to be read And the user identification information in the entry that allows the AS to initiate a session on behalf of the user. In the case of the ICMPa, the S-CSCF address information of the user's IMPUA is returned to the AS through the successful response message. If the S-CSCF address information is not allowed to be read or the S-CSCF address information is not found or is in the entry, If the user identification information that allows the AS to initiate the session on the user does not include the IMPUA, the response message of the query failure is returned to the AS when the S-CSCF address is obtained from the response message of the successful query, and the session establishment request is initiated on behalf of the IMPUA. The session establishment request message received by the S-CSCF is a process of detecting the session authority initiated by the AS on behalf of the user, and detecting the message sent by the successful AS, which is a secure aggregation setup request message. When the AS receives the response message of the query failure, the AS cannot obtain the S-CSCF address corresponding to the IMPUA. Therefore, the session establishment request cannot be initiated on behalf of the IMPUA, thereby preventing the S-CSCF from receiving the insecure session establishment request message. .

The method can be conveniently applied to the newly implemented IMS system. The present invention implements the authority detection of the AS on behalf of the user to initiate a session in the query request detection process of the AS, thereby improving the service processing efficiency.

In view of the fact that the existing MS system has been relatively stable, in order to minimize the impact of the technical solution of the embodiment of the present invention on the existing application, the present invention can also add an additional processing procedure to check the S-CSCF process. Whether the AS has the right to initiate a session on behalf of the user, so that the process of checking the authority of the AS on behalf of the user to initiate the session introduced by the present invention does not affect the existing process of detecting the query request to the AS.

In addition to querying the S-CSCF process, an additional process is added to implement the specific process of the AS to initiate a session on behalf of the user.

The AS sends a query request message to the HSS through the sh interface. The query request message carries the public user identifier MSISDNb of the user, indicating that the user data that the AS needs to query is the S-CSCF address currently serving the MSISDNb.

After receiving the query request message from the AS on the Sh interface, the HSS determines the corresponding entry in the AS allow list according to the index of the user data to be queried carried in the query request message, and then, according to the AS identifier carried in the query message. The MSISDNb determines whether the AS is allowed to read the S-CSCF address of the user MSISDNb.

After the foregoing process ends, and after determining that the AS is allowed to read the S-CSCF address information, the AS performs a permission check process for the user to initiate a session. The specific process is as follows: The HSS needs to query the user according to the query request message. The data index information is retrieved to the corresponding entry in the AS allow list. Then, according to the AS identifier, the MSISDNb, and the corresponding entry of the list in the query request message, the AS identifies the user identification information that the AS initiates the session on behalf of the user to determine whether the AS is Allows a user to initiate a session. If allowed, the HSS returns the S-CSCF address information of the user MSISDNb to the AS through a successful response message, and the AS obtains the S-CSCF address according to the obtained S-CSCF address. The PT/CN2006/002799 initiates a session establishment request on behalf of the MSISDNb. At this time, the session establishment request message received by the S-CSCF is a message that is sent by the AS on behalf of the user to initiate the session authority detection process and detects the successful AS. Aggregate the setup request message. If not allowed, the HSS returns the response message of the query failure to the AS, and the AS cannot obtain the S-CSCF address corresponding to the MSISDNb. Therefore, the session establishment request cannot be initiated on behalf of the MSISDNb, thereby avoiding the insecure reception by the S-CSCF. Request message.

When the AS initiates a session request on the PSI, the AS can query the address information of the S-CSCF from the HSS through the SH interface, or obtain the address of the S-CSCF through static configuration, and directly send the session establishment request message to the specified S- CSCF. In the case of static configuration, it is not possible to use the AS Allow List to implement the eligibility check process for the AS to initiate a session on behalf of the user.

The address of the S-CSCF is configured on the AS, which means that the IMS operator has a certain trust relationship with the AS. However, there are still possible security vulnerabilities. Therefore, when the address of the S-CSCF is configured on the AS, The invention proposes another method to avoid the phenomenon that the AS may represent a PSI that the user does not have to represent on the basis of the configuration: the IMPU initiates a session request to establish a session.

In this method, the authority information of the AS on behalf of the user to initiate the session can be set in the User Profile.

After the AS sends a SIP session establishment request message to the S-CSCF, the S-CSCF treats it as a normal SIP session establishment request message, and checks according to the User Profile information downloaded from the HSS, such as performing iFC (filter rule). The matching process, the matching process is the same as the existing iFC matching process, in that each triggering rule is matched according to each information field in the received SIP message, and if the matching is successful, it corresponds to an AS. The difference is that when the S-CSCF determines that the call is an AS originated call, it is necessary to add an AS to perform a permission check on the user initiated session in the above matching process.

The following describes the permission checking process of the AS on behalf of the user to initiate a session in the embodiment of the present invention by two specific examples.

Example 1. Set the permission information of the AS on behalf of the user to initiate a session as the predetermined field information already in the User Profile, such as AS information.

For the call initiated by the AS on behalf of the IMPU/PSI, the S-CSCF is downloaded from the HSS according to it.

During the iFC matching process, when the AS that initiates the session establishment request message appears in the user's iFC list, that is, the user's session information, such as registration information, can be routed to the AS that initiated the session establishment request message, indicating that the AS The AS can initiate a session on behalf of the user; when the AS that initiated the session establishment request message does not appear in the user's iFC list, that is, the user's session information, such as registration information, cannot be routed to the AS that initiated the session establishment request message, indicating that the AS The AS cannot initiate a session on behalf of the user. PT/CN2006/002799 This method is more suitable for IMS networks that have applied S-CSCF and HSS, and this method has no effect on the existing network architecture of IMS and the message transmission between S-CSCF and HSS.

Example 2: Setting the rights information of the AS to initiate a session on the user is the newly added field content in the User Profile. The content of the field is used to indicate the authorization list that allows the AS to initiate a session on behalf of the user, such as adding/disabling the user profile. The AS initiates the AS identification information of the user on behalf of the user.

For the originating call of the AS on behalf of the IMPU/PSI, the newly added field content in the User Profile needs to be detected to detect whether the AS is in the authorization list. If the AS is in the authorization list, the AS can initiate a session on behalf of the user. - The CSCF allows the session establishment request sent by the AS; if the AS is not in the authorization list, it indicates that the AS cannot initiate a session on behalf of the user, and the S-CSCF rejects the session establishment request sent by the AS.

Example 2 is applicable to the case where the S-CSCF and HSS are newly applied to the IMS network.

In the description of the foregoing example 1, the example 2, the S-CSCF determines that the AS-initiated session is the originating call of the AS on behalf of the IMPU/PSI: the orig (source) field in the session establishment request message is used to discriminate the The call is the originating call, and the AS originating call is identified by the record route header field. The p-asserted-identity (p is the private header field) is used to identify which IMPU/PSI the AS represents. Originated originating call.

In the process of implementing session control using the iFC (filtering rule) matching mechanism, it is considered that in the R6 version, the download of the iFC needs to distinguish the user registration status. Therefore, when the iFC is configured, if the AS initiates a session establishment request on behalf of the user. If the current registration status of the user needs to be distinguished, the iFC used to check the validity of the AS on behalf of the user will be configured only in the user profile of the corresponding registration status, such as only in the REGISTERED section, or only configured. The UNREGISTERED section is not configured, or is configured in a User Profile that is not related to the registration status. If the AS initiates a session establishment request on behalf of the user, it does not need to distinguish the current registration status of the user, that is, regardless of the current registration status of the user, and the user profile of the HSS distinguishes the user data according to the registration status, and may be in different registrations. The configuration of this iFC is added to the user profile of the state.

The invention enhances the inspection process of the AS in the existing IMS network, that is, increases the detection of the AS initiated by the user on the IMS network, so that the IMS network can check the AS not only for the AS itself, but also for the AS itself. Further, the AS is a user who initiates a call, thereby avoiding the phenomenon that an application server located in the AS allow list replaces a user to initiate a call when the user does not have the right to initiate a call, thereby eliminating the security risks in the IMS network. Protect the legitimate interests of users.

The session control apparatus in the IMS network provided by the present invention is as shown in FIG.

The device in FIG. 1 mainly includes: an acquisition permission information module, a determination permission module, and a session control module. The obtaining permission information module is mainly used to obtain the permission information of the AS on behalf of the user to initiate the session, and transmit the permission information to the determining permission module.

When the session control device is an HSS, the privilege information of the AS on behalf of the user to initiate the session may be set in the privilege information module, and the privilege information of the AS on behalf of the user to initiate the session may be stored in the form of an AS allow list, as described in the foregoing method. The obtaining permission information module may obtain the permission information of the corresponding AS on behalf of the user to initiate the session according to the query request sent by the AS to obtain the user data that is allowed to be read by the AS, and transmit the permission information to the determined permission module.

When the session control device is an S-CSCF, the right information of the AS on behalf of the user to initiate the session may be set in the HSS, so that the obtaining permission information module needs to obtain the authority information of the AS on behalf of the user to initiate the session from the HSS, as in the above method. description.

The determining permission module is mainly used to determine, according to the rights information received by the AS, the information carried in the request message transmitted by the AS, whether the AS is allowed to initiate a session on behalf of the user, and transmit the permitted or prohibited information to the session control module.

When the session control device is an HSS, the request message transmitted by the AS is a query request message of the user data that is allowed to be read, and the process of determining the permission of the permission module may be performed simultaneously with the processing request process of the HSS to the S-CSCF, or After the query request processing process of the S-CSCF, it is specifically described in the method.

When the session control device is the S-CSCF, the request message transmitted by the AS is a session establishment request message, and the permission module determines that the session to be established is the initial session of the AS on behalf of the user, according to the rights information received by the AS, AS. The information carried in the transmitted request message determines whether the AS is allowed to initiate a session on behalf of the user. The specific implementation process is as described in the foregoing method.

The session control module is mainly used to perform corresponding control processing on the process in which the AS initiates a session on behalf of the user according to the information that is allowed or prohibited.

When the session control device is an HSS, the session control module can control the process of the AS initiating a session on behalf of the user by denying the address information of the S-CSCF to the AS or the address information of the S-CSCF to the AS. Specifically, it is described in the above method.

When the session control device is the S-CSCF, the session control module can control the process of the AS initiating the session on behalf of the user by rejecting the session establishment request message sent by the AS or the session establishment request message sent by the AS. Specifically, it is described in the above method.

While the invention has been described by the embodiments of the invention, it will be understood that

Claims

Rights request

A method for controlling a session in an IMS network, comprising: an AS (application server) initiating a session on behalf of a user, wherein the IMS network is provided with the authority information of the AS on behalf of the user to initiate the session, and the method specifically includes: During the process of initiating a session on behalf of the user, the IMS network function entity acquires the rights information, and determines the authority of the AS that initiates the session on behalf of the user according to the obtained right's limit information, and the IMS network function entity performs the AS according to the determined authority. Controls the session process initiated on behalf of the user.

The method according to claim 1, wherein the method comprises: determining, by the IMS network function entity, whether the AS that represents the user initiated the session has the right to initiate the session on behalf of the user, according to the acquired right information, if the AS has On behalf of the user to initiate a session, the IMS network function entity allows the AS to initiate a session on behalf of the user. If the AS does not have the authority to initiate a session on behalf of the user, the IMS network function entity prohibits the AS from initiating the session on behalf of the user.

3. The method according to claim 1, wherein the IMS network functional entity is: an HSS or an S-CSCF.

4. The method according to claim 1, wherein the AS is set in the HSS on behalf of the user to initiate a session.

•

The method according to claim 4, wherein user identification information that allows and/or prohibits the AS to initiate a session on behalf of the user is added to the AS allow list of the HSS; the method includes:

The AS sends a query request for user data to the HSS;

The method of claim 5, wherein: the query request of the user data comprises: a query request for address information of the S-CSCF corresponding to the user; and the step of the HSS performing the checking and controlling comprises:

The HSS obtains the corresponding entry in the AS allow list according to the user data index information carried in the query request.

The method of claim 1, wherein the predetermined field in the User Profile of the HSS is set to the authority information of the AS to initiate the session on behalf of the user.

The method according to claim 7, wherein the predetermined field is AS information, and the method includes: the S-CSCF determines, according to the SIP session establishment request message sent by the AS, that the session to be established is an AS. When the session is sent, it is determined whether the AS information is included in the User Profile downloaded from the HSS;

9. The method according to claim 1, wherein the AS identification information that allows the AS to initiate a session on behalf of the user is set in the User Profile of the HSS.

10. The method of claim 9 wherein:

Set the AS identification information that allows the AS to initiate a session on behalf of the user in the User Profile that is not related to the registration status.

11. The method of claim 9, wherein the method comprises:

The method according to claim 8 or 11, wherein the determining the session to be established is an AS The steps of the initial session include:

13. A session control device in an IMS network, the device comprising:

Obtaining the permission information module: During the process of the AS initiating the session on behalf of the user, obtaining the permission information of the AS on behalf of the user to initiate the session, and transmitting the permission information to the determining permission module;

Determining the permission module: determining, according to the rights information received by the AS, the information carried in the request message transmitted by the AS, whether the AS is allowed to initiate a session on behalf of the user, and transmitting the permitted or prohibited information to the session control module; the session control module: according to the The received allowed or forbidden information performs corresponding control processing on the process in which the AS initiates a session on behalf of the user.

14. Apparatus according to claim 13 wherein said apparatus is: S-CSCF or HSS.