Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/10—Architectures or entities
  • H04L65/1016—IP multimedia subsystem [IMS]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
  • H04L65/1066—Session management
  • H04L65/1073—Registration or de-registration
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/14—Session management
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/14—Session management
  • H04L67/147—Signalling methods or messages providing extensions to protocols defined by standardisation
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
  • H04L51/04—Real-time or near real-time messaging, e.g. instant messaging [IM]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
  • H04L51/58—Message adaptation for wireless communication

Definitions

• mobile radio users are offered services which are provided by special networks (service networks) which are optimized for the provision of services.
• service networks are connected to the service network via an access network (e.g. a communication network working according to the GPRS standard). It is often of interest for network operators to ascertain the identity of the service users before a service is provided and to register these users if authentication is successful.
• IMS IP Multimedia Subsystem
• a prerequisite for the charging of services requested by a user (service charging) in the IMS is the identification of the user in the IMS, as can be implemented according to the mechanisms described in the 3GPP TS 23.228 version 5.4.1. However, the implementation of these mechanisms requires that communication terminals and the access network essentially have to be adapted or comply with the 3GPP standardization release 5, which is not yet implemented.
• a registration procedure as required above is the subject of German patent application DE 10223248.2.
• a method for identifying a communication terminal (UE) registered in a service network (IMS) when using a ⁇ TO ⁇ is provided with a communication service that can be organized, with communication end devices (UE) accessing the service network (IMS) via an access network (GPRS) connecting the communication terminal device (UE) to the service network (IMS), in which a Pre-step a registration IP address (IP-SRC-UE), which was assigned to the communication terminal (UE) when the communication terminal (UE) registered with the access network (GPRS), received by the service network (IMS) and in this was stored for the respective user of the communication terminal, the registration IP address (IP-SRC-UE) of the service network (IMS) was assigned a public identifier (SIP-Public-ID) of the communication terminal (UE), and during registration of the communication terminal in the service network gives the communication terminal an identifier Chen (token) was assigned by the service network
• IMS IP-SRC-UE
• RN random number
• the identifier (token) and a public identifier are also transmitted, before providing the requested communication service, the identifier transmitted with the messages (SIP Message, SIP INVITE,) on the part of the communication terminal with the identifier data and the transmitted public Identifier can be compared with the corresponding public identifier stored in the service network and - with simultaneous agreement of the identifier with the identifier data and the public identifier contained in the messages to be sent by the communication terminal for the provision of the communication service with the public identifier stored in the service network Identifier the requested communication service is carried out, and - if the identifier does not match the identifier data and / or the messages to be sent by the communication terminal to provide the communication service e Contained public identifier with the public identifier stored in the service network, an execution of the requested communication service is denied.
• the method according to the invention advantageously does not require any communication terminals or access networks which correspond to standardization regulations of 3GPP "Release 5". Rather, the method according to the invention can also be used with the communication terminals and access networks prevailing today which standardization regulations of 3GPP "Release 1999” (also as “Release.” 3 ") are sufficient. For example, common communication terminal devices are now suitable which only have a conventional" Subscriber Identity Module (SIM) "card.
• SIM Subscriber Identity Module
• a further advantage of the method according to the invention is that the license plate can be “guessed” only with great difficulty, since the license plate is generated from the login IP address and a random number by means of an encryption method
• This and the routing in the access network advantageously ensures that the identifier only reaches the communication terminal with the login IP address, so that in the further course of the method only for this a communication terminal can successfully identify.
• the method according to the invention can be designed such that the identifier is stored in the service network as identifier data, when the identifier assigned to the communication terminal is compared with the identifier data stored in the service network, the identifier assigned to the communication network is compared with the stored identifier. and with simultaneous agreement of the identifier assigned to the communication terminal with the stored identifier and that in the to provide the Communication service on the part of the communication terminal to be sent messages containing the public identifier with the public identifier stored in the service network
• the identification can be carried out in a particularly simple manner, since in just one comparison step the identifier already assigned to the communication terminal during the registration of the communication terminal in the service network needs to be compared with the stored identifier. It is also not necessary to decrypt the license plates, so that the resources of the service network are used only slightly.
• the method according to the invention can also be designed such that the registration IP address and the random number are stored in the service network as identifier data and, after receipt of messages to be sent from the communication terminal to the service network in order to provide the communication service, from the service network ( IMS) the license plate transmitted with these messages is decrypted.
• a comparison of the transmitted identifier with the identifier data stored in the service network then means that the login IP address recovered during the decryption is compared with the stored login IP address. If the recovered login IP address coincides with the stored login IP address and the public ID contained in the messages to be sent by the communication terminal to provide the communication service the requested communication service is carried out with the public identifier stored in the service network.
• the license plate is marked as invalid when a predetermined validity period of the license plate has elapsed.
• the license plate can only be used for a certain period of validity. If the license plate becomes known to unauthorized persons, the duration of any undesired use is limited.
• the number plate can also be decrypted by the switching center of the service network.
• the method according to the invention can also be carried out in such a way that a switching center of the service network compares the license plate number transmitted by the communications terminal to be sent to provide the communication service with the license plate data and the transmitted public identifier with the public identifier stored in the service network the requested communication service is carried out by the switching center with simultaneous agreement of the license plate with the license plate data and the transmitted public identification with the public identification stored in the service network, and by the switching center if the number plate does not match the registration number Data and / or the transmitted public identifier with the public identifier stored in the service network, the execution of the requested communication service is refused.
• FIG. 1 shows an exemplary embodiment of an arrangement for carrying out the method according to the invention
• FIG. 2 shows a schematic representation of an exemplary embodiment of the method according to the invention.
• the first communication terminal UE1 and the second communication terminal UE2 can be, for example, mobile telephones, laptops or palmtops with a mobile radio module.
• a service network IMS IP multimedia subsystem
• S-CSCF Call session control function
• S-CSCF Serv ing-CSCF
• a message called "IMS Instant Message" can be sent to the second communication terminal UE2; that is, a specific service is requested. This request can only be made after successful registration. If the communication terminal UE1 is successfully registered in the IMS, it must identify or authenticate again immediately before or when requesting a service.
• a user of a communication terminal wants to use services of the IMS service network, his communication terminal is logged into the access network (the access network is now often implemented by a so-called "Release 1999" GPRS network).
• a GPRS user authentication known per se is carried out, this uses the SIM card present in the terminal device.
• the communication terminal device has to register with the service network IMS and thereby authenticate. Both procedures, the registration in the access network GPRS and the registration (registration) in the Service network IMS, for example, are carried out automatically when the terminal is switched on.
• An essential part of the registration with the service network is authentication by the service network.
• a user of the communication terminal is authenticated during registration of the communication terminal with the service network ie the SIM card of the user, which is inserted in the communication terminal, is recognized and thus closed to the person of the user.
• FIG. 2 shows how an IMS user identification for using a communication service or here an IMS service is carried out according to the invention.
• the displayed message flow (SIP message flow) is identical to a standardized message flow shown in the 3GPP in the document TS 24.228 version 5.00, but differs from the standard on the one hand in that the communication terminal has an identifier, a so-called Token is also sent and on the other hand in the identification procedure according to the invention, which is carried out in the service network IMS.
• the exemplary embodiment begins with the registration of a communication terminal UE-A of a subscriber A in an access network, in this example a GPRS access network.
• IP-SRC-UE assign a temporary IP address IP-SRC-UE to the communication terminal UE-A. This IP address allows other network participants to send IP packets to the communication terminal.
• Another communication terminal UE-B of a second subscriber B is also logged in.
• the communication terminal UE-A registers in the service network IMS. In the course of the registration process, which is known from DE 10223248, an identifier (token) is transmitted to the communication terminal UE-A.
• subscriber A After registration, subscriber A starts a communication service or an IMS service on his communication terminal UE-A.
• the message flow that follows is analogous to the message flow specified in the standard TS 23.228.
• a so-called SIP INVITE message is first sent from the communication terminal UE-A of subscriber A to the communication terminal UE-B of subscriber B.
• the SIP INVITE message contains the speed IP address (IP-SRC-UE-1) of the communication terminal
• the SIP-INVITE message also contains a public identifier SIP-Public-ID-1, which was assigned to the communication terminal UE-A by the service network IMS. This parameter can also be manipulated by a dishonest participant A. To check this, the token assigned during registration is inserted into the SIP INVITE message by the communication terminal UE-A.
• the sequence described so far comprises steps 2 to 5 in FIG. 2.
• a switching center S-CSCF of the service network IMS receives the SIP INVITE message with the identifier (token) (step 6).
• the identifier (token) from the SIP INVITE message is compared with the identifier (token) stored on the exchange S-CSCF or the identifier (token) from the SIP-INVITE message is first decrypted in the switching center S-CSCF and the parameters RN and IP-SRC-UE obtained therefrom are then entered with a corresponding entry ⁇ RN, IP-SRC-UE; SIP Public ID> compared in a database of the exchange S-CSCF.
• the public identifier the so-called SIP Public User ID from the SIP INVITE message with the SIP Public IP assigned to this identifier (token) or with the corresponding ⁇ RN, IP-SRC-UE, SIP Public -ID> Triple stored SIP Public User ID compared.
• the subscriber A is identified if either the identifier (token) from the SIP INVITE message with that on the Switch S-CSCF matches the identifier (token) and the public identifier SIP-Public-ID stored for this identifier (token) on the switch S-CSCF matches the public identifier SIP-Public-ID-1 from the SIP-INVITE message matches or if for the parameters RN and IP-SRC-UE decrypted from the identifier (token) of the SIP INVITE message a suitable ⁇ RN, IP-SRC-UE; SIP-Public-ID> entry on the switching center S-CSCF exists and the public identifier SIP-Public-ID stored in this entry matches the public identifier SIP-Public-ID-1 from the SIP-INVITE message.
• the exchange S-CSCF sends a SIP-401-UNAUTHORIZED message to the communication terminal UE-A of subscriber A.
• the message flow is continued analogously to the standard TS 23.228 (step 7-27).
• the identifier (token) is also added to the sent message and the check just described for the SIP INVITE message is carried out.
• the message flow according to FIG. 2 is only continued in the event of success, otherwise the communication service is terminated.
• IP-SRC-UE In order to search for the associated identifier (token) or the associated data record entry ⁇ RN, IP-SRC-UE; in the IMS user authentication at the switching center S-CSCF; SIP Public ID> to accelerate, for example, an index ver drive can be used in the switching center database.
• the database index required for this can be e.g. from the
• IP address IP-SRC-UE is only delivered to the terminal device which has been assigned this IP address by the gateway GPRS switching center GGSN « . This is ensured by routing in the GPRS access network.
• the encryption of all messages during transmission via the air interface ensures that the token cannot be intercepted by other GPRS devices.
• the use of a random number in the token generation prevents the token (identifier) from being used by dishonest intentions from another terminal device that is randomly assigned the same temporary IP address at a later point in time.
• the method according to the invention does not require any new interfaces or network elements. Without a clear identification of a subscriber who wants to use a communication service of a service network, no communication services can be billed.
• the method according to the invention provides a solution for secure subscriber authentication.
• the method according to the invention can be used both for charging for services in a service network, such as IMS, and for charging content that is offered in the service network, such as IMS.
• the method according to the invention provides the same security as exists today for WAP services.
• a great advantage for a network operator is that for a service network like IMS, today's Release 99 GPRS networks can be used as access networks, since a secure authentication of a service user is possible by means of the method according to the invention.
• An advantage for a service user is that in addition to GPRS (e.g. WAP) services, he can also use IMS services without having to log in again, for example with a password.
• GPRS e.g. WAP
• the method described can advantageously be used to prevent messages which, for example, are sent with dishonest intentions with an incorrect IP address or an incorrect SIP Public User ID, which leads to incorrect authentication.
• An essential aspect of the method is that a communication terminal is assigned an identifier by addressing it with a specific temporary IP address to the terminal that actually has this specific temporary IP address. This is ensured by the routing mechanisms of the access network (e.g. a GPRS network). If a device only faked a temporary IP address during registration, it will not receive this identifier. However, the indicator is required for a successful request from an IMS service. in the
• the license plate allows verification of the temporary IP address. This in turn then allows the public identifier SIP-Public-ID and a corresponding private identifier SIP-Private-ID to be reliably identified.
• IP multimedia subsystem IP multimedia subsystem
• IMS IP multimedia subsystem
• the problem is that a subscriber can fraudulently modify a communication device, which can result in SIP messages with an incorrect IP address and an incorrect SIP Public User ID being sent, resulting in incorrect charging
• the described method enables the IMS user to be reliably identified even in the event that the service network IMS is connected to a “Release 1999” GPRS network that is common today or that existing “Release 1999” Devices that do not have an ISIM card, for example, can be used by doing this for the purpose of registration in the IMS to the communication device t sent identifier (token) is used to check the identity or authenticity of a subscriber who wants to use an IMS service and for this purpose sends service-related messages.
• identifier token
• the service network IMS is able to check whether the temporary IP address or the SIP public user ID specified in the service-relevant messages matches that which was specified and verified when the communication terminal was registered. Through this secure authentication the subscriber may be charged for IMS services.
• An example scenario is the following:
• a fraudulent subscriber logs into a 1999 GPRS access network. He would like to send an IMS instant message to another subscriber and thereby cause a connected service network, such as an IMS, to charge a third party of the service network for costs incurred for sending the instant message.
• the dishonest participant logs on under his own identity in the GPRS access network and in the service network such as IMS. According to the registration procedure from DE 10223248, every subscriber of the service network IMS receives a token during the successful booking into the IMS. Up to this step, the dishonest participant must behave correctly, otherwise he will not be logged into the IMS service network. This also gives him a valid token.
• the service network IMS would deliver the instant message to the recipient and charge according to the wrong information that the dishonest participant has inserted in the instant message. This means that the wrong IMS participant is billed, which must be excluded in any case.
• the method according to the invention requires that IMS services can only be used if the identifier is specified.
• the indicator enables the specified IP address and the specified SIP public ID to be checked.
• Each IMS participant only receives his own identifier (token) when registering and not that of another IMS participant. It is also difficult to guess the token (token) due to the random number it contains. It is also not possible to listen to the license plate (token), since all messages are encrypted and transmitted over the air interface.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Multimedia (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Business, Economics & Management (AREA)
• General Business, Economics & Management (AREA)
• Mobile Radio Communication Systems (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Priority Applications (5)

Applications Claiming Priority (1)

Publications (1)

Family

ID=31892774

Family Applications (1)

Country Status (5)

Cited By (19)

Families Citing this family (10)

Citations (1)

Family Cites Families (1)

• 2002
  • 2002-08-16 WO PCT/DE2002/003060 patent/WO2004019640A1/de not_active Application Discontinuation
  • 2002-08-16 BR BR0215842-6A patent/BR0215842A/pt not_active IP Right Cessation
  • 2002-08-16 DE DE10297762T patent/DE10297762D2/de not_active Withdrawn - After Issue
  • 2002-08-16 AU AU2002336891A patent/AU2002336891A1/en not_active Abandoned
  • 2002-08-16 CN CNB028294548A patent/CN100362896C/zh not_active Expired - Fee Related

Patent Citations (1)

Non-Patent Citations (2)

Also Published As

Similar Documents

Legal Events