WO2011038691A1

WO2011038691A1 - Authentication method and device

Info

Publication number: WO2011038691A1
Application number: PCT/CN2010/077516
Authority: WO
Inventors: 谢国军; 谢秀洪
Original assignee: 华为技术有限公司
Priority date: 2009-09-30
Filing date: 2010-09-30
Publication date: 2011-04-07
Also published as: CN101668016A; CN101668016B

Abstract

An authentication method and device are provided in the embodiments of the present invention, said method including the following steps: receiving an Internet Protocol (IP) Multimedia Subsystem (IMS) network authentication request sent by a User Equipment (UE); according to said IMS network authentication request, obtaining the authentication information of an application server from a Home Subscriber Server (HSS); sending the IMS network authentication response message containing the authentication information of said application server to the UE, so as to trigger said UE to utilize the authentication information of said application server to carry out authentication in said application server. By carrying the authentication information of the application server in the returned result of the IMS network authentication, the method of the embodiments of the invention enables uniform authentication of the IMS and the application server without requiring the user's manually intervening the authentication process of the application server. The method brings great convenience to the usage of users and the management of operators; and in addition, the existing IMS authentication flow is fully utilized to implement the method in a simple manner.

Description

The present invention relates to the field of communications, and in particular, to an authentication method and apparatus. Background Art In an IMS (IP multimedia subsystem) network, in addition to network devices that provide basic telecommunication services, there are many application servers that provide value-added services. Such application servers can operate independently of the IMS network. To ensure legitimate service usage and correct billing, many application servers need to separately authenticate the UE (User Equipment). For example, an application server GROUP that provides address book storage and management, regardless of whether the UE has authenticated through the IMS network, the UE must provide the correct username and password to pass the authentication of the GROUP before using the services provided by the GROUP.

FIG. 1 is a flow chart of the prior art IMS network authentication and application server authentication. As shown in FIG. 1 , S101-S104 is a prior art IMS network standard authentication process; S105-S107 is a prior art application server authentication process, where S105 requires the user to manually input authentication information again.

In the process of implementing the present invention, the inventor has found that the prior art has at least the following deficiencies: The prior art requires user intervention in each authentication process, and cannot implement automatic authentication, which is inconvenient for the user to use; The technical approach cannot achieve unified authentication of the IMS network and the application server. SUMMARY OF THE INVENTION Embodiments of the present invention provide an authentication method, an authentication information transmission method, and an apparatus.

In an aspect, the embodiment of the present invention provides an authentication method, where the method includes: receiving an IP multimedia subsystem IMS network authentication request sent by a user equipment UE; and, according to the IMS network authentication request, from a home subscriber server HSS Obtaining application server authentication information; sending an IMS network authentication response message including the application server authentication information to the UE, to trigger the UE to use the application server authentication information to perform authentication on the application server.

In another aspect, an embodiment of the present invention provides a method for transmitting an authentication information, where the method includes: receiving a first message sent by a call session control function entity CSCF, where the first message includes requesting authentication of an IMS network. Determining, according to the first message, whether there is application server authentication information corresponding to the UE; when there is application server authentication information corresponding to the UE, sending, by the CSCF, the UE corresponding to the UE The second message of the application server authentication information.

In another aspect, an embodiment of the present invention provides an authentication method, where the authentication method includes: sending an IP multimedia subsystem IMS network authentication request to a call session control function entity CSCF; receiving an IMS network sent by the CSCF The authentication response message, the IMS network authentication response message carries the application server authentication information, and the application server authentication information is used to perform the authentication on the application server. In another aspect, the embodiment of the present invention provides a call session control. Functional entity CSCF, said The call session control function entity CSCF includes: an authentication request receiving unit, configured to receive an IP multimedia subsystem IMS network authentication request sent by the user equipment UE, and an authentication information obtaining unit, configured to: according to the IMS network authentication request, The home subscriber server HSS obtains the application server authentication information, and the authentication response sending unit is configured to send an IMS network authentication response message including the application server authentication information to the UE, to trigger the UE to use the application server. The authentication information is authenticated to the application server.

In a further aspect, the embodiment of the present invention provides a home subscriber server, where the home subscriber server includes: a receiving unit, configured to receive a first message sent by a call session control function entity CSCF, where the first message includes a request a UE identifier for the IMS network authentication, a determining unit, configured to determine whether there is application server authentication information corresponding to the UE, and a sending unit, configured to: when there is application server authentication information corresponding to the UE, The CSCF sends a second message including application server authentication information corresponding to the UE.

In a final aspect, the embodiment of the present invention provides a user equipment, where the user equipment includes: a first authentication request sending unit, configured to send an IP multimedia subsystem IMS network authentication request to a call session control function entity CSCF; The right response receiving unit is configured to receive an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries application server authentication information, and a second authentication request sending unit is configured to use the application server The authentication information is authenticated to the application server.

The technical solution provided by the embodiment of the present invention is carried in the result returned by the IMS network authentication. The authentication information of the application server realizes the unified authentication of the IMS network and the application server, and realizes the automatic authentication of the application server, that is, the user does not need to intervene in the authentication process, and both the user and the operator management are brought It is very convenient; make full use of the existing IMS network authentication process to achieve simplicity. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below, obviously, in the following description The drawings are only some of the embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive labor.

1 is a flow chart of authentication of an IMS network and application server in the prior art;

2 is a flowchart of signaling interaction of a system according to Embodiment 1 of the present invention;

3 is a functional block diagram of a system according to Embodiment 1 of the present invention;

4 is an overall flowchart of a method according to Embodiment 2 of the present invention;

Figure 4a is a specific flowchart 1 of the method of Embodiment 2 of the present invention;

4b is a specific flowchart 2 of the method of Embodiment 2 of the present invention;

4c is a specific flowchart 3 of the method of Embodiment 2 of the present invention;

Figure 5 is a flowchart of a method according to Embodiment 3 of the present invention;

6 is a schematic structural diagram of an extension of a User Profile according to Embodiment 3 of the present invention; 7 is a diagram showing an example of an in-line format of a user profile according to Embodiment 3 of the present invention;

8 is a schematic structural diagram of application server authentication information according to Embodiment 3 of the present invention;

9 is a definition diagram of an Add-ons field according to Embodiment 3 of the present invention;

10 is an overall flowchart of a method according to Embodiment 4 of the present invention;

10a is a specific flowchart 1 of the method according to Embodiment 4 of the present invention;

Figure 10b is a specific flowchart 2 of the method of Embodiment 4 of the present invention;

11 is a functional block diagram of a call session control function entity according to Embodiment 5 of the present invention;

11a is a functional block diagram of an authentication information acquiring unit according to Embodiment 5 of the present invention;

FIG. 1 is a functional block diagram of an authentication response sending unit according to Embodiment 5 of the present invention;

12 is a functional block diagram of a home subscriber server according to Embodiment 6 of the present invention;

13 is a block diagram showing the overall function of a user equipment according to Embodiment 7 of the present invention;

FIG. 14 is a detailed functional block diagram of a user equipment according to Embodiment 7 of the present invention. The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without departing from the inventive scope are the scope of the present invention. The application server according to the embodiment of the present invention mainly refers to an application server that is independent of the IMS network and needs independent authentication. Such an application server usually provides value-added services independently, such as a "WEB domain application server."

The interface between the HSS (Home Subscriber System) and the CSCF (Call Session Control Functions) includes a Cx interface, and its main functions include location management, user data download/update processing, and user authentication. Embodiment 1 The embodiment 1 of the present invention provides a method and system for unified authentication of an IP multimedia subsystem IMS network and an application server.

Embodiment 1 of the present invention utilizes existing IMS devices and processes, and performs appropriate extension to support unified authentication of the IMS network and the application server. That is, after the UE is authenticated by the IMS network, the UE uses the authentication information acquired in the IMS network authentication process to automatically authenticate other application servers used by the authorized UE, and the user does not need to intervene.

2 is a flowchart of signaling interaction of a system according to Embodiment 1 of the present invention. As shown in Figure 2, the signaling interaction process includes:

The S20K user equipment performs the IP multimedia subsystem IMS network authentication, and the UE sends an IMS network authentication request to the CSCF;

The authentication algorithms include: IMS AKA (Authentication and Key Agreement) Key negotiation), Early AKA, or HTTP Digest (HTTP digest authentication algorithm), etc.

5202. The CSCF sends a SAR message to the HSS to obtain a user subscription information of the UE.

5203. The HSS returns the user subscription information of the UE to the CSCF through the extended SAA message; if the corresponding IMPU (IP Multimedia Public Identity) or IRS (Implicit Registered Set) has an associated application The server authentication information includes the application server authentication information in the User Profile; otherwise, the application server authentication information is not included in the User Profile;

5204. The CSCF determines whether the User Profile is accompanied by the application server authentication information. If not, the CSMS returns an IMS network authentication response message 200 OK that is consistent with the prior art. If yes, the IMS network authentication response message is returned to the UE. 200 OK, and the 200 ΟΚ carries the above application server authentication information;

5205. When the UE receives the 200 OK, the application server authentication information is removed.

If the associated Uniform Resource Identifier P-Associated-URI header field is added in the 200 OK, and the P-Associated-URI header field is used to carry the application server authentication information, the Bay ijUE checks whether the p-aso-uri-spec list is accompanied by http- Usemame, http-token and other parameters. From the first URI with the http-usemame parameter, take the http-token and other parameters; and use CK (Check Bit) to decrypt; if the UE and IMS network use HTTP Digest authentication, Then use HA1 for decryption. S206: The UE performs authentication on the application server according to the returned authentication information.

If the application server uses the HTTP Digest authentication method to authenticate the user. The UE uses the HTTP usemame and HTTP Token (WEB Password) obtained from the IMS network to calculate the authentication Digest response and complete the authentication.

5207. The application server returns an authentication result.

When the UE needs to authenticate to multiple application servers, S206-S207 is repeatedly executed.

The system of Embodiment 1 of the present invention implements unified authentication of the IMS network and the application server by using the existing authentication process.

3 is a functional block diagram of a system according to Embodiment 1 of the present invention. As shown in FIG. 3, a system 10 for IP multimedia subsystem IMS network and application server unified authentication according to Embodiment 1 of the present invention includes:

The user equipment UE101 is configured to send an IP multimedia subsystem IMS network authentication request to the call session control function entity CSCF102, and receive an IMS network authentication response message 200 OK sent by the CSCF 102, where the 200 OK carries the application server authentication information. Applying the application server authentication information to the application server for authentication;

The call session control function entity CSCF102 is configured to receive an IP multimedia subsystem IMS network authentication request sent by the user equipment UE101, send a SAR message to the home subscriber server HSS103, to obtain the user subscription information User Profile of the UE101, and receive the HSS103. The SAA message sent, the SAA message includes the User Profile, and the User Profile carries application server authentication information; and sends an IMS network profile including the application server authentication information to the UE 101 The right response message 200 OK, to trigger the UE 101 to use the application server authentication information to authenticate to the application server 104;

The home subscriber server HSS 103 is configured to receive the SAR message sent by the call session control function entity CSCF 102. When the application server authentication information corresponding to the UE 101 is stored, send the SAA containing the user subscription information User Profile of the U101E to the CSCF 102. a message, and the user profile carries the application server authentication information;

The application server AS104 is configured to receive an authentication request sent by the UE 101, perform authentication on the UE 101, and return an authentication response to the UE 101.

With the system of Embodiment 1 of the present invention, the HSS adds the application server authentication information structure at the end of the User Profile structure by extending the User Profile structure carried in the SAA message on the Cx interface, thereby transmitting the application server authentication information to the CSCF through the SAA message. .

The CSCF encrypts the application server authentication information by using the bit check CK or HA1 during the transmission of the 200 OK message, thereby ensuring the security of the application server authentication information transmission.

The UE authenticates to the application server by using the application server authentication information carried by the 200 OK message, without manually inputting the application server authentication information manually, thereby reducing the operation burden of the user and realizing automatic authentication.

In summary, the system in the first embodiment of the present invention implements unified authentication for the IMS network and the application server, which brings great convenience to both the user and the operator management; fully utilizes the existing IMS authentication process, and is simple to implement. , no need to add additional authentication proprietary devices; no special for existing application servers Requirements, there is no need to change the existing authentication process. Embodiment 2: Embodiment 2 of the present invention provides an authentication method, which is a method for unified authentication of an IP multimedia subsystem IMS network and an application server, and an execution body of the method may be a CSCF.

Figure 4 is a general flow chart of the method of Embodiment 2 of the present invention. As shown in FIG. 4, the method includes: S40K receiving an IP multimedia subsystem IMS network authentication request sent by a user equipment UE;

S402: Obtain application server authentication information from the home subscriber server HSS according to the IMS network authentication request.

Specifically, the application server authentication information includes: an authentication username of the application server, HTTP-Username, an authentication password of the application server (expandable to an authentication credential:) HTTP-Token, and an additional parameter Add-ons of the application server ( For example, the IP address of the application server). Where Add-ons is an optional parameter, and the above Add-ons parameter includes one or more server parameters Sever-parameter.

S403. Send an IMS network authentication response message that includes the application server authentication information to the UE, to trigger the UE to use the application server authentication information to perform authentication on the application server.

It should be noted that, in general, the UE has defined which application servers need to be authenticated, but the UE does not know the necessary information required for authentication, such as an IP address, a username, a password, etc., once the IMS network returns the information. For the UE, the UE can authenticate to the application server. 4a is a specific flowchart 1 of the method according to Embodiment 2 of the present invention. Optionally, as shown in FIG. 4a, the method may include:

S401a, receiving an IP multimedia subsystem IMS network authentication request sent by the user equipment UE;

S402a, sending a SAR message to the home subscriber server HSS, to obtain the user subscription information User Profile of the UE;

Specifically, the SAR message includes a Server-Assignment-Request message. The Server-Assignment-Request is a command sent by the CSCF to the HSS in the Cx interface, and the SAR message may carry the IMPU and/or IMPI (IP Multimedia Private Identity) of the UE, so that the HSS is based on the IMPU of the UE. / or IMPI to query whether the application server authentication information corresponding to the UE is stored.

S403. The SAA message is sent by the HSS, where the SAA message includes the user profile, and the user profile carries application server authentication information.

Specifically, the SAA message is a Server-Assignment-Answer message, which is a response of the HSS to the SAR command in the Cx interface.

The extension structure of the User Profile and the structure of the application server authentication information in the embodiment of the present invention will be described in detail in the following embodiments, and will not be described here.

Optionally, other messages may also be sent to obtain application server authentication information, for example, application server authentication information may be delivered through other messages in other processes customized between the CSCF and the HSS. S404. The IMS network authentication response message 200 OK including the application server authentication information is sent to the UE, to trigger the UE to use the application server authentication information to authenticate to the application server.

FIG. 4b is a specific flowchart 2 of the method of Embodiment 2 of the present invention. The difference between Fig. 4b and Fig. 4a lies in S404b.

S404b, sending an IMS network authentication response message 200 OK to the UE, where the 200 OK message includes an associated uniform resource identifier P-Associated-URI header field, and the P-Associated-URI header field carries the application server authentication The information is triggered to trigger the UE to use the application server authentication information to authenticate to the application server.

Specifically, the specific process of S404b may also include:

And assigning the value of the HTTP-Username to the first ai-param parameter included in the P-Associated-URI header field;

And assigning the value of the HTTP-Token to the second ai-param parameter included in the P-Associated-URI header field;

Sending an IMS network authentication response message 200 OK to the UE, where the 200 ΟΚ includes an associated uniform resource identifier P-Associated-URI header field, where the P-Associated-URI header field includes the first ai-param parameter The second ai-param parameter described in the mouth.

Optionally, the value of one or more server parameters Server-parameter included in the Add-ons may be respectively assigned to other corresponding ai-param parameters included in the P-Associated-URI header field; Optionally, the IMS network authentication response message 200 OK may also be sent to the UE, where the 200 ΟΚ includes an associated uniform resource identifier P-Associated-URI header field, where the P-Associated-URI header field includes the first An ai-param parameter, the second ai-param parameter, and other plurality of ai-param parameters carrying values of the plurality of Server-parameters.

4c is a specific flowchart 3 of the method of Embodiment 2 of the present invention. Figure 4c differs from Figure 4 in S404c and S405c.

S404c: encrypt the application server authentication information by using a check bit CK or HA1;

S405, sending an IMS network authentication response message 200 OK to the UE, where the 200 OK includes the application server authentication information encrypted by using the check bit CK or HA1, to trigger the UE to use the application server The right information is authenticated to the application server.

The method for carrying the application server authentication information in the foregoing 200 Ok response may include: transmitting the application server authentication information as an ai-param parameter of the P-Associated-URI header field.

For example: Use the parameters defined in the standard P-Associated-URI to carry "application server authentication information".

P-Associated-URI is defined in the standard as:

P-Associated-URI = "P-Associated-URI" HCOLON

(p-aso-uri-spec)

*(COMMA p-aso-uri-spec)

P-aso-url-spec = name-addr *(SEMI ai-param) Ai-param = genenc-param

The following example illustrates the process of carrying "application server authentication information" by parameters defined by P-Associated-URI.

The CSCF takes the HTTP-username cell of the application server authentication information, copies its contents into the http-usemame parameter, and uses http-usemame as an ai-param#3⁄4 of the P-Associated-URI;

For example, take the HTTP-username cell of the application server authentication information, copy the content of the cell "user1 @home1.net" to the http-usemame parameter, so that http-usemame=" user @home1.net,, , And use the http-usemame as a si-psrsm parameter of the P-Associated-URI.

The CSCF takes the HTTP-Token cell of the application server authentication information, copies the content to the http-token parameter, and uses the http-token as an ai-param parameter of the P-Associated-URI; for example, extracting the application server authentication information. HTTP-Token cell, copy the content of the cell "PWD" into the http-token parameter, making http-token= "PWD", and using http-token as an ai-param parameter of the P-Associated-URI .

The CSCF takes out the Add-ons cell of the application server authentication information, and uses each of the one or more Server-parameters included in the Add-ons cell as a single ai-param parameter, if any Server-parameter, corresponding to multiple For example, the Add-ons cell of the application server authentication information is extracted, and the content "group-domain-address" in the first server-parameter included in the cell is copied into the group-uri parameter, so that group-uri= , group-domain-address ,, , and group-uri as an ai-param parameter of the P-Associated-URI;

Copy the content "AP-domain-address" in the second Server-parameter contained in the cell to the ap-uri parameter, so that ap-uri=,, AP-domain-address" ; and ap-uri as P - an ai-param parameter of the Associated-URI.

Therefore, an example of a P-Associated-URI carrying application server authentication information is formed as follows:

P-Associated-URI:

Sip:user1 @home1.net;http-username="user1 @home1.net";http-token= " PWD";group-uri=" group-domain-address";ap-uri="AP-domain-address "In order to ensure the security of the transmission process, the application server authentication information can be encrypted by CK; if the UE and IMS use HTTP Digest authentication, then HA1 (HTTP)

The intermediate calculation result of the Digest authentication process) is encrypted.

The method of the embodiment of the present invention receives the SAA message that is sent by the HSS and includes the application server authentication information, and sends the application server authentication information to the UE by using a 200 OK response, so that the UE can receive the response according to the response received from the 200 OK. Application server authentication information is applied to the application server for authentication. This process does not require manual intervention, and implements automatic authentication of the application server, and also implements IMS. The unified authentication of the network and the application server facilitates the use of the user.

By using CK or HA1 to encrypt the application server authentication information during transmission, the security of data transmission is effectively guaranteed.

The method of the embodiment of the present invention does not add an authentication special device, but improves on the basis of the existing device and the existing process, and provides a unified authentication process for implementing a simple IMS network and an application server. This will help operators manage and save operators' investment. Embodiment 3: Embodiment 3 of the present invention provides a method for transmitting authentication information of an application server, and the execution subject of the method may be an HSS.

FIG. 5 is a flowchart of a method according to Embodiment 3 of the present invention. As shown in Figure 5, the method includes:

The S50K receives the first message sent by the call session control function entity CSCF, where the first message includes a UE identifier that requests authentication of the IMS network;

S502: Determine, according to the first message, whether there is application server authentication information corresponding to the UE;

5503. When there is application server authentication information corresponding to the UE, send, to the CSCF, a second message that includes application server authentication information corresponding to the UE.

Optionally, the first message may be a SAR message, and the second message may be an SAA message, where the UE identifier includes: an IP multimedia public identifier of the UE, an IMPU or an IMPI. The process of S503 may specifically include:

Sending an SAA message to the CSCF when the application server authentication information corresponding to the UE is present, the SAA message includes a user subscription information User Profile of the UE, and the user profile carries the application server authentication information.

Optionally, the SAR message may carry the IMPU and/or the IMPI of the UE, so that the HSS queries the application server authentication information corresponding to the UE according to the IMPU and/or IMPI of the UE. When the UE includes multiple IMPUs, the multiple IMPUs may form one IRS.

Specifically, when an IMS user opens an account or applies for a new service, if the office or the BOSS (Business and Operation Supporting System) determines that there is an application server that needs independent authentication, The authentication information of the application server is stored in the HSS. The authentication information of the application server may be associated with one or more IMPUs, that is, the authentication information of the application server may correspond to one or more IMPUs and may belong to one or more IMPUs.

When the authentication information of the application server is associated with multiple IMPUs, the associated IMPU can be registered as an IRS in the HSS, which is equivalent to associating the application server authentication information with the IRS. The multiple IMPUs are set in one set, so that when the UE has multiple IMPUs, the application server authentication information can be obtained regardless of which IMPU is logged in, without the application server authentication information being saved on the HSS multiple times.

When the HSS determines that the corresponding IMPU or IRS has associated application server authentication information, then The application server contains the application server authentication information.

For example, the user profile structure carried in the SAA message is extended in the Cx interface, and the application server authentication information structure is added at the end of the User Profile structure, and is represented by UML (Unified Model Language) as Figure 6, Figure 6 A schematic diagram of an expanded structure of the User Profile of Embodiment 3 of the present invention.

As shown in FIG. 6, an IMPI of an IMS user may correspond to one or more "Service Profiles" and may correspond to one or 0 "application server authentication information". "l...n" in Fig. 6 indicates one or more, and "0...1" indicates no or one. FIG. 7 is a diagram showing an example of an in-line format of a user profile according to Embodiment 3 of the present invention. Only two Service profiles are shown in Figure 7. For different applications, more than two Service profiles can be used. Only three Public ids are shown in Figure 7. For different applications, more than three Public ids can be used. . The IFC in Figure 7 represents the initial filter criteria. The service profile is the same as defined in the original user profile.

The structure of the application server authentication information of the embodiment 3 of the present invention is represented by FIG. 8 using UML, and FIG. 8 is a schematic structural diagram of application server authentication information according to Embodiment 3 of the present invention. As shown in Figure 8, HTTP-Username indicates the authentication user name of the application server; HTTP-Token indicates the authentication password of the application server (expandable to authentication credentials); Add-ons stores additional parameters of the application server. (eg the IP address of the application server). As can be seen from FIG. 8, an application server authentication information may include, for example, an HTTP-Usemame, an HTTP-Token, one or zero Add-ons. In other applications, you can also include multiple HTTP-Usemame, multiple HTTP-Token, and more. Add-ons.

If there are multiple application servers, specify the same authentication username and authentication password for opening an account, applying for a new service or other application scenarios, and for different additional parameters (such as the IP address of the application server) in the Add-ons field. Store. Optionally, the application server authentication information structure may also be extended, and different authentication user names and authentication passwords may be specified for multiple application servers.

The Add-ons field of the application server authentication information structure can be defined as shown in FIG. Figure 9 is a diagram showing the definition of the Add-ons field in Embodiment 3 of the present invention. As shown in FIG. 9, where "1 ... n" represents one or more, gp i Add-ons fields may include one or more Server-parameters, and in each Server-parameter, parameters are saved. Name and parameter value; for example, group-uri="group-domain-address", where group-uri indicates the parameter name and group-domain-address indicates the corresponding parameter value.

In summary, the HSS adds the application server authentication information structure at the end of the User Profile structure by extending the User Profile information structure included in the SAA message, and returns an SAA message carrying the application server authentication information to the CSCF, thereby transmitting the application server authentication information. CSCF. Optionally, an application server authentication information structure can also be added in front of the User Profile structure.

The method of Embodiment 3 of the present invention adds an application server authentication information structure to the end of the User Profile structure by extending the User Profile structure carried in the SAA message, so that the application server authentication information can be sent to the CSCF through the SAA message, so that the CSCF can The application server authentication information is sent to the UE, so that the UE performs the authentication according to the application server authentication information to the application server. Right, without requiring the user to manually intervene in the application server's authentication process. This method brings great convenience to both user usage and operator management. Through the above technical solution, the method of Embodiment 3 of the present invention is advantageous for implementing unified authentication of the IMS network and the application server. Embodiment 4: Embodiment 4 of the present invention provides an authentication method, where the authentication method includes a method for unified authentication of an IMS multimedia subsystem network and an application server. The execution body of the method may be a UE.

Figure 10 is a general flow chart of the method of Embodiment 4 of the present invention. As shown in FIG. 10, the method includes: S100K sending an IMS network authentication request to a call session control function entity CSCF;

51002: Receive an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries authentication information of the application server.

51003. Perform authentication by using the application server authentication information to the application server.

FIG. 10a is a specific flowchart 1 of the method according to Embodiment 4 of the present invention. Figure 10a differs from Figure 10 in that S 1002a.

The SI 002a receives the IMS network authentication response message 200 OK sent by the CSCF, where the 200 OK includes an associated uniform resource identifier P-Associated-URI header field, and the P-Associated-URI header field carries application server authentication information.

Specifically, the process of S1002a may include:

Receiving an IMS network authentication response message 200 OK sent by the CSCF, the 200 OK packet The P-Associated-URI header field includes an associated uniform resource identifier, and the plurality of ai-param parameters included in the P-Associated-URI header field carry an authentication username of the application server, HTTP-Usemame, and an authentication password of the application server. -Token and one or zero additional application server add-ons.

FIG. 10b is a specific flowchart 2 of the method in Embodiment 4 of the present invention. As shown in Figure 10b, the method includes:

SlOOlb, sending an IMS network authentication request to the call session control function entity CSCF; S1002b, receiving an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries an application encrypted by using a check bit CK or HA1 Server authentication information; S1003b, decrypting the application server authentication information by using the check bit CK or HA1; S1004b, using the application server authentication information to the application server for authentication. The method of Embodiment 4 of the present invention, by carrying the application server authentication information in the IMS network authentication response message, enables the UE to obtain the application server authentication information from the received IMS network authentication response message, and according to the application server The authentication information is automatically authenticated to the application server. The method simplifies the authentication process, is convenient for the user to use, and the user does not need to intervene, and the method brings great convenience to the user and the operator management. At the same time, the application server authentication information in the transmission process is encrypted by using CK or HA1 to ensure the security of data transmission. Example 5: Embodiment 5 of the present invention provides a call session control function entity CSCF. This CSCF is formed corresponding to the method of Embodiment 2.

11 is a functional block diagram of a call session control function entity according to Embodiment 5 of the present invention. As shown in Figure 11, the CSCF20 includes:

The authentication request receiving unit 201 is configured to receive an IP multimedia subsystem IMS network authentication request sent by the user equipment UE;

The authentication information obtaining unit 202 is configured to obtain application server authentication information from the home subscriber server HSS according to the IMS network authentication request.

The authentication response sending unit 203 is configured to send an IMS network authentication response message that includes the application server authentication information to the UE, to trigger the UE to use the application server authentication information to perform the authentication to the application server. right.

Figure 11a is a functional block diagram of an authentication information acquisition unit. Optionally, the authentication information obtaining unit 202 may include:

The requesting sub-unit 2021 is configured to send a SAR message to the home subscriber server HSS, to obtain a user subscription information of the UE;

The receiving subunit 2022 is configured to receive an SAA message sent by the HSS, where the SAA message includes the User Profile, and the User Profile carries application server authentication information.

Optionally, the authentication response sending unit 203 is configured to send an IMS network authentication response message 200 OK to the UE, where the associated unified resource identifier P-Associated-URI is added in the 200 OK a header field, where the P-Associated-URI header field carries the application server authentication information. Figure l ib is a functional block diagram of the authentication response sending unit. Optionally, the authentication response sending unit 203 may include: an encryption subunit 2031, configured to encrypt the application server authentication information by using a check bit CK or HA1; and a sending subunit 2032, configured to The UE sends an IMS network authentication response message, where the IMS network authentication response message includes the application server authentication information encrypted by using CK or HA1. The application server authentication information includes: an authentication user name of the application server, HTTP-Usemame, and an authentication password of the application server, HTTP-Token; optionally, the application server authentication information may further include an additional parameter Add-ons of the application server. The Add-ons includes one or more server parameters. The CSCF entity provided by the embodiment 5 of the present invention receives the SAA message extended by the User Profile structure, and the application server authentication information is added to the end of the User Profile structure. Structure, so that the corresponding application server authentication information can be obtained from the HSS.

The CSCF entity encrypts the application server by using the CK during the transmission of the application server authentication information, or when the UE and the IMS use the HTTP Digest authentication, the HA1 encrypts the application server authentication information, thereby ensuring the security of the transmission.

The CSCF entity carries the application server authentication information in the 200 OK message returned to the UE, so that the UE can use the application server authentication information to authenticate to the application server. This process realizes automatic authentication without manual intervention. In summary, by adopting the CSCF of the embodiment of the present invention, unified authentication of the IMS and the application server is realized, which brings great convenience to the user and the operator management. At the same time, the operator investment is saved, and no additional authentication is needed. There are devices. Embodiment 6 The embodiment of the present invention provides a home subscriber server, which is formed correspondingly by the method of Embodiment 3. Figure 12 is a functional block diagram of a home subscriber server according to Embodiment 6 of the present invention. As shown in FIG. 12, the home subscriber server 30 includes: a receiving unit 301, configured to receive a first message sent by a call session control function entity CSCF, where the first message includes a UE identifier that requests authentication of an IMS network; a unit, configured to determine whether there is application server authentication information corresponding to the UE, where the sending unit 302 is configured to: when the application server authentication information corresponding to the UE exists, send, to the CSCF, the UE corresponding to the The second message of the application server authentication information. Optionally, the first message may be a SAR message, the second message may be an SAA message, and the identifier of the UE includes an IP multimedia public identity (IMPU) or an IMPI of the UE. The sending unit 302 may be configured to: when the application server authentication information corresponding to the UE exists, send an SAA message to the CSCF, where the SAA message includes a user subscription information User Profile of the UE, and the The User Profile carries the application server authentication information. For the structure of the extended User Profile and the structure of the application server authentication information, please refer to the figure. 6- Figure 9, and corresponding description, will not be described here.

The home subscriber server of Embodiment 6 of the present invention can store the authentication information of the application server corresponding to the UE in advance, and add the application server authentication information structure at the end of the User Profile information structure by extending the User Profile, so that the SAA message can be passed. Passing the authentication information of the application server to the CSCF facilitates unified authentication of the IMS and the application server. Embodiment 7: Embodiment 7 of the present invention provides a user equipment which is formed by the method of Embodiment 4.

Figure 13 is a functional block diagram of a user equipment according to Embodiment 7 of the present invention. As shown in FIG. 13, the user device 40 includes:

The first authentication request sending unit 401 is configured to send an IP multimedia subsystem IMS network authentication request to the call session control function entity CSCF;

The authentication response receiving unit 402 is configured to receive an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries the authentication information of the application server;

The second authentication request sending unit 403 is configured to use the application server authentication information to authenticate to the application server.

Optionally, the authentication response receiving unit 401 is further configured to receive an IMS network authentication response message 200 OK sent by the CSCF, where the 200 OK includes an associated unified resource identifier. A P-Associated-URI header field, the P-Associated-URI header field carrying application server authentication information. Optionally, the authentication response receiving unit 401 is further configured to receive an IMS network authentication response message sent by the CSCF, where the associated unified resource identifier of the IMS network authentication response message is a P-Associated-URI header field. The plurality of included ai-param parameters carry the value of the authentication server name HTTP-Usemame of the application server, the value of the authentication password HTTP-Token of the application server, and the value of the additional parameter Add-ons of one or zero application servers.

For a specific method for carrying the application server authentication information by using the P-Associated-URI header field added by the 200 OK, refer to the corresponding description in Embodiment 2, and details are not described herein.

Optionally, the authentication response receiving unit 401 is further configured to receive an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries an application server encrypted by using a check bit CK or HA1. Authentication information.

FIG. 14 is a detailed functional block diagram of a user equipment according to Embodiment 7 of the present invention. Optionally, the user equipment 40 may further include:

The decryption unit 404 is configured to decrypt the application server authentication information by using the check bit CK or HA1.

The user equipment provided in Embodiment 7 of the present invention can use the application server authentication information carried by the 200 OK message to authenticate the application server, and does not need to manually input the application server authentication information by manually manually, thereby facilitating the user. The method of the embodiment of the present invention implements the IMS by carrying the authentication information of the application server in the result returned by the IMS network authentication. Unified authentication of network and application servers.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium, the program When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above embodiments are only used to explain the technical solutions of the embodiments of the present invention, and are not limited thereto. Although the embodiments of the present invention have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents. The modifications and substitutions of the embodiments do not depart from the spirit and scope of the technical solutions of the embodiments of the embodiments of the present invention.

Claims

Claim

An authentication method, wherein the authentication method comprises:

Receiving an IP multimedia subsystem IMS network authentication request sent by the user equipment UE;

Obtaining application server authentication information from the home subscriber server HSS according to the IMS network authentication request;

And sending, by the UE, an IMS network authentication response message that includes the application server authentication information, to trigger the UE to use the application server authentication information to perform authentication on the application server.

The method according to claim 1, wherein the obtaining the application server authentication information from the home subscriber server HSS according to the IMS network authentication request comprises:

Sending a Server-Assignment-Request, SAR message to the home subscriber server HSS, to obtain the user subscription information of the UE;

Receiving a Server-Assignment-Ask, SAA message sent by the HSS, the SAA message includes the User Profile, and the User Profile carries application server authentication information.

3. The method according to claim 2, wherein the SAR message carries an IP multimedia public identity IMPU and/or an IP multimedia private identity IMPI of the UE, so that the HSS is based on the UE's IMPU and/or IMPI. To query whether the application server authentication information corresponding to the UE is stored.

The method according to claim 1, wherein the sending the IMS network authentication response message including the application server authentication information to the UE comprises:

Sending an IMS network authentication response message 200 OK to the UE, where the associated unified resource identifier P-Associated-URI header field is added, and the P-Associated-URI header field carries the Application server authentication information.

The method according to claim 4, wherein the plurality of ai-pamm parameters included in the P-Associated-URI header field carry the application server authentication information.

Encrypting the application server authentication information by using the check bit CK or HA1; sending an IMS network authentication response message to the UE, where the IMS network authentication response message includes the application server encrypted by CK or HA1 Authentication information.

The method according to any one of claims 1 to 6, wherein the application server authentication information comprises: an authentication username of the application server, HTTP-Usemame, and an authentication password of the application server, HTTP-Token.

The method according to claim 7, wherein the application server authentication information further includes: an additional parameter Add-ons of the application server, where the Add-ons parameter includes one or more servers Parameter Sever—parameter.

9. A method for transmitting authentication information, the method comprising:

And receiving, by the call session control function entity, a first message sent by the CSCF, where the first message includes a user equipment UE identifier that is requested to perform an IP multimedia subsystem IMS network authentication;

Determining, according to the first message, whether there is application server authentication information corresponding to the UE; when there is application server authentication information corresponding to the UE, sending, to the CSCF, a second message of the application server authentication information corresponding to the UE.

The method according to claim 9, wherein the first message is a Server-Assignment-Request, a SAR message, and the second message is a Server-Assignment-Answer, an SAA message;

Sending the second message that includes the application server authentication information to the CSCF includes: sending an SAA message to the CSCF, where the SAA message includes a user subscription information User Profile of the UE, and the user profile carries the Application server authentication information.

The method according to claim 10, wherein the application server authentication information structure is added in the User Profile structure by extending the User Profile structure carried in the SAA message in the Cx interface, thereby authenticating the application server. The information is passed to the CSCF via the SAA message.

12. An authentication method, wherein the authentication method comprises:

Sending an IP multimedia subsystem IMS network authentication request to the call session control function entity CSCF; receiving an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries application server authentication information;

The application server authentication information is used to authenticate to the application server.

The method of claim 12, wherein the IMS network authentication response message sent by the CSCF is received, where the IMS network authentication response message carrying the application server authentication information includes:

Receiving an IMS network authentication response message 200 OK sent by the CSCF, the 200 OK packet The P-Associated-URI header field is associated with the associated uniform resource identifier, and the P-Associated-URI header field carries application server authentication information.

The IMS network authentication response message sent by the CSCF, the IMS network authentication response message carrying the application server authentication information includes:

Receiving an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries application server authentication information encrypted by using the check bit CK or HA1.

The method according to claim 14, wherein before the authenticating the application server authentication information to the application server, the method further comprises:

The application server authentication information is decrypted by using the check bit CK or HA1.

A call session control function entity CSCF, wherein the call session control function entity CSCF comprises:

An authentication request receiving unit, configured to receive an IP multimedia subsystem IMS network authentication request sent by the user equipment UE;

An authentication information obtaining unit, configured to acquire application server authentication information from the home subscriber server HSS according to the IMS network authentication request;

An authentication response sending unit, configured to send an IMS network authentication response message that includes the application server authentication information to the UE, to trigger the UE to use the application server authentication information to perform authentication on the application server .

The call session control function entity CSCF according to claim 16, wherein the authentication information acquiring unit comprises:

a requesting sub-unit, configured to send a Server-Assignment-Request, a SAR message to the home subscriber server HSS, to obtain a user subscription information of the UE;

The receiving subunit is configured to receive a Server-Assignment-Answer, SAA message sent by the HSS, where the SAA message includes the User Profile, and the User Profile carries application server authentication information.

The call session control function entity CSCF according to claim 16, wherein the authentication response sending unit is configured to send an IMS network authentication response message to the UE.

OK, the associated unified resource identifier P-Associated-URI header field is added to the 200 OK, and the P-Associated-URI header field carries the application server authentication information.

The call session control function entity CSCF according to claim 16, wherein the authentication response sending unit comprises:

An encryption subunit, configured to encrypt the application server authentication information by using a check bit CK or HA1;

And a sending subunit, configured to send an IMS network authentication response message to the UE, where the IMS network authentication response message includes the application server authentication information encrypted by using CK or HA1.

A home subscriber server, where the home subscriber server includes: a receiving unit, configured to receive a first message sent by a call session control function entity CSCF, where The first message includes a UE identifier that requests authentication of the IMS network;

a determining unit, configured to determine whether there is application server authentication information corresponding to the UE, and a sending unit, configured to: when there is application server authentication information corresponding to the UE,

The CSCF sends a second message including application server authentication information corresponding to the UE.

The home subscriber server according to claim 20, wherein the first message is a Server-Assignment-Request, a SAR message, and the second message is a Server-Assignment-Ask, SAA message,

The sending unit is configured to send an SAA message to the CSCF when the application server authentication information corresponding to the UE is present, where the SAA message includes a user subscription information User Profile of the UE, and the user profile Carrying the application server authentication information.

22. A user equipment, where the user equipment includes:

a first authentication request sending unit, configured to send an IP multimedia subsystem IMS network authentication request to the call session control function entity CSCF;

An authentication response receiving unit, configured to receive an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries application server authentication information;

And a second authentication request sending unit, configured to use the application server authentication information to perform authentication on the application server.

23. The user equipment according to claim 22, wherein

The authentication response receiving unit is configured to receive an IMS network authentication response sent by the CSCF The message 200 OK, the 200 OK includes an associated uniform resource identifier P-Associated-URI header field, and the P-Associated-URI header field carries application server authentication information.

24. The user equipment of claim 22, wherein

The authentication response receiving unit is configured to receive an IMS network authentication response message sent by the CSCF, where the IMS network authentication response message carries application server authentication information encrypted by using the check bit CK or HA1.

The user equipment according to claim 24, wherein the user equipment further comprises: a decryption unit, configured to decrypt the application server authentication information by using a check bit CK or HA1.