The Public Land Mobile Network (PLMN) defined by the 3rd Generation Partnership Project (3GPP) can be logically divided into two parts: a Core Network (CN) and an Access Network (AN). The CN can be subdivided into a Circuit Switched (CS) domain, a Packet Switched (PS) domain, and an IMS. In different CN, a user must use a different access mode.
(i) CS Domain and User Access
The CS domain provides CS services for users, including voice, CS data, and fax. Typical entities of the CS domain include: a Mobile Switching Center (MSC), adapted to handle call signaling and complete call routing; a Wireless Media Gateway (WMG), adapted to set up media connections and convert voice codes; a Visitor Location Register (VLR), adapted to store information about the current location of a user and the service data; a Home Location Register (HLR), adapted to store subscription data of a user and the information about the current serving VLR; an Equipment Identity Register (EIR), adapted to store user equipment identities; and an Authentication Center (AuC), adapted to generate authentication data.
To ensure the services in the CS domain to be accessible to users, the 3GPP protocol defines a mechanism for a mobile CS user to access a CN. Through this mechanism, the network can obtain the user location information and implement network access security protection.
The network needs to handle access requests when a mobile CS user powers on a Mobile Equipment (ME), roams to a new MSC/VLR service area, updates the location periodically, or invokes a service.
A network operator can decide to use or not to use certain access-related processes, for example, authentication process, encryption process, process of allocating a Temporary Mobile Subscriber Identity (TMSI), in different access operations according to specific policies.
A typical access process of a 3G CS user is shown in FIG. 1. A Mobile Equipment (ME) sends a location update request to the Radio Network Controller (RNC), and sends an authentication information request to the HLR/AUC through an MSC/VLR in turn; afterward, the HLR/AUC returns an authentication request message to the MSC/VLR, RNC and ME in turn.
The process for a CS user to access a network further includes a process of starting security protection.
The identities for use in an access process of a CS user include: Mobile Subscriber ISDN Number (MSISDN), International Mobile Subscriber Identity (IMSI), and TMSI. The composition of an IMSI is shown in FIG. 2. An IMSI uniquely identifies a user in a global mobile network, and is bound to the MSISDN of the user at the time of subscription.
As shown in FIG. 2, an IMSI consists of three parts: Mobile Country Code (MCC), Mobile Network Code (MNC), and Mobile Subscriber Identification Number (MSIN). The MCC is promulgated by the ITU-T and applied globally. An MNC is allocated by the country that governs the MCC according to the actual conditions, and is expressed by two or three digits. An MSIN is allocated by an operator who holds the MCC and MNC. A National Mobile Subscriber Identity (NMSI) is expressed as “MNC+MSIN”.
As shown in FIG. 3, an MSISDN is allocated according to the ITU E.164 numbering plan and E.213 specifications, and consists of three parts: Country Code (CC), National Destination Code (NDC), and Mobile Subscriber Identification Number (MSIN). A CC is an international toll area code, and is promulgated by the ITU-T and applied globally. An NDC is defined by the country that governs the CC and allocated according to the conditions of the country. A mobile operator may have more than one NDC, for example, 135-139 held by China Mobile, and 130-134 held by China Unicom. A national number is defined by the operator holding “CC+NDC”. A national number is expressed as “NDC+SN”.
An MSISDN should be able to serve as a Global Title (GT) of the Signaling Connection Control Part (SCCP) to locate the HLR of the user. In the addressing process, the HLR that serves the user can be located according to the “CC+NDC” of the number, or optionally, plus part of the Subscriber Number (SN). The identity of the HLR related to user registration may be an HLR number compliant with the E.164 specifications, or an HLR ID. The format of an HLR number is the same as that of an MSISDN. An HLR ID consists of several parts of an IMSI, namely, the first few digits of “MCC+MNC+MSIN”.
The TMSI is a locally effective identity in the MSC/VLR service area. It is used with a Location Area Identity (LAI). Therefore, the network operator can stipulate that a TMSI should be reallocated for every access. To prevent an eavesdropper from determining the user location through a unique ID, the GSM/WCDMA network generally allocates a TMSI to the user who accesses an MSC/VLR service area initially.
The CS user who accesses the network should be authenticated. The authentication process includes: obtaining an authentication vector (AV) through the MSC/VLR (MSC is combined with VLR), and performing bidirectional authentication with the user.
The process for an MSC/VLR to obtain an AV includes: when an MSC/VLR of the CN receives a user location update request for access, if the MSC/VLR determines that the user needs authentication, the MSC/VLR requests an AV from the HLR/AUC (HLR is combined with AUC). The AUC generates several groups of AVs arranged sequentially according to the IMSI of the user. An AV includes five elements (RAND, AUTN, CK, IK, RES). The HLR returns all the generated AVs to the MSC/VLR through a response.
After obtaining an AV, the MSC/VLR performs a bidirectional authentication process with the user, including: after receiving the AV groups, the MSC/VLR selects an intact AV, removes the response (RES), and sends it to the RNC to require initiation of authentication. The RNC removes the cipher key (CK) and the integrity key (IK) of the remaining AVs, and sends an authentication request to the ME (USIM). The USIM in the ME can calculate out the CK, IK and RES in the AV group by using different algorithms shared with the network according to the key (K) which is allocated at the time of subscription and shared in the AUC of the network as well as the received random number (RAND). According to the RAND, authentication token (AUTN) and the shared key (K), the ME calculates out the MAC, and compares the value with the MAC value received from the AUTN. If the two values are the same, the ME returns the calculated RES to the MSC/VLR. The MSC/VLR compares the value with the RES stored in the AV, and, if the two values are the same, determines that the ME passes the authentication and is legal.
In a GSM system, the access process of a GSM user is similar to that of a CS user in a 3G system such as CDMA system. As shown in FIG. 4, the differences between the access process of a GSM user and that of a 3G CS user include:
The GSM system has no ME for network authentication, so the AV contains no AUTN parameter;
The GSM system has no data integrity protection, so the AV contains no IK parameter; and
A cipher key (Kc) of the GSM system contains only 64 digits while a CK used in the 3G system contains 128 digits, and the encryption algorithm applied in the 3G system is more intense.
The signed response (SRES) of a GSM system differs from the RES of a 3G system in algorithm and length.
The access process of a 3G and 2G CS user described above reveals that a security mechanism is set for the mobile CS domain to provide security assurance to some extent. The security mechanism of a 3G user is an enhancement of the GSM user security mechanism. That is, the 3G security mechanism is a smooth evolution from the 2G security mechanism.
The foregoing is an access process of the CS network and CS user. The following describes an access process of the IMS network and IMS user.
The IMS is a subsystem that is overlaid on the existing PS domain and supports IP multimedia services. It is intended to provide rich multimedia services such as audio, video, text, interactive session, or combination thereof. The IMS uses the Session Initiation Protocol (SIP), and is independent of access.
As shown in FIG. 5, the function entities in an IMS include: a Call Session Control Function (CSCF) entity that controls user registration and session, an Application Server (AS) that provides various service logic control functions, and a Home Subscriber Server (HSS) that manages subscription data altogether. A user accesses the IMS through the Proxy-CSCF (P-CSCF) of a current visited location. The Serving-CSCF (S-CSCF) in the home domain controls triggering of sessions and services and interacts with the AS about service control.
In an IMS network, each user who subscribes to the IMS service owns one or more private user identities allocated by the home network operator for the purpose of registration, authorization, management and charging. Each IMS user owns one or more public user identities intended for use in service session processes and for identifying the user during communication with other users.
FIG. 6 shows the IMS subscription and the relationship between the public user identity and the private user identity in an IMS. One private user identity corresponds to one or more public user identities.
In an IMS network, the access process of an IMS user can be divided into: initial registration of the user, re-registration of the user, deregistration of the user, re-authentication initiated by the network, deregistration initiated by the network, and event subscription after registration.
In the registration initiated by a user, these parameters must be carried in the request: an IP Multimedia Public Identity (IMPU), an IP Multimedia Private Identity (IMPI), and a home domain name of the user. Other parameters such as the authentication capability and IP address of a User Equipment (UE) may also be carried.
As shown in FIG. 7, the initial registration process initiated by an IMS user includes:
The user uses the IMPU, IMPI, contact address and home domain name stored in the ISIM module to construct a SIP Register message. The message also carries the information about the type and ID of the user access network, the supported encryption, integrity algorithm options, port required for setting up a Security Association (SA) with the P-CSCF, and timeout duration. Afterward, the user sends the message to the default address of the P-CSCF found previously by the UE in the P-CSCF discovery process.
After receiving the message, the P-CSCF stores the user identity and other necessary information, queries for the address of the Interrogating-CSCF (I-CSCF) of the home domain according to the home domain name, and constructs a new Register message which carries the information about the visited network and sends the message to the I-CSCF address indicated by the query result.
According to the private identity of the user, the I-CSCF queries the HSS for the registration state of the user. If the user is not registered, the I-CSCF selects an S-CSCF for handling the Register request of the user. After selecting an S-CSCF, the I-CSCF sends the Register request to the S-CSCF for further processing.
After receiving the Register message, the S-CSCF checks and determines that the user is registered initially, and requests the HSS to allocate an authentication vector (AV) to the user. The composition of the AV is the same as that of a 3G user AV, and is a quintuplet vector. After receiving the allocation result of the HSS, the S-CSCF selects a group of vectors from the SIP 401 message, removes the XRES in the vectors and sends the vectors to the P-CSCF through the I-CSCF.
After removing the CK and IK in the AV, the P-CSCF selects a preferred algorithm according to the encryption and integrity algorithm capabilities of the P-CSCF and the UE, and sets the parameters of the security association in the P-CSCF. The P-CSCF puts such parameters into the 401 message, and initiates an authentication challenge to the UE.
The UE calculates out the CK, IK and RES according to the Authentication Key (K) shared with the network and the received RAND, and authenticates the network in the same way as in a 3G CS domain. Then it negotiates the security association according to the relevant parameters returned by the P-CSCF. After negotiation of the security association, the signaling at the UE and the network side uses the port defined by the security association for communication. After calculating the RES required by the network, the UE needs to construct a new Register message. After encryption and integrity protection, the message is sent to the P-CSCF through the security channel connected to the P-CSCF.
The P-CSCF decrypts the received message. If the message is resolved successfully, the network and the UE have completed encryption and integrity protection. Afterward, the P-CSCF sends the authentication result to the S-CSCF through the I-CSCF. After receiving the Register message, the S-CSCF compares the RES in the message with the RES stored previously. If they are the same, the authentication succeeds. After the authentication is completed, the S-CSCF notifies the HSS of authentication success, and downloads user data from the HSS. Afterward, the S-CSCF sends a 200 OK message to the UE, indicating that the registration succeeds. The message carries the registration lifetime measured in seconds, which is specified by the network. Besides, the S-CSCF may initiate third-party registration to the Application Server (AS) specified in the triggering conditions according to the triggering conditions in the user data.
After receiving a 200 OK response, the P-CSCF initiates a process of subscribing to the registration event packet of the UE to the S-CSCF. After the subscription succeeds, the S-CSCF returns the registration state to the P-CSCF.
After receiving the 200 OK response, the UE initiates a process of subscribing to the registration event packet of the UE to the S-CSCF. After the subscription succeeds, the S-CSCF returns the registration state to the UE.
After completion of the registration, the following processes may be performed for a user who accesses the IMS network:
(1) The re-registration process initiated by the user is shown in FIG. 8. Before expiry of the registration lifetime, the UE initiates re-registration to the network, and indicates support of integrity protection to the network. As shown in the figure, the S-CSCF judges whether to re-authenticate the user. If no authentication is required, the S-CSCF returns a 200 OK response to the UE.
(2) The deregistration process initiated by the user is: In the Register message, the UE set “expires” (a parameter that indicates the registration lifetime) to 0. The S-CSCF notifies the HSS that the user is deregistered. If the UE has no other triggering conditions of the unregistered state, the S-CSCF will no longer store information about the user.
(3) As shown in FIG. 9, the re-registration process initiated by an IMS network includes:
The S-CSCF in the network initiates re-registration of the UE. Re-registration is to send a SIP NOTIFY message to the UE. After the user initiates re-registration, the network decides whether to re-authenticate the user according to the operation policy.
After sending a NOTIFY message, the S-CSCF shortens the registration lifetime of the corresponding IMPI of the user. In this period, if the UE initiates no re-registration process, the S-CSCF initiates a deregistration process.
(4) The deregistration process initiated by the IMS network is shown in FIG. 10. When the user data is deleted from the HSS, or deregistration is triggered by an internal event (re-registration timer timeout) of the S-CSCF, the IMS network initiates a deregistration process. In the deregistration process, different parameters are carried in the NOTIFY message, depending on whether the IMS network expects the UE to initiate registration again.
With the development of network communication technologies, integration of an IMS network with a CS network becomes a megatrend in the industry. To meet the increasing IP multimedia application requirements, the 3GPP proposes an IMS of an all-IP service network architecture on the basis of a packet bearer network. The integrated network is intended to shield the user access mode and improve the multimedia communication experience. Therefore, a solution is required as regards how an existing CS user accesses an IMS network.
Radio interface CS signaling (for example, GSM 04.08 signaling) is used to register a mobile CS user at the CS domain, but the SIP signaling based on a PS network is used to register a user in the IMS. Therefore, a CS user is unable to be registered to the IMS directly. In the prior art, therefore, it is impossible for a CS user to access an IMS network through registration in the IMS network.