CN101207484A - Multimedia subsystem and its method and device for establishing channel - Google Patents

Abstract

The invention provides a multimedia subsystem and its method and device for establishing a channel, which are used for establishing a PSK TLS link in the IMS subsystem. The invention carries PSK TSL in the registration message as an optional security strategy, and negotiates the shared key in the process of signaling registration, thereby effectively speeding up the process of PSK TSL and signaling registration.

Description

Multimedia subsystem and its method and device for establishing channel

technical field

The invention relates to the communication field, in particular to a multimedia subsystem and a method and device for establishing a channel.

Background technique

At present, in many scenarios in a multimedia subsystem (IMS, IP Multimedia Subsystem IP) network, Transport Layer Security (TLS, TransportLayer Security) is used to encrypt Session Initiation Protocol (SIP, Session Initiation Protocol) signaling. In the prior art, when a terminal establishes TLS with a Proxy Call Session Control Function (P-CSCF, Proxy Call Session Control Function), the registration of SIP signaling is separated from the establishment of TLS, and the TLS connection is established before registration, and all subsequent SIP messages are sent over this link.

Since the establishment of a TLS link is separated from the registration of SIP signaling in the prior art, a TCP link must be established between the terminal and the P-CSCF before the TLS link is established, and the whole process has a long delay; and since the establishment of TLS and the registration of signaling are separate In the separate process, HTTP Digest authentication is required between the terminal and the P-CSCF during the signaling registration process, and the terminal user must judge the validity of the certificate, which is troublesome for the user; secondly, because the TLS is established first, and then the SIP signal If there are malicious users in the network who only establish TLS and do not transmit SIP signaling, a large number of TLS will be established between the terminal and the P-CSCF, which will cause the resource exhaustion of the P-CSCF.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method for establishing a channel in a multimedia subsystem, a multimedia subsystem, a terminal, and a proxy call session control function entity, which can reduce the number of PSK TLS links established between the terminal and the P-CSCF and the number of connections between the PSK and PSK. The delay of SIP signaling registration and transmission on the TLS link.

In order to solve the problems of the technologies described above, the purpose of the present invention is achieved through the following technical solutions:

An embodiment of the present invention provides a method for establishing a channel in a multimedia subsystem, including:

The terminal sends a registration message to the proxy call session control function entity P-CSCF, and the registration message includes a shared key to realize the security policy of the transport layer security PSK TLS; the P-CSCF sends the registration message to the serving call session control function entity S -CSCF; the S-CSCF calculates a password digest, and sends an authentication challenge message carrying the user name and the password digest to the P-CSCF; if the P-CSCF supports the PSK TLS security policy, saves the service call session control function The user name and password abstract carried in the authentication challenge message returned by the entity S-CSCF, delete the user name and password abstract carried in the authentication challenge message; P-CSCF sends to the terminal the authentication challenge message with the user name and password abstract deleted; the terminal and The P-CSCF negotiates a key derivation algorithm and establishes a PSK TLS link.

Optionally, if the P-CSCF does not support the PSK TLS security policy, return an authentication challenge error message to the terminal.

Optionally, after the P-CSCF sends the registration message indicating that the shared key realizes the transport layer security PSK TLS as a security policy to the serving call session control function S-CSCF, the S-CSCF calculates the password digest, and the Before the authentication challenge message carrying the user name and the password digest is sent to the P-CSCF, it includes:

The S-CSCF sends a password request message carrying the user name to the home subscriber server HSS;

The HSS queries the user configuration data according to the user name, and returns the password request message carrying the password corresponding to the user name and the user name to the S-CSCF.

The embodiment of the present invention also provides a multimedia subsystem, including:

P-CSCF is used to receive the registration message sent by the terminal, and the registration message includes a shared key to realize the security strategy of the transport layer security PSK TLS; the registration message is sent to the service call session control function S-CSCF, and it is judged if supported PSK TLS security policy, save the user name and password digest carried in the authentication challenge message returned by the service call session control function entity S-CSCF, negotiate with the terminal on the password digest algorithm, and establish a PSK TLS link with the terminal; S-CSCF uses For calculating the password digest, send an authentication challenge message carrying the user name and the password digest to the P-CSCF.

Optionally, the P-CSCF is configured to return an authentication challenge error message to the terminal if the PSK TLS security policy is not supported.

Optionally, the multimedia subsystem includes:

The S-CSCF is configured to send a password request message carrying a username to the home subscriber server HSS;

The HSS is configured to query the user configuration data according to the user name, and return the password request message carrying the password corresponding to the user name and the user name to the S-CSCF.

The embodiment of the present invention also provides a terminal, including:

The registration message sending unit is used to send the registration message to the proxy call session control function entity P-CSCF, and the registration message includes the security policy that the shared key realizes the transport layer security PSK TLS; the authentication challenge message receiving unit is used for in the described After the registration message sending unit sends the registration message to the P-CSCF, it receives the authentication challenge message sent by the P-CSCF without user name and password digest; the key algorithm negotiation unit is used to receive the P - After the authentication challenge message sent by the CSCF that does not carry the user name and password digest, negotiate the key derivation algorithm with the P-CSCF; establish a PSK TLS unit for negotiating the key derivation algorithm with the P-CSCF in the key algorithm negotiation unit After that, establish the PSK TLS connection with the P-CSCF.

The embodiment of the present invention also provides a proxy call session control function entity, including:

The registration message forwarding unit is used to send the registration message sent by the terminal to the S-CSCF, and the registration message includes a shared key to realize the security strategy of the transport layer security PSK TLS; a security policy judging unit is used to judge whether to support PSK TLS security policy, if supported, then notify the password storage unit to save the user name and password summary carried in the authentication challenge message returned by the S-CSCF; the password storage unit is used to store after the security policy judging unit supports the PSK TLS security policy The user name and password abstract carried in the authentication challenge message returned by the S-CSCF, and delete the user name and password abstract carried in the authentication challenge message; the authentication challenge message forwarding unit is used to delete the user name and password from the password storage unit A digest of the Authentication Challenge message is sent to the endpoint. A key negotiation unit, configured to negotiate a key derivation algorithm with the terminal after the authentication challenge message forwarding unit sends the authentication challenge message in which the password storage unit has deleted the username and password digest to the terminal; establishes a PSK TLS link unit, It is used to establish a PSK TLS connection with the terminal after the key agreement unit negotiates the key derivation algorithm with the terminal.

As can be seen from the above technical solutions, since the present invention indicates in the registration message that the shared key realizes the transport layer security PSK TLS as a security policy, the security policy is negotiated in the signaling registration process, which reduces the time for establishing a PSK TLS link and signaling registration , effectively reducing the delay of signaling registration and transmission.

Further, since the present invention carries the user name and password digest in the registration message, it effectively prevents the password from being eavesdropped during transmission, and the registration message does not need to carry the authentication message, and neither the terminal nor the server needs to carry out any further authentication. Authentication information judgment, user-friendly.

Further, the present invention provides that if the P-CSCF does not support the security policy of PSK TLS, an authentication challenge error message is returned to the terminal, so as to avoid that if the P-CSCF does not support the security policy of PSK TLS, the terminal cannot receive a response for a long time, wasting users time.

Further, since the present invention provides that the P-CSCF requests the user name and the password corresponding to the user name from the HSS through the S-CSCF, the S-CSCF calculates the password digest and feeds it back to the P-CSCF, reducing the burden on the P-CSCF.

Further, since the present invention negotiates the password digest algorithm when establishing the PSK TLS link, it ensures the consistency of the terminal and the P-CSCF password digest algorithm, and ensures the smooth establishment of the PSK TLS link.

Description of drawings

Fig. 1 is the embodiment diagram of the method for establishing channel in the multimedia subsystem provided by the present invention;

FIG. 2 is a structural diagram of a multimedia subsystem provided by an embodiment of the present invention.

Detailed ways

The present invention provides a method for establishing a channel in a multimedia subsystem, the multimedia subsystem, a terminal, and a proxy call session control function entity, which can realize the establishment of a PSK TLS link between the terminal and the P-CSCF. The present invention carries the PSK TSL in the registration message as an optional security strategy, and negotiates the shared key in the process of signaling registration, thereby effectively accelerating the process of PSK TSL and signaling registration.

The following invention provides detailed examples.

Please refer to FIG. 1 , which is a diagram of an embodiment of a method for establishing a channel in a multimedia subsystem provided by the present invention.

101. The terminal sends a registration message to the P-CSCF;

The registration message sent by the terminal to the P-CSCF includes the security policy of the shared key to realize the security of the transport layer PSKTLS.

102. After receiving the registration message, the P-CSCF sends the registration message to the S-CSCF;

The registration message sent by the P-CSCF to the S-CSCF contains the security policy of the shared key to realize the security PSKTLS of the transport layer.

103. The S-CSCF sends a password request message to the HSS;

The S-CSCF sends a password request message (MAR message) to the HSS, and the password request message carries the user name carried in the registration message;

The S-CSCF requests the password corresponding to the username from the Home Subscriber Server (HSS, Home Subscriber Server) according to the username carried in the registration message indicating that the shared key realizes the transport layer security PSK TLS as the security policy.

104. The HSS returns the password request message carrying the password corresponding to the user name and the user name to the S-CSCF;

The HSS queries and stores the login password registered by the registered user and returns it to the S-CSCF.

105. The S-CSCF sends an authentication challenge message to the P-CSCF;

S-CSCF uses the MD5 algorithm to calculate the password digest according to the password returned by HSS; sends the authentication challenge message (4xx-Auth_Challenge) carrying the user name and password digest to P-CSCF; P-CSCF judges whether to support it after receiving the authentication challenge message PSK TLS security policy, if supported, save the username and password digest carried in the authentication challenge message, and delete the username and password digest in the authentication challenge message; if the P-CSCF does not support the PSK TLS security policy, return an authentication challenge error message to the terminal .

106. The P-CSCF sends an authentication challenge message to the terminal;

The P-CSCF extracts and saves the digest of the user name and password in the authentication challenge message sent by the S-CSCF. The P-CSCF sends an authentication challenge message that does not carry the user name and password digest to the terminal.

107. The terminal negotiates a key derivation algorithm with the P-CSCF;

After receiving the authentication challenge message sent by the P-CSCF, the terminal sends a ClientHello message to the P-CSCF, carrying the key derivation algorithm as PSK or DH.

After receiving the ClientHello message sent by the terminal, the P-CSCF sends a ServerHello message to the terminal, and selects the same key derivation algorithm as carried in the ClientHello message, which is PSK or DH.

108. Establish PSK TLS between the terminal and the P-CSCF;

After negotiating the key derivation algorithm between the terminal and the P-CSCF, the encryption key and the integrity key are derived by using the existing password digest of the terminal and the P-CSCF, and the PSKTLS between the terminal and the P-CSCF is established.

109. The terminal sends a subsequent registration message to the P-CSCF through PSKTLS, and performs subsequent standard procedures;

The registration request message REGISTER carries the authentication response (username, password and verification information) to the P-CSCF entity for subsequent standard registration procedures.

Please refer to FIG. 2 which is a structural diagram of the multimedia subsystem provided by the present invention.

P-CSCF300 is used to receive the registration message sent by the terminal, send the registration message to the serving call session control function entity S-CSCF, determine if the PSK TLS security policy is supported, and save the authentication returned by the serving call session control function entity S-CSCF Challenge the user name and password digest carried in the message, negotiate with the terminal on the key derivation algorithm, and establish a PSK TLS connection with the terminal;

The S-CSCF400 is configured to calculate a password digest, and send an authentication challenge message carrying the user name and the password digest to the P-CSCF.

On the basis of the above solution, if the P-CSCF 300 does not support the PSK TLS security policy, it returns an authentication challenge error message to the terminal.

Also optionally, the S-CSCF400 is configured to send a password request message carrying a username to the home subscriber server HSS;

The HSS500 is configured to query user configuration data according to the user name, and return a password request message carrying the password corresponding to the user name and the user name to the S-CSCF.

The present invention also provides a terminal, including: a registration message sending unit, configured to send a registration message to the proxy call session control function entity P-CSCF, the registration message includes a shared key to realize the security policy of the transport layer security PSK TLS; authentication The challenge message receiving unit is configured to receive the authentication challenge message sent by the P-CSCF without the username and password digest after the registration message sending unit sends the registration message to the P-CSCF; the key algorithm negotiation unit is configured to After the authentication challenge message receiving unit receives the authentication challenge message sent by the P-CSCF and does not carry the user name and password digest, it negotiates with the P-CSCF on a key derivation algorithm; establishes a PSK TLS unit for negotiation of the key algorithm After the unit negotiates the key derivation algorithm with the P-CSCF, it establishes a PSK TLS link with the P-CSCF.

The present invention also provides a proxy call session control function entity, including:

The registration message forwarding unit is used to send the registration message sent by the terminal to the S-CSCF, and the registration message includes a shared key to realize the security strategy of the transport layer security PSK TLS; a security policy judging unit is used to judge whether to support PSK TLS security policy, if supported, then notify the password storage unit to save the user name and password summary carried in the authentication challenge message returned by the S-CSCF; the password storage unit is used to store after the security policy judging unit supports the PSK TLS security policy The user name and password abstract carried in the authentication challenge message returned by the S-CSCF, and delete the user name and password abstract carried in the authentication challenge message; the authentication challenge message forwarding unit is used to delete the user name and password from the password storage unit A digest of the Authentication Challenge message is sent to the endpoint. A key negotiation unit, configured to negotiate a key derivation algorithm with the terminal after the authentication challenge message forwarding unit sends the authentication challenge message in which the password storage unit has deleted the username and password digest to the terminal; establishes a PSK TLS link unit, It is used to establish a PSKTLS link with the terminal after the key agreement unit and the terminal negotiate a key derivation algorithm.

A method for establishing a channel in a multimedia subsystem provided by the present invention, a multimedia subsystem, a terminal, and a proxy call session control functional entity have been introduced in detail above. In this paper, specific examples are used to explain the principles of the present invention. and the embodiment have been described, the description of the above embodiment is only used to help understand the method of the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, in the specific embodiment and application scope There will be changes. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (8)

1. set up the method for passage in the IP multimedia subsystem, IMS, it is characterized in that, comprising:

Terminal sends registration message to proxy call conversation control function entity P-CSCF, and described registration message comprises shares the security strategy that key is realized Transport Layer Security PSK TLS;

P-CSCF sends to service call session control function entity S-CSCF with described registration message;

Described S-CSCF calculates cryptographic summary, and the authentication challenge message of carrying described user name and described cryptographic summary is sent to described P-CSCF;

P-CSCF is if support PSK TLS security strategy, and the username and password summary that carries in the authentication challenge message that preservation service call session control function entity S-CSCF returns is deleted the username and password summary that carries in the described authentication challenge message;

P-CSCF sends the authentication challenge message of having deleted the username and password summary to terminal;

Terminal and P-CSCF arranging key derive from algorithm, set up PSK TLS link.

2. set up the method for passage in the IP multimedia subsystem, IMS according to claim 1, it is characterized in that, comprising: described P-CSCF is not if support the security strategy of PSK TLS, to terminal return authentication challenge error message.

3. set up the method for passage in the IP multimedia subsystem, IMS according to claim 2, it is characterized in that, after described P-CSCF sends to service call conversation control function S-CSCF with the described registration message that shows that shared key realization Transport Layer Security PSK TLS is a security strategy, described S-CSCF calculates cryptographic summary, the authentication challenge message of carrying described user name and described cryptographic summary is sent to before the described P-CSCF, comprising:

Described S-CSCF sends the password that carries user name to home signature user server HSS and asks for message;

HSS asks for message with the password that carries password corresponding with described user name and user name and returns to S-CSCF according to user name inquiring user configuration data.

4. an IP multimedia subsystem, IMS is characterized in that, comprising:

P-CSCF is used for the registration message that receiving terminal sends, and described registration message comprises shares the security strategy that key is realized Transport Layer Security PSK TLS; Described registration message is sent to service call conversation control function S-CSCF, judge if support PSK TLS security strategy, the username and password summary that carries in the authentication challenge message that preservation service call session control function entity S-CSCF returns, consult the cryptographic summary algorithm with terminal, set up with terminal between PSK TLS link;

S-CSCF is used to calculate cryptographic summary, and the authentication challenge message of carrying described user name and described cryptographic summary is sent to described P-CSCF.

5. IP multimedia subsystem, IMS according to claim 4 is characterized in that, described P-CSCF is used for if do not support PSK TLS security strategy, to described terminal return authentication challenge error message.

6. IP multimedia subsystem, IMS according to claim 5 is characterized in that, described IP multimedia subsystem, IMS comprises:

Described S-CSCF is used for sending the password that carries user name to home signature user server HSS and asks for message;

HSS is used for the password that carries password corresponding with described user name and user name being asked for message returning to S-CSCF according to user name inquiring user configuration data.

7. a terminal is characterized in that, comprising:

The registration message transmitting element is used for sending registration message to proxy call conversation control function entity P-CSCF, and described registration message comprises shares the security strategy that key is realized Transport Layer Security PSK TLS;

The authentication challenge message receiving element is used at described registration message transmitting element receiving the authentication challenge message of not carrying the username and password summary that P-CSCF sends after described P-CSCF sends registration message;

The key algorithm negotiation element is used for deriving from algorithm with the P-CSCF arranging key after described authentication challenge message receiving element receives the authentication challenge message of not carrying the username and password summary of P-CSCF transmission;

Set up PSK TLS unit, be used for after described key algorithm negotiation element and P-CSCF arranging key derive from algorithm, set up with P-CSCF between PSK TLS link.

8. a proxy call conversation control function entity is characterized in that, comprising:

The registration message retransmission unit is used for the registration message that described terminal sends is sent to S-CSCF, and described registration message comprises shares the security strategy that key is realized Transport Layer Security PSKTLS;

The security strategy judging unit is used to judge whether to support PSK TLS security strategy, if support then to notify the username and password summary that carries in the password preservation unit preservation authentication challenge message that S-CSCF returns;

Password is preserved the unit, be used for after described security strategy judgment unit judges is supported PSK TLS security strategy, the username and password summary that carries in the authentication challenge message that preservation S-CSCF returns, and delete the username and password summary that carries in the described authentication challenge message;

The authentication challenge message retransmission unit, the authentication challenge message that has been used for described password preservation element deletion the username and password summary sends to terminal.

The key agreement unit is used for deriving from algorithm with the terminal arranging key after described authentication challenge message retransmission unit has been preserved element deletion with described password the authentication challenge message of username and password summary sent to terminal;

Set up PSK TLS link unit, be used for after key agreement unit and terminal arranging key derive from algorithm, setting up with terminal between PSK TLS link.

Images