CN1756428A - Method for carrying out authentication for terminal user identification module in IP multimedia subsystem - Google Patents

Abstract

The invention discloses a method for authenticating a terminal user identity module in an IP multimedia subsystem. In the method, firstly, the IMS system determines the triplet authentication for the UE after receiving the registration request sent by the UE Vector, the triplet authentication vector contains at least RAND and SRES, retains the SRES in the triplet, and sends the RAND to the UE; the UE transmits the RAND to its own end user identity module; the end user identity module Calculate the RES and return the RES to the IMS system through the UE; the IMS system judges whether the RES returned by the UE is equal to the SRES saved by itself, if yes, the authentication passes, otherwise, the authentication fails. The solution of the invention solves the problem in the prior art that the authentication must be realized through the ISIM. Through the solution of the invention, the UE is authenticated through the SIM and USIM modules in the IMS system, greatly reducing the difficulty of popularizing the IM service, and making little change to the existing network.

Description

Method for Authenticating Terminal User Identity Module in IP Multimedia Subsystem

technical field

The present invention relates to authentication technology for mobile terminal, more precisely, relates to a method for authenticating terminal user identity module in IP Multimedia Subsystem (IMS).

Background technique

With the development of multimedia services, multimedia services for mobile terminals have appeared at present. The current IMS system that provides multimedia services for mobile terminals is shown in Figure 1. The system was originally a subdomain superimposed on the existing packet domain of the third generation network (3G). This subdomain is specially used to support IP multimedia business. When the conditions are ripe, the IMS system can also serve users who access in other ways such as terminal local area network (WLAN).

The IMS system is mainly composed of a call control entity and a media gateway component, and the session initiation protocol (SIP) is mainly used to transmit control signaling between each component. The call control component mainly completes functions such as call control, address translation, billing, and concealed mobile terminal (UE) mobility, and is a key component in the IMS system; the media gateway component is for communication with the existing public switched telephone network (PSTN) Introduced for network compatibility. In addition, the Home Subscriber Server (HSS) in the IMS system is a device used in the home network for storing IMS user subscription information.

The security of the IMS system includes user authentication in the IMS system and protection of SIP messages. The security architecture of the IMS system is shown in Figure 2. Among them, the authentication and Security Association (SA: Security Association) negotiation between UE and home network adopts the IMS Authentication Key Agreement (AKA) two-way authentication mechanism, and the encryption and integrity protection of SIP messages adopt the hop-by-hop processing method .

Specifically, in the IMS system, in order to realize the authentication of IP Multimedia (IM) users, the 3GPP protocol organization uses a special IMS Subscriber Identity Module (ISIM) module as the authentication module on the user side, and uses the Universal Mobile AKA mechanism for communication systems (UMTS). The authentication process of the user by the IMS system is shown in Figure 3, corresponding to the following steps:

Step 301, when UE needs to use IMS service, it sends registration request to Serving Call State Control Function (S_CSCF) through Proxy-Call State Control Function (P_CSCF) and Inquiry-Call State Control Function (I_CSCF) in sequence.

Step 302, after receiving the registration request, if the S_CSCF has a quintuple authentication vector (AV) for the user, it will directly use the authentication vector to authenticate the user, that is, enter step 304; if not, then Request AV from HSS.

Here, the five-tuple AV includes: a random number (RAND), an authentication token (AUTN), an encryption key (CK) used by the global mobile communication network, an integrity key (IK) and an expected response (XRES).

Step 303: After receiving the request from the S_CSCF, the HSS determines the quintuple AV and sends it to the S_CSCF.

Of course, in order to improve efficiency, the HSS generally sends multiple groups of quintuple AVs to the S_CSCF in sequence.

Step 304, S_CSCF keeps the XRES in the quintuple AV sent by the HSS, puts RAND, AUTN, CK and IK in the Autn_Challenge message, and sends the message to the P_CSCF through the I_CSCF.

If the HSS sends multiple sets of 5-tuple AVs, the S_CSCF can select a set of 5-tuple AVs in order, and the other 5-tuple AVs will be used in the next authentication for this user.

In step 305, the P_CSCF retains the CK and IK sent by the S_CSCF through the Autn_Challenge message, and delivers the RAND and AUTN to the UE.

If the system has enabled consistency protection and confidentiality protection, P_CSCF will use the saved IK and CK as keys in subsequent sessions.

Step 306, the UE sends the received RAND and AUTN to the ISIM.

Step 307, ISIM verifies the received AUTN, and calculates a response (RES) according to RAND after the verification is passed, then sends the calculated RES to the UE as an authentication response, and the UE returns the RES to the S_CSCF, and at the same time ISIM also calculates IK and CK according to RAND, and sends IK and CK to UE.

The verification of the received AUTN by the ISIM includes determining whether the MAC value contained in the AUTN is legal and whether the SQN is acceptable. Wherein, the verification of whether the SQN is acceptable by the ISIM is to verify whether resynchronization is required.

Specifically, the UE will send the RES to the S_CSCF through the P_CSCF and the I_CSCF, and retain the IK and CK as keys in subsequent sessions.

Steps 308-309, S_CSCF compares the RES in the authentication response sent by the UE with the XRES stored by itself, if they are equal, then determine that the authentication has passed, and send an authentication success message to the UE through the I_CSCF and P_CSCF; otherwise, determine Authentication failed.

The above process requires the use of a separate ISIM module to complete the authentication of the IM domain. It does not contain an ISIM module, so these end user identity modules cannot complete the authentication of the IM domain through the above process. For example, most users currently use Subscriber Identity Module (SIM) cards based on GSM/GPRS networks. Even if some networks are upgraded to 3G networks, users can still access 3G systems through SIM cards because UEs implement dual-mode applications. In this case, because there is no ISIM module in the SIM card, the authentication of the IM domain cannot be completed through the above processing procedure. For another example, currently available UICC cards for 3G generally only include a USIM module for authentication in the CS domain and PS domain, so that the authentication in the IM domain cannot be completed through the above process.

If you do not want to complete the authentication of the IM domain through the above ISIM module-based processing process, but want to achieve authentication through the USIM module, it will occur that the USIM module authenticates the IM domain while implementing CS domain or PS domain authentication. And cause the problem of frequent resynchronization. The so-called resynchronization means: the SQN _MS is saved in the USIM module, if the SQN in the quintuple sent by HSS/HLR is older than the SQN _MS saved in the USIM module, and the SQN sent is the SQN saved by HSS/HLR _HE prevails, which means that the SQN _HE is older than the SQN _MS , so the USIM module will use its own SQN _MS to synchronize the SQN _HE in the HSS/HLR.

Specifically, in order to improve the access efficiency of the network, the VLR for the CS domain, the SGSN for the PS domain, and the S_CSCF for the IM domain will ask for multiple sets of authentication vectors, and only use one of them for authentication each time. authorization processing, and cache the remaining authentication vectors by itself. In this case, if the operation frequency of each domain is different, for example, SGSN and VLR have obtained 5 sets of authentication tuples from the HSS successively. , so _that the 4 sets of remaining authentication vectors cached in the SGSN will be older than the SQN _MS in the USIM module. The SQN _MS desynchronizes the SQN _HE in the HSS/HLR, thereby causing all authentication vectors currently cached by the SGSN/VLR to become invalid. It can be seen from the above examples that if the operating frequencies of different domains differ greatly, frequent resynchronization will inevitably occur.

To solve the above frequent resynchronization problem, HSS can be used to replace all HLRs in the live network, because HSS can divide the issued SQN into CS domain, PS domain and IM domain, so that the USIM module can separately SQN comparison, as long as the SQN corresponding to the authentication tuple issued by the HSS to each domain is guaranteed to be in order, unnecessary re-synchronization process will not be caused. Since there is only one network entity in each domain to cache the authentication tuple, for example, there is a VLR cache in the CS domain, an SGSN cache in the PS domain, and an S_CSCF cache in the IM domain, so the division of the SQN by the HSS can be Fix resync issues.

However, since the current network is in the initial stage, it is basically impossible to replace the HLR on a large scale. A more reasonable solution is to superimpose one or more HSSs dedicated to providing IM services on the basis of the existing network, while the existing The HLR remains unchanged and continues to provide services in the CS and PS domains, while the HSS obtains the user's CS/PS information through interaction with the HLR in the existing network. In this networking situation, the newly added IM domain and the existing CS/PS domain can share the USIM, and the HSS in the IM domain can obtain the authentication vector from the HLR to which the user belongs, but the HLR cannot divide the issued SQN There are CS domain, PS domain and IM domain, so the problem of frequent resynchronization is still not solved.

In addition, if the IMS system is superimposed on the existing network, because the SQN needs to be verified, the HLR of the existing network and the newly added HSS need to share the same AUC, which has a great impact on the existing network.

As can be seen from the above description, if you want to realize IM service in SIM card, or use USIM card to realize IM service without frequent re-synchronization problem, the current solution suggested by 3GPP is to replace the card with a card containing ISIM module. According to the current operation mode, if the user wants to upgrade the UE, he can do so through various means, including purchasing a new phone, upgrading through Java or the interface provided by the mobile phone manufacturer, etc. These upgrades are highly operable. However, if the user wants to change the card, he must go to a special business point authorized by the operator to replace it. In order to ensure the continuity of the business, the IMSI in the new card must be related to the IMSI in the old card. Belonging to the same HLR, therefore, changing the card must be very cumbersome in actual operation.

To sum up, if you want to use the IM service at present, the user's terminal user identification module must contain an ISIM module. Obviously, this requires relatively high requirements for the terminal user identification module, and often requires the user to replace his own SIM card or USIM card to achieve . However, card replacement is very cumbersome in actual operation, which will inevitably greatly reduce the attractiveness of IM services and increase the difficulty for operators to promote IM services.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a method for authenticating the terminal user identity module in the IMS system, so that the user can use the IM service in the 3G system without replacing his own user identity module.

In order to achieve the above object, the technical solution of the present invention is achieved in that a method for authenticating the terminal user identity module in the IP multimedia subsystem, the method may include the following steps:

a. After the IP multimedia subsystem IMS receives the registration request sent by the mobile terminal UE, it determines the triplet authentication vector for the UE, and the triplet authentication vector includes at least a random number RAND and a symbolic response SRES, Retain the SRES in the triplet, and send the RAND to the UE;

b. The UE transmits the RAND to its own end user identity module;

c. The terminal user identity module calculates the RES according to the RAND, and returns the RES to the IMS system through the UE;

d. The IMS system judges whether the RES returned by the UE is equal to the SRES saved by itself, and if yes, the authentication is passed; otherwise, the authentication fails.

In the step a, the IMS system determining the triplet authentication vector for the UE includes: the S_CSCF in the IMS system judges whether it has a triplet authentication vector for the UE, and if so, performs subsequent steps ; Otherwise, request the triplet authentication vector for the UE from the home subscriber server HSS;

After receiving the authentication vector request sent by the S_CSCF, the HSS determines the triplet authentication vector for the UE and sends it to the S_CSCF.

The terminal subscriber identity module in the UE is a subscriber identity module SIM, and the HSS directly determines the triplet authentication vector for the SIM module in the UE.

The terminal user identity module in the UE is a user service identity module USIM;

The HSS determining the triplet authentication vector for the UE includes: the HSS first determines the five-tuple authentication vector for the USIM module, and converts the five-tuple authentication vector into a triplet authentication vector.

The three-tuple authentication vector further includes: Kc; the five-tuple authentication vector includes: RAND, XRES, IK, CK, and AUTN; the five-tuple authentication vector is converted into a three-tuple authentication vector is: discard AUTN in the quintuple, keep RAND, convert XRES to SRES, and convert IK and CK to Kc.

In the step c, the calculation of the RES by the terminal user identification module according to the RAND includes: the USIM module judges whether to convert the quintuple into a triplet according to whether the AUTN is received, such as judging whether it is necessary to start the 3G+Kc mode, if not received When AUTN is received, the 3G+Kc mode is started, and XRES is calculated according to RAND, and XRES is converted into SRES; if AUTN is received, the 3G+Kc mode is not started, and this processing flow ends.

In the step a, the IMS system sends the RAND to the UE as follows: the S_CSCF sends the RAND to the UE through the I_CSCF and the P_CSCF;

In step c, the end user identity module returns the RES to the IMS system through the UE: the end user identity module sends the RES to the UE, and the UE sends the RES to the S_CSCF through the proxy call state control functions P_CSCF and I_CSCF.

The system enables consistency protection and confidentiality protection; and Kc is further included in the triplet;

The step a further includes: the S_CSCF in the IMS system converts Kc in the triplet into CK and IK, and sends the CK and IK to the P_CSCF through the I_CSCF;

The step c further includes: the terminal user identity module calculates Kc, and uploads the Kc to the UE;

The method further includes: the UE converts the Kc uploaded by the terminal user identity module into IK and CK; the UE and the P_CSCF use the IK and CK as keys in subsequent sessions.

The system enables consistency protection and confidentiality protection;

The step a further includes: the S_CSCF in the IMS system sends the Kc in the triplet to the P_CSCF directly through the I_CSCF;

The step c further includes: the terminal user identity module calculates Kc, and uploads the Kc to the UE;

The method further includes: P_CSCF and UE convert Kc received by themselves into CK and IK; UE and P_CSCF use the IK and CK as keys in subsequent sessions.

The terminal user identity module is a USIM module;

In step c, the calculation of Kc by the terminal user identification module further includes: the USIM module determines that the quintuple needs to be converted into a triplet according to the failure to receive the AUTN, for example, after the 3G+Kc mode needs to be started, calculate the IK and IK according to the RAND CK, and convert the IK and CK into Kc, and then send the Kc to the UE.

The scheme of the present invention uses the triplet authentication vector to authenticate the terminal user identification module through the IMS system, and while realizing the authentication using the existing SIM module or USIM module, it also avoids the verification of the SQN by the USIM module. In this way, the new HSS based on the existing network does not need to share the same AUC with the HLR in the existing network. upgrade any existing existing network equipment.

Through the scheme of the invention, users using such as SIM modules and USIM modules can enjoy IM services without upgrading or changing cards, which greatly reduces the difficulty of popularizing IM services.

In addition, all the modifications and transformations involved in the solution of the present invention are implemented in the relevant network entities in the IM domain, and there is no additional requirement for all equipment in the current GSM, GPRS and UMTS, so that the existing network It is possible to overlay an IMS system dedicated to providing the IM domain.

Description of drawings

Figure 1 is a schematic diagram of the structure of the current IMS system;

FIG. 2 is a schematic diagram of a security architecture of the IMS;

FIG. 3 is a sequence diagram of a message flow in which an IMS system authenticates a UE through an ISIM in the prior art;

FIG. 4 is a sequence diagram of a message flow in which the IMS system authenticates the UE through the SIM in the present invention;

FIG. 5 is a message flow sequence diagram of another scheme in which the IMS system authenticates the UE through the SIM in the present invention;

FIG. 6 is a sequence diagram of a message flow in which the IMS system authenticates the UE through the USIM in the present invention;

FIG. 7 is a message flow sequence diagram of another solution for the IMS system to authenticate the UE through the USIM in the present invention.

Detailed ways

Since the process shown in Figure 3 needs to verify the AUTN, for the SIM module and the USIM module, verifying the AUTN will bring frequent resynchronization problems, therefore, the core idea of the present invention is: when the S_CSCF needs to authenticate the UE, use The three-tuple authentication vector that does not contain AUTN performs authentication to avoid the verification of the SQN. In this way, the authentication vector sent by the HSS to the S_CSCF should also be a triplet.

Taking the SIM and the USIM as the terminal user identification module as examples, the solutions of the present invention will be described in detail below in conjunction with the accompanying drawings.

Figure 4 shows the authentication process for SIM card access to the IM domain, corresponding to the following steps:

Step 401, when the UE needs to use the IMS service, it sends a registration request to the S_CSCF through the P_CSCF and the I_CSCF in sequence.

Step 402, after receiving the registration request, the S_CSCF judges whether there is a triplet AV for the user, if it exists, it directly uses the AV to authenticate the user, that is, enters step 404; if it does not exist, it sends to the HSS Request AV.

Here, triplet AV includes: RAND, symbol response SRES and Kc.

Step 403, after receiving the request from the S_CSCF, the HSS determines the triplet AV for the SIM module and sends it to the S_CSCF.

Since the SIM itself supports the triplet AV, the HSS can directly determine the triplet AV for the SIM.

In addition, in order to improve efficiency, the HSS generally sends multiple sets of triplet AVs to the S_CSCF in sequence.

Step 404, S_CSCF retains the SRES in the triplet AV sent by the HSS, converts Kc into CK and IK using a standard algorithm, and then sends the RAND and the converted CK and IK to the P_CSCF through the Auth_Challenge message.

If the HSS sends multiple sets of triplet AVs, the S_CSCF can select a set of AVs in order, and the other AVs will be used in the next authentication for the user.

Step 405, P_CSCF retains CK and IK sent by S_CSCF through Auth_Challenge message, and delivers RAND to UE.

If the system has enabled consistency protection and confidentiality protection, P_CSCF will use the saved IK and CK as keys in subsequent sessions.

Step 406, the UE sends the received RAND to the SIM.

Step 407: After receiving the RAND, the SIM calculates RES and Kc according to the RAND, returns the RES to the S_CSCF through the UE as an authentication response, and uploads Kc to the UE.

Specifically, the UE will send the authentication response returned by the SIM to the S_CSCF through the P_CSCF and the I_CSCF in turn.

Steps 408-409, S_CSCF compares the RES in the authentication response sent by the UE with the SRES saved by itself, if they are equal, then determine that the authentication has passed, and send an authentication success message to the UE through I_CSCF and P_CSCF; otherwise, determine Authentication failed.

Authentication to the SIM can be realized through the above-mentioned processing procedure. Of course, if the system starts the consistency protection and the confidentiality protection, the UE also needs to convert the Kc sent by the SIM into IK and CK as the consistency key and the integrity key of the subsequent session.

In the above process, the conversion algorithm used by S_CSCF and UE can be the three-tuple and five-tuple conversion algorithm given in 3GPP TS33.102, so as to improve the versatility.

For the SIM card authentication process, it can also be realized through the process shown in FIG. 5 . Compared with the above-mentioned process shown in Figure 4, steps 501-503 and steps 506-509 in Figure 5 are the same as the corresponding steps in Figure 4, and the main differences are:

In step 504, the S_CSCF does not convert the Kc, but directly sends the Kc to the P_CSCF through the Auth_Challenge message.

In step 505, what the P_CSCF retains is the Kc sent by the S_CSCF through the Auth_Challenge message. Of course, if the system has enabled consistency protection and confidentiality protection, P_CSCF also needs to use standard algorithms to convert the Kc into CK and IK, and use the saved IK and CK as keys in subsequent sessions.

The process of authenticating through SIM has been described above in conjunction with Figure 4 and Figure 5, and for the process of authenticating through USIM, as shown in Figure 6, it corresponds to the following steps:

Step 601, when the UE needs to use the IMS service, it sends a registration request to the S_CSCF through the P_CSCF and the I_CSCF in sequence.

Step 602, after receiving the registration request, the S_CSCF judges whether there is a triplet AV for the user, if it exists, it directly uses the AV to authenticate the user, that is, enters step 404; if not, it sends the AV to the HSS A triplet AV is requested.

Here, triplet AV includes: RAND, SRES and Kc.

Step 603. After receiving the request from S_CSCF, the HSS determines the quintuple AV corresponding to the USIM. The quintuple AV includes RAND, XRES, IK, CK and AUTN, and then uses the standard conversion algorithm to determine the quintuple AV Convert to the corresponding triplet AV, the triplet AV includes RAND, SRES and Kc, and then send the obtained triplet AV to the S_CSCF.

Since the USIM itself does not support the triplet AV, the HSS needs to first determine the quintuple AV supported by the USIM, and then convert it into the corresponding triplet AV. The main conversion work is: keep the original RAND, discard AUTN, convert XRES to SRES, and convert IK and CK to Kc.

In addition, in order to improve efficiency, the HSS generally determines multiple quintuple AVs, converts each quintuple AV into a corresponding triplet AV, and then sends the converted triplet AVs to the S_CSCF in sequence.

Step 604, S_CSCF retains the SRES in the triplet AV sent by the HSS, converts Kc into CK and IK using a standard algorithm, and then sends RAND and the converted CK and IK to P_CSCF through Auth_Challenge message.

Of course, if the HSS sends multiple sets of triplet AVs, the S_CSCF can select a set of AVs in order, and the other AVs will be used in the next authentication for the user.

Step 605, P_CSCF retains the CK and IK sent by S_CSCF through the Auth_Challenge message, and sends RAND to UE.

If the system has enabled consistency protection and confidentiality protection, P_CSCF will use the saved IK and CK as keys in subsequent sessions.

Step 606, the UE sends the received RAND to the USIM.

Step 607: After receiving the RAND, the USIM determines that the quintuple needs to be converted into a triplet according to the AUTN, uses RAND to calculate XRES, IK, and CK, and then uses the conversion algorithm to convert XRES into RES, and convert IK and The CK is converted into Kc, and the RES is returned to the S_CSCF through the UE as an authentication response, and the converted Kc is uploaded to the UE.

Wherein, the USIM determines according to the AUTN that it needs to convert the quintuple into a triple, and it may be determined according to the AUTN that it needs to start the 3G+Kc mode. According to the AUTN, the USIM determines whether to start the 3G+Kc mode. Specifically: the USIM judges whether the AUTN is received. The 3G+Kc mode is started, and then the subsequent processing is performed.

Specifically, the UE will send the authentication response returned by the USIM to the S_CSCF through the P_CSCF and the I_CSCF in turn.

Steps 608-609, S_CSCF compares the RES in the authentication response sent by the UE with the SRES saved by itself, and if they are equal, it determines that the authentication has passed, and sends an authentication success message to the UE through the I_CSCF and P_CSCF; otherwise, the authentication right failed.

Certainly, if the system starts the consistency protection and the confidentiality protection, the UE also needs to convert the Kc sent by the USIM into IK and CK as the consistency key and the integrity key of the subsequent session.

Similarly, the conversion algorithm used in the above processing may be the triplet and quintuple conversion algorithm given in 3GPP TS 33.102, thereby improving versatility.

For the process of authenticating the USIM card, it can also be realized through the process shown in FIG. 7 . Compared with the process shown in FIG. 6 above, the main difference between this process and the process shown in FIG. 4 and FIG. 5 in the above SIM card authentication process is the same. That is to say, S_CSCF can not convert Kc, but directly send it to P_CSCF. If the system has enabled consistency protection and confidentiality protection, P_CSCF also needs to use standard algorithms to convert Kc into CK and IK, and use them as key in subsequent sessions.

The above descriptions are only preferred embodiments of the solution of the present invention, and are not intended to limit the protection solution of the present invention.

Claims (10)

1, a kind of method of terminal user identification module being carried out authentication in IP Multimedia System is characterized in that, this method may further comprise the steps:

The a.IP multimedia subsystem, IMS is after receiving the register requirement that mobile terminal UE is sent, determine tlv triple authentication vector at this UE, described tlv triple authentication vector comprises random number RA ND and symbol response SRES at least, keeps the SRES in the tlv triple, and RAND is issued to UE;

B.UE is sent to described RAND the terminal user identification module of self;

C. terminal user identification module calculates RES according to RAND, and RES is returned to the IMS system by UE;

The d.IMS system judges whether the RES that UE returns equates with the SRES that self preserves, if then authentication is passed through, otherwise, failed authentication.

2, method according to claim 1, it is characterized in that among the described step a, the definite tlv triple authentication vector at UE of described IMS system comprises: the service in the IMS system-CSCF S_CSCF judges the tlv triple authentication vector that self whether has at this UE, if then carry out subsequent step; Otherwise, to the tlv triple authentication vector of home subscriber server HSS request at this UE;

HSS determines the tlv triple authentication vector at this UE, and sends to S_CSCF after receiving the authentication vector request that S_CSCF sends.

3, method according to claim 2 is characterized in that, the terminal user identification module among the described UE is Subscriber Identity Module SIM, and described HSS directly determines the tlv triple authentication vector at sim module among this UE.

4, method according to claim 2 is characterized in that, the terminal user identification module among the described UE is user's service identifiers module USIM;

Described HSS determines to comprise at the tlv triple authentication vector of UE: HSS at first determines the five-tuple authentication vector at the USIM module, and described five-tuple authentication vector is converted to the tlv triple authentication vector.

5, method according to claim 4 is characterized in that, described tlv triple authentication vector further comprises: the encryption key Kc that the global mobile communication net uses; Described five-tuple authentication vector comprises: RAND, intended response XRES, Integrity Key IK, encryption key CK and authentication-tokens AUTN;

Describedly the five-tuple authentication vector is converted to the tlv triple authentication vector is: abandon the AUTN in the five-tuple, keep RAND, XRES is converted to SRES, and IK and CK are converted to Kc.

6, method according to claim 4, it is characterized in that among the described step c, described terminal user identification module calculates RES according to RAND and comprises: whether USIM module basis receives AUTN judges whether that needs are converted to tlv triple with five-tuple, if do not receive AUTN, then determine and five-tuple need be converted to tlv triple, calculate XRES according to RAND, XRES is converted to SRES; If receive AUTN, then do not carry out conversion, and finish this handling process.

7, method according to claim 1 is characterized in that among the described step a, and the IMS system is issued to UE with RAND and is: S_CSCF is issued to UE by agent call State Control function P_CSCF with RAND;

Among the step c, described terminal user identification module returns to the IMS system with RES by UE and is: terminal user identification module sends to UE with RES, and UE sends to S_CSCF with described RES by P_CSCF again.

8, method according to claim 7 is characterized in that, consistency protection and privacy protection are enabled by described system; Further comprise Kc in the described tlv triple;

Described step a further comprises: the S_CSCF in the IMS system is converted to CK and IK with the Kc in the tlv triple, and described CK and IK are sent to P_CSCF;

Described step c further comprises: terminal user identification module calculating K c, and described Kc is uploaded to UE;

This method further comprises: the Kc that UE uploads terminal user identification module is converted to IK and CK; UE and P_CSCF with described IK and CK as the key in the subsequent session.

9, method according to claim 7 is characterized in that, consistency protection and privacy protection are enabled by described system;

Described step a further comprises: the S_CSCF in the IMS system directly sends to P_CSCF with the Kc in the tlv triple;

Described step c further comprises: terminal user identification module calculating K c, and described Kc is uploaded to UE;

This method further comprises: the Kc that P_CSCF and UE receive self is converted to CK and IK; UE and P_CSCF and with described IK and CK as the key in the subsequent session.

10, according to Claim 8 or 9 described methods, it is characterized in that described terminal user identification module is the USIM module;

Among the step c, described terminal user identification module calculating K c further comprises: the USIM module is not after basis receives that AUTN determines that needs are converted to tlv triple with five-tuple, calculate IK and CK according to RAND, and IK and CK are converted to Kc, afterwards described Kc is sent to UE.

Images