WO2013064040A1 - 一种ims单点登录的组合鉴权方法及*** - Google Patents

一种ims单点登录的组合鉴权方法及*** Download PDF

Info

Publication number
WO2013064040A1
WO2013064040A1 PCT/CN2012/083623 CN2012083623W WO2013064040A1 WO 2013064040 A1 WO2013064040 A1 WO 2013064040A1 CN 2012083623 W CN2012083623 W CN 2012083623W WO 2013064040 A1 WO2013064040 A1 WO 2013064040A1
Authority
WO
WIPO (PCT)
Prior art keywords
ims
idp
authentication
http
sso
Prior art date
Application number
PCT/CN2012/083623
Other languages
English (en)
French (fr)
Inventor
张孟旺
田甜
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2013064040A1 publication Critical patent/WO2013064040A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/41—User authentication where a single sign-on provides access to a plurality of computers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1016—IP multimedia subsystem [IMS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response

Definitions

  • the present invention relates to network communication security technologies, and in particular, to a combined authentication method and system for IMS single sign-on. Background technique
  • Unified IP Multimedia Subsystem IMS, IP Multimedia Subsystem
  • UICC Universal Integrated Circuit Card
  • SIP Digest Session Digest Protocol
  • AS Application Server
  • SSO-SPS architectures in SSO-APS can implement this function.
  • the architecture is usually implemented by unified IMS users.
  • IMS UE such as IMS UE or IP Multimedia Service Subsystem User
  • HSS User Home Network Server
  • AS and Identity Authentication Provider Entity
  • IMS UE and IdP are connected through SSOb interface
  • IMS The UE and the AS are connected through the SSOa interface
  • the IdP is connected to the HSS through the SSOh interface.
  • the IdP is used to authenticate the identity with the IMS UE by using the SIP Digest authentication mechanism, and authenticate the AS, and simultaneously generate the shared key K between the IdP and the IMS UE.
  • the HSS stores the subscription file for describing the user information, and the HSS also has the function of generating the authentication information; the AS provides the network service service for the IMS UE.
  • the IMS UE is authenticated by using the SIP Digest authentication mechanism in the scenario where the operator does not deploy the Generic Bootstrapping Architecture (GBA) and the IMS UE does not have the UICC.
  • GBA Generic Bootstrapping Architecture
  • the SSO function of the IMS UE to the AS is implemented.
  • the foregoing specific process is as follows: The IMS UE sends a service request to the AS (RP); the AS redirects the service request to a unified authentication center IdP.
  • the redirected information stream includes the private identity identifier of the IMS UE and the AS; the IdP authenticates the AS according to the received private identity identifier of the AS, and saves the authentication result, and determines whether there is a key corresponding to the IMS UE. If the key exists, the IMS UE has been authenticated, and the SIP Digest authentication mechanism is not required to be used for authentication again. The authentication is skipped and the subsequent steps are directly performed.
  • the IdP obtains the SIP Digest authentication vector and the IMPI-based user terminal from the HSS.
  • IdP generates a random number nonce, and stores the nonce and H(A1) downloaded from the HSS; IdP sends a 401 authentication challenge message to the IMS UE using the SIP Digest authentication mechanism; the IMS UE generates a random number cnonce and generates H ( A1), in turn, generates a key KQ, and uses a parameter to calculate a response value response; the IMS UE sends a response message to the IdP for the 401 authentication challenge message, completes authentication of the IMS UE in the IdP, and generates a shared key Ko; IdP is generated again.
  • IdP uses the key Ko encryption key and AS authentication result, using AS and IdP shared key encryption and pair I The authentication result of the MS UE; the IdP redirects the encrypted and the authentication result of the IMS UE to the AS; the IMS UE decrypts the authentication result of the AS, and generates the shared key K l Q information is redirected to the AS; the AS decrypts the information Obtaining the authentication result and key of the IMS UE At this time, the shared key K l is shared between the IMS UE and the AS, so that subsequent communication between the IMS UE and the AS can be performed securely.
  • ID-FF Identity Alliance Architecture
  • ID-WSF Identity Web Service Framework
  • ID-SIS Identity Service Interface Specification
  • ID-FF mainly includes Identity Federation function and SSO Function
  • ID-FF architecture mainly includes three entities: IMS UE, identity authentication provider IdP, service provider SP.
  • the identity confederation function means that the IMS UE has its own identity on the IdP and the SP, that is, user identities, and these identities can form an alliance.
  • the SSO function refers to the function of the above identity identity alliance. On the basis of this, as long as the IMS UE passes the authentication on the IdP, it is equal to the authentication at the same time on all the SPs that form the alliance.
  • the IMS UE For the IMS UE, there are two authentication methods: One is that after the IMS UE authenticates the IdP, the IdP will directly return the IMS UE's authentication declaration Assertion to the IMS UE, and the IMS UE sends the authentication declaration Assertion.
  • the SP For the SP, the SP authenticates the IMS UE by analyzing the Assertion.
  • the IMS UE After the IMS UE authenticates the IdP, the IdP returns the IMS UE's authentication claim link Artiface to the IMS UE.
  • the IMS UE sends the authentication claim link Artifact to the SP, and the SP passes the Artifact.
  • the Simple Object Access Protocol (SOAP) is sent to the IdP.
  • the IdP queries the corresponding Assertion according to the Artifact and returns it to the SP.
  • the SP authenticates the IMS UE by analyzing the Assertion.
  • SOAP Simple Object Access Protocol
  • the IMS UE and the SSO server are authenticated to obtain the shared key Ko, which can provide a secure session key for the subsequent access RP application, which can conveniently complete the single-point authentication process and enhance the security of the authentication.
  • the security of messaging but increases the complexity and inconvenience of IMS UE operations.
  • the identity-based alliance architecture an identity-based security association is established between each SP and the IdP through the identity-based alliance function, and a security trust circle is formed. As long as the authentication is passed on the IdP, it is equal to the security of the IdP. All SPs in the circle of trust have also passed authentication.
  • the two architectures can communicate with each other, the original security will not be reduced, and the IMS UE operation simplicity can be increased, and the application scenario of the IMS UE can be extended to use various existing ones. WEB business.
  • a typical scenario in which the GBA architecture and the identity association architecture are interoperable is defined in the current 3GPP specification 33.980, that is, the IdP and the NAF are one entity.
  • the Ub interface and the Zn interface function of the original GBA architecture are basically unchanged.
  • the IdP and IMS UE of the identity association architecture need to add the GBA function; the related SP and the IdP/NAF form a security trust circle through the identity identification alliance function; When the UE accesses each SP, it first passes the authentication authentication on the IdP/NAF, which is equal to Relevant other SPs have also passed authentication.
  • the main object of the present invention is to provide a combined authentication method and system for IMS single sign-on, which can implement the fusion and interworking between the SSO-APS and the SSO architecture and the free association architecture.
  • the present invention provides a combined authentication method for IMS single sign-on, including:
  • the SP sends a response message to the IMS UE, where the response message carries the address information of the identity identification authentication request information AuthnRequest and L_IdP/AS;
  • the IMS UE sends an HTTP service request message to the L-IdP/AS according to the address information of the L-IDP/AS, where the HTTP service request message carries the AuthnRequest;
  • the L-IdP/AS sends a challenge response message to the IMS UE, and the IMS UE performs its own authentication by using the SSO-based authentication method in the SSO-ASP;
  • the L-IdP/AS authenticates the IMS UE. If the authentication succeeds, a security association is established between the L-IdP/AS and the IMS UE.
  • the method further includes: the IMS UE interacts with the SP to complete the SSO authentication.
  • the AuthnRequest is carried in the HTTP service request message: the HTTP service request message carries an AuthnRequest obtained from the SP and an identifier indicating that the IMS UE supports the SSO-APS authentication mechanism.
  • the L_IdP/AS sends a challenge response message to the IMS UE: After receiving the HTTP service request message sent by the IMS UE, the L-IdP/AS finds the address information of the corresponding IdP, and sends a redirected HTTP challenge response message to the IMS UE, where the redirected HTTP challenge response message carries the IMS UE to carry
  • the indication information of the identity information to the corresponding IdP for authentication further carries the address information of the IdP, the identity information of the L-IdP/AS, and the identifier indicating that the IMS UE needs to perform the SSO-APS authentication mechanism.
  • the IMS UE performs its own authentication by using an authentication method based on the SSO framework in SSO-ASP:
  • the IMS UE sends an authentication request message to the IdP, and the IdP authenticates the L_IdP/AS; if the IdP determines that the shared key K of the UE and the IdP exists. , then use the shared key ⁇ to generate E K . (noncel, OP/AS- Auth), using pre-generated shared key generation of L-IdP/AS and IdP
  • the IdP redirects the IMS UE to the L-IdP/AS; the redirect message carries E K0 (noncel, OP/AS- Auth) and Rapauth;
  • the IMS UE is based on E K . (noncel, OP/AS- Auth) determines the legality of the L-IdP/AS. If it is legal, the IMS UE calculates the rspauth and authenticates the network according to the rspauth and the received rapauth. When the authentication succeeds, the key K l Q is generated .
  • the method also includes:
  • the IdP obtains the SIP Digest authentication vector (SD-AV) from the HSS, and generates a random number nonce, and stores the hash function value H(A1) in the nonce and SD-AV;
  • the IdP sends a 401 unauthenticated challenge message to the IMS UE, and the IMS UE generates a random number cnonce and H(A1), and uses cnonce and H(A1) to generate a shared key K of the IMS UE and the IdP. And calculate the response;
  • the IMS UE sends a response message of the 401 unauthenticated challenge message to the IdP, and the IdP checks the nonce in the response message. If the check is correct, the IdP calculates the Xresponse and uses the Xresponse. The IMS UE is authenticated. If the authentication is passed, the IdP calculates rspauth and uses H(A1) and cnonce to generate the shared key Ko.
  • the L-IdP/AS authenticates the IMS UE. If the authentication succeeds, the security association between the L-IdP/AS and the IMS UE is: IdP IMS UE During the process of redirecting to L-IdP/AS, the sent message is redirected to
  • the IMS UE Immediately following the message in the redirection process, the IMS UE sends an HTTP request message to the L_IdP/AS;
  • the L-IdP/AS decrypts the shared key after receiving the request message At the same time, the L-IDP/AS authenticates the IMS UE according to the AuthnRequest. If the authentication succeeds, the L-IdP/AS will notify the IMS UE that the SP of the identity association can be formed, and the IMS UE accepts and completes the SP with the SP.
  • An identity association, an IMS UE, and an L-IDP/AS establish a security association.
  • the IMS UE interacts with the SP to complete the SSO authentication as:
  • the L-IdP/AS returns an HTTP authentication success response message to the IMS UE, where the HTTP authentication success response message carries Assertion;
  • the IMS UE re-initiates an HTTP application request message to the SP, where the HTTP application request message carries Assertion;
  • the SP processes the Assertion, and performs the SSO authentication on the IMS UE according to the identity information of the L-IDP/AS generated in the process of establishing the security association between the IMS UE and the L-IdP/AS, and returns the success to the IMS UE. HTTP response message.
  • the IMS UE interacts with the SP to complete the SSO authentication as:
  • L-IdP/AS generates a corresponding Artifact and Assertion, and saves the corresponding relationship between the two, and returns an HTTP authentication success response message to the IMS UE, where the HTTP authentication success response message carries the Artifact;
  • the IMS UE re-initiates an HTTP application request message to the SP, where the HTTP application requests cancellation Carrying an Artifact in the message;
  • the SP sends an HTTP request message to the L-IdP/AS, where the HTTP request message carries an Artifact;
  • the L-IdP/AS finds the corresponding Assertion according to the Artifact, and returns an HTTP response message to the SP.
  • the HTTP response message carries the Assertion; the SP processes the Assertion, and establishes a security association process between the IMS UE and the L-IdP/AS.
  • the L-IdP/AS generated in the identity identifies the alliance information, performs SSO authentication on the IMS UE, and returns a successful HTTP response message to the IMS UE.
  • the present invention also provides a combined authentication system for IMS single sign-on, including: SP, IMS UE, L-IdP/AS;
  • the SP is configured to send a response message to the IMS UE, where the response message carries the address information of the identity identifier authentication request information AuthnRequest and L_IdP/AS;
  • the IMS UE is configured to send an HTTP service request message to the L-IdP/AS according to the address information of the L-IDP/AS, where the HTTP service request message carries the AuthnRequest;
  • L-IdP/AS configured to send a challenge response message to the IMS UE
  • the IMS UE is also used for authentication by itself based on the SSO-based authentication method in SSO-ASP;
  • the L-IdP/AS is also used to perform identity authentication on the IMS UE after the IMS UE is successfully authenticated. If the authentication succeeds, a security association is established between the L-IdP/AS and the IMS UE.
  • the IMS UE is further configured to: interact with the SP to complete SSO authentication.
  • the SP sends a response message to the IMS UE, where the address information of the identity authentication request information AuthnRequest and L_IdP/AS is carried; the IMS UE according to the L- The address information of the IdP/AS sends an HTTP service request message to the L-IdP/AS, where the AuthnRequest is carried; L-IdP/AS sends a challenge response message to the IMS UE, and the IMS UE adopts an SSO-based SSO architecture. Recognize The authentication method performs its own authentication. After the IMS UE is successfully authenticated, the L-IdP/AS authenticates the IMS UE.
  • the SSO architecture and the free association architecture are integrated to meet the non-UICC scenario.
  • the unified IMS UE uses the combined authentication method and system to implement the SSO function to the application server.
  • FIG. 1 is a schematic flowchart of a method for implementing a combination authentication method for implementing IMS single sign-on according to the present invention
  • FIG. 2 is a schematic flowchart of a method for implementing step 104 of the present invention
  • FIG. 3 is a schematic flowchart of Embodiment 1 of the method for implementing Step 106 of the present invention
  • FIG. 4 is a schematic flowchart of Embodiment 2 of the method for implementing Step 106 of the present invention
  • FIG. 5 is a combined authentication for implementing IMS single sign-on according to the present invention
  • the basic idea of the present invention is: The SP sends a response message to the IMS UE, where the address information of the identity identification authentication request information AuthnRequest and L_IdP/AS is carried; the IMS UE according to the address information of the L_IdP/AS, to the L
  • the IdP/AS sends an HTTP service request message, where the AuthnRequest is carried, and the L-IdP/AS sends a challenge response message to the IMS UE, and the IMS UE performs the authentication according to the SSO-based authentication method in the SSO-ASP; After the authentication succeeds, the L-IdP/AS authenticates the IMS UE. If the authentication succeeds, a security association is established between the L-IdP/AS and the IMS UE.
  • FIG. 1 is a schematic flowchart of a combined authentication method for implementing IMS single sign-on according to the present invention. As shown in FIG. 1, the method includes the following steps:
  • Step 101 The SP sends a response message to the IMS UE, where the identity identification request is carried. Address information of the information AuthnRequest and L_IdP/AS;
  • the IP multimedia service subsystem user sends an application request message to the SP; after receiving the application request message, the SP acquires the address of the L_IdP/AS; the SP sends a response message to the IMS UE, requesting the IMS UE to respond accordingly.
  • the L-IdP/AS performs authentication, and the response message carries address information of the identity authentication request information AuthnRequest and L_IdP/AS.
  • Step 102 After receiving the response message, according to the address information of the L_IDP/AS in the response message, the IMS UE sends an HTTP service request message to the L-IdP/AS, where the acquired AuthnRequest is carried;
  • the IMS UE After receiving the response message sent by the SP, according to the address information of the L_IdP/AS in the response message, the IMS UE sends an HTTP service request message to the L-IdP/AS, and the HTTP service request message carries the information obtained from the SP.
  • the AuthnRequest also carries an identifier indicating that it supports the SSO-APS authentication mechanism.
  • Step 103 The L-IdP/AS sends a challenge response message to the IMS UE.
  • the L-IdP/AS finds that the IMS UE supports the SSO-APS authentication mechanism and finds the address information of the corresponding IdP; L-IdP/AS and IdP utilize the existing mechanism.
  • a shared key is generated between the two, such as a Diffie-Hellman key exchange mechanism or a pre-configured key, and then the L-IdP/AS sends a redirect HTTP challenge response message to the IMS UE, the redirected HTTP challenge.
  • the response message carries the indication information that requires the IMS UE to carry the identity identification information to the corresponding IdP for authentication, and also carries the address information of the IdP, the identity identification information of the L-IdP/AS, and a signal indicating that the IMS UE needs to perform the SSO-APS authentication mechanism.
  • Step 104 After receiving the challenge response message, the IMS UE performs its own authentication by using an SSO-based authentication method based on SSO-ASP.
  • Step 105 After the IMS UE is successfully authenticated, the L-IdP/AS performs identity authentication on the IMS UE. If the authentication succeeds, a security association is established between the L IdP/AS and the IMS UE. Specifically, the IdP redirects the IMS UE to the L-IdP/AS, and the sent message is redirected to the L-IdP/AS, where the message carries Immediately following the message in the redirection process, the IMS UE sends an HTTP request message to the L-IdP/AS, where the request message carries an authentication request AuthnRequest, which is a fixed format and a naming manner defined by the original authentication framework Liberty Alliance;
  • L-IdP/AS decrypts the shared key after receiving the request message And the UE-Auth; and the L-IdP/AS authenticates the IMS UE according to the AuthnRequest. If the authentication succeeds, the L-IdP/AS will notify the IMS UE that the SP of the identity association can be formed, and the IMS UE accepts The identity association with the SP is completed. At this time, a security association is established between the IMS UE and the service authentication provider L-IdP/AS. Thereafter, the IMS UE can perform SSO authentication with the corresponding SP.
  • Step 106 The IMS UE interacts with the SP to complete SSO authentication.
  • step 104 is a schematic flowchart of the method for implementing step 104 in the present invention, that is, after receiving the challenge response message, the IMS UE adopts an SSO-based authentication method based on the SSO-ASP to perform its own authentication, as shown in FIG. 2 .
  • the method includes the following steps:
  • Step 201 The IMS UE sends an authentication request message to the IdP, and the IdP authenticates the L_IdP/AS.
  • the IMS UE finds the corresponding IdP according to the address information of the IdP obtained from the L-IDP/AS, and sends an authentication request message to the IdP, where the identity identification information of the identity information U_credential and the L_IdP/AS is carried;
  • the IdP obtains the identity information of the L_IdP/AS from the authentication request message, and authenticates the L_IdP/AS according to the identity identification information, and generates the authentication result L_IdP/AS_Auth of the L_IdP/AS, and Save the certification result.
  • Step 202 IdP determines whether there is a shared key Ko of the UE and the IdP, if yes, step 203 is performed, if not, step 208 is performed; Specifically, the IdP checks whether there is a shared key Ko between the IMS UE and the IdP corresponding to the U-creedential according to the U-creedential carried in the authentication request message sent by the IMS UE. If yes, go to step 202. If not, Go to step 208.
  • Step 203 The IdP obtains a SIP Digest authentication vector (SD-AV) and user configuration information from the HSS, and generates a random number nonce, and saves the hash function value H(A1) in the nonce and SD-AV; specifically, the IdP direction
  • the HSS sends an authentication request, and according to the U-creedential sent by the IMS UE, the IdP searches for and downloads the SIP Digest authentication vector (SD-AV) and user configuration information corresponding to the U-creedential in the HSS; wherein, the SD-AV includes U- credential, realm, quality assurance (qop), authentication algorithm (algorithm), and H(A1); where H(A1) is a hash function consisting of U-creedential, realm, and password (assword) If there are multiple HSSs in the scenario, the IdP can obtain the corresponding HSS by storing the address of the HSS storing the user information by querying the SLF;
  • SD-AV S
  • the IdP generates a random number nonce and stores the H(A1) in the SD-AV obtained from the HSS according to the U-creedential and the nonce.
  • Step 204 The IdP sends a 401 unauthenticated challenge message to the IMS UE, where the 401 unauthenticated challenge message carries U-creedential, realm, qop, algorithm, and nonce.
  • Step 205 The IMS UE generates a random number cnonce and H(A1), generates a shared key Ko of the IMS UE and the IdP by using cnonce and H(A1), and calculates a response;
  • the IMS UE after receiving the 401 unauthenticated challenge message, the IMS UE generates a random number cnonce and H(A1), and generates a shared key Ko of the IMS UE and the IdP by using cnonce and H(A1), and the IMS UE uses a one-way hash function.
  • the IMS UE can use cnonce for network authentication and avoid plain text attack ("chosen plaintext"); Nonce-count is a counter. Each time the same nonce is used to calculate the response value, nonce-count ⁇ ) finds the port 1, and uses the nonce-count to participate in the calculation of the response value. The possibility of attack.
  • Step 206 The IMS UE sends a response message of the 401 unauthenticated challenge message to the IdP, where the response message carries a cnonce, a nonce, a response, a realm, a U-creedential, a qop, an algorithm, a Digest-url, and a nonce-count;
  • the -url is an address identifier, and the IMS UE determines, according to the address identifier, an IdP that needs to send a response message.
  • Step 207 The IdP checks the nonce in the response message. If the check is correct, the IdP calculates the Xresponse, and uses the Xresponse to authenticate the IMS UE. If the authentication passes, the IdP calculates the rspauth, and uses H(A1) and the CNnce to generate the shared secret. Key Ko;
  • the IdP After receiving the response message of the 401 unauthenticated challenge message, the IdP checks the nonce in the response message by using the previously stored nonce. If the two nones are the same, the check is correct, and the IdP uses the parameters in the response message, cnonce, nonce. -count, qo, etc., and the previously stored nonce and H(A1) calculate the expected value Xresponse, ⁇ The calculated Xresponse is compared with the 4th-response response. If the comparison result of the two is the same, the IMS UE is authenticated.
  • Step 208 IdP generates E K by using the shared key Ko. (noncel, OP/AS- Auth), using the shared key of L-IdP/AS and IdP to generate Eko ⁇ UE_Auth);
  • the IdP saves the related information of the IMS UE authentication result UE-Auth, IdP generates a random number noncel, uses the shared key KQ and the noncel generated key to utilize the shared key Ko to the noncel and the previously saved L_IdP/AS— Auth information is encrypted to generate E K0 (nonce 1 , ⁇ /AS Auth); EKoJ ⁇ UE Auth is generated by shared key encryption of L-IdP/AS and IdP and UE Auth
  • Step 209 The IdP redirects the IMS UE to the L_IdP/AS; the redirect message carries the EK . (nonce 1 , OP/AS — Auth) and ⁇ , ⁇ — Auth) and rapauth.
  • Step 210 the IMS UE according to E K . (noncel, OP/AS- Auth) determines the legality of the L-IdP/AS. If it is legal, the IMS UE calculates the rspauth, and authenticates the network according to the rspauth and the received rapauth. When the authentication succeeds, the key I is generated.
  • the IMS UE decrypts the received E K . (noncel, OP/AS- Auth), obtain the authentication result of nonce 1 and L-IdP/AS L-IdP/AS- Auth, judge the legality of L-IdP/AS according to L-IdP/AS_Auth, if illegal
  • the IMS UE stops accessing the AS; if it is legal, the IMS UE calculates the rspauth value in the same manner as in step 206, and compares the rspauth value with the rspauth value received from the IdP. If the two are the same, the authentication network succeeds, and vice versa. After the network authentication succeeds, the IMS UE will generate a key K l according to the method in step 208.
  • FIG. 3 is a schematic flowchart of Embodiment 1 of the method for implementing step 106 in the present invention.
  • L-IdP/AS returns the scenario where the authentication response of the IMS UE does not include Artifact, as shown in Figure 3, the method includes:
  • Step 301 The L-IDP/AS returns an HTTP authentication success response message to the IMS UE.
  • the authentication response message AuthnResponse in the HTTP authentication success response message carries the corresponding Assertion, and the Assertion includes the digital signature of the L-IdP/AS.
  • AuthnResponse is a fixed format and naming method defined by the original authentication architecture Liberty Alliance.
  • Step 302 The IMS UE re-initiates an HTTP application request message to the SP.
  • the AuthnResponse in the HTTP application request message is the AuthnResponse returned in the previous step, where the corresponding Assertion is carried, and the Assertion includes the digital signature of the L-IdP/AS.
  • Step 303 The SP processes the Assertion correspondingly, that is, the SP identifies the data signature of the Assertion, determines the correctness and the owner of the Assertion, and the SP generates the security association process between the IMS UE and the L-IdP/AS according to step 105.
  • L-IdP/AS identifies the alliance information and performs SSO authentication on the IMS UE.
  • Step 304 The SP returns a successful HTTP response message to the IMS UE.
  • Step 106 of the present invention is a schematic flowchart of Embodiment 2 of the method for implementing Step 106 of the present invention, where the method includes:
  • Step 401 L-IdP/AS generates corresponding diagnostic files Artifact and Assertion, and saves the correspondence between the two, and the L-IdP/AS returns an HTTP authentication success response message to the IMS UE, where the generated Artifact is carried.
  • Step 402 The IMS UE re-initiates an HTTP application request message to the SP.
  • the AuthnResponse in the HTTP application request message is the AuthnResponse returned in the previous step, where the corresponding Artifact is carried, and the Artifact includes the Assertion link.
  • Step 403 The SP sends an HTTP request message encapsulated by the SOAP protocol to the L-IdP/AS; the HTTP request message carries the corresponding Artifact.
  • Step 404 The L-IdP/AS finds the corresponding Assertion according to the Artifact, and returns an HTTP response message encapsulated by the SOAP protocol to the SP, where the corresponding Assertion is carried, which includes the digital signature of the IdP.
  • Step 405 The SP processes the Assertion accordingly, and performs SSO authentication on the IMS UE according to the identity information of the L-IDd/AS that is generated during the establishment of the security association between the IMS UE and the L-IdP/AS.
  • Step 406 The SP returns a successful HTTP response message to the IMS UE.
  • FIG. 5 is a schematic structural diagram of a combined authentication system for implementing IMS single sign-on according to the present invention. As shown in FIG. 5, the system includes: SP 51, IMS UE 52, L_IdP/AS 53; wherein
  • SP 51 configured to send a response message to the IMS UE 52, where the identity identification request is carried Address information of the information AuthnRequest and L_IdP/AS;
  • the IMS UE 52 is configured to send an HTTP service request message to the L-IdP/AS 53 according to the address information of the L-IdP/AS 53, and the HTTP service request message carries the AuthnRequest;
  • L-IdP/AS 53 configured to send a challenge response message to the IMS UE 52;
  • the IMS UE 52 is also used for authentication by using an authentication method based on the SSO architecture in SSO-ASP;
  • the L-IdP/AS 53 is also used for identity authentication of the IMS UE 52 after the IMS UE 52 is successfully authenticated. If the authentication is successful, a security association is established between the L-IdP/AS 53 and the IMS UE 52.
  • the IMS UE 52 is further configured to interact with the SP 51 to complete SSO authentication.
  • the IMS UE 52 sends an HTTP service request message to the L-IdP/AS 53.
  • the AuthnRequest is carried in the HTTP service request message:
  • the IMS UE sends an HTTP service request message to the L-IdP/AS, and the HTTP service request message carries the message.
  • the AuthnRequest obtained by the SP and the identifier indicating that it supports the SSO-APS authentication mechanism.
  • the L-IdP/AS 53 sends a response message to the IMS UE 52.
  • the L-IdP/AS finds the address information of the corresponding IdP, and sends the weight to the IMS UE.
  • the redirected HTTP ⁇ war response message carries the indication information that requires the IMS UE to carry the identity information to the corresponding IdP for authentication, and also carries the address information of the IdP, the identity information of the L-IdP/AS, and Indicates the identity that requires the IMS UE to perform the SSO APS authentication mechanism.
  • the IMS UE 52 performs the authentication according to the SSO-based authentication method in the SSO-ASP as follows:
  • the IMS UE sends an authentication request message to the IdP, and the IdP authenticates the L-IDP/AS; if the IdP determines that the UE and the IdP exist
  • the shared key Ko using the shared key ⁇ to generate E K0 (nonce 1 , ⁇ / AS Auth), using the pre-generated shared key of L-IdP/AS and IdP
  • the IdP redirects the IMS UE to the L-IdP/AS; the redirect message carries E K0 (nonce 1 , OP/AS - Auth) and UE According to E K.
  • the IMS UE determines the legality of the L-IdP/AS. If it is legal, the IMS UE calculates the rspauth and authenticates the network according to the rspauth and the received rapauth. When the authentication succeeds, the key I is generated.
  • the method further includes: IdP obtains a SIP Digest authentication vector (SD-AV) from the HSS, and generates a random number nonce, and saves the hash function value H (A1) in the nonce and SD-AV.
  • SD-AV SIP Digest authentication vector
  • IdP sends a 401 unauthenticated challenge message to the IMS UE, the IMS UE generates a random number cnonce and H(A1), generates a shared key Ko of the IMS UE and the IdP by using cnonce and H(A1), and calculates a response;
  • the IdP sends a response message of the 401 unauthenticated challenge message, and the IdP checks the nonce in the response message. If the check is correct, the IdP calculates the Xresponse, and uses the Xresponse to authenticate the IMS UE. If the authentication passes, the IdP calculates the rspauth and uses the H. (A1) and cnonce generate a shared key Ko.
  • the L-IdP/AS 53 authenticates the IMS UE 52. If the authentication succeeds, the security association between the L-IdP/AS 53 and the IMS UE 52 is: IdP IMS During the process of redirecting the UE to the L-IdP/AS, the sent message is redirected to the L-IdP/AS, which carries Immediately following the message in the redirection process, the IMS UE sends an HTTP request message to the L_IdP/AS; L_IdP/AS decrypts the shared key after receiving the request message At the same time, the L_IdP/AS authenticates the IMS UE according to the AuthnRequest.
  • the L-IdP/AS will notify the IMS UE that the SP of the identity association can be formed, and the IMS UE accepts and completes the identity with the SP.
  • a security association is established between the IMS UE and the L-IdP/AS.
  • the IMS UE 52 interacts with the SP 51 to complete the SSO authentication as follows: L-IdP/AS returns an HTTP authentication success response message to the IMS UE, and the HTTP authentication success response message carries Assertion; the IMS UE re-initiates HTTP to the SP Applying the request message, the HTTP application request message carries the Assertion; the SP processes the Assertion and according to the IMS UE and the L-IdP/AS The identity association information of the L-IDP/AS generated in the process of establishing the security association is established, the SSO authentication is completed for the IMS UE, and a successful HTTP response message is returned to the IMS UE.
  • the IMS UE 52 interacts with the SP 51 to complete the SSO authentication as: L—IdP/AS generates a corresponding Artifact and Assertion, and saves the correspondence between the two, and the L—IdP/AS returns to the IMS UE.
  • the HTTP authentication success response message carries the Artifact in the HTTP authentication success response message; the IMS UE re-initiates an HTTP application request message to the SP, and the HTTP application request message carries the Artifact; the SP sends an HTTP request message to the L-IdP/AS.
  • the HTTP request message carries the Artifact; L-IdP/AS finds the corresponding Assertion according to Artifact, and returns an HTTP response message to the SP, and the HTTP response message carries the Assertion; the SP processes the Assertion according to the IMS UE and the L-IdP/AS
  • the identity association information of the L-IDP/AS generated during the establishment of the security association process is completed, the SSO authentication is completed for the IMS UE, and a successful HTTP response message is returned to the IMS UE.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开一种IMS单点登录的组合鉴权方法，包括：SP向IMS UE发送响应消息，其中携带身份标识鉴权请求信息AuthnRequest和L_IdP/AS的地址信息；IMS UE根据所述L_IdP/AS的地址信息，向L_dP/AS发送HTTP服务请求消息，其中携带所述AuthnRequest；L_IdP/AS向IMS UE发送挑战响应消息，IMS UE采用基于SSO_ASP中的SSO架构的认证方法进行自身的认证；IMS UE认证成功后，L_IdP/AS对IMS UE进行身份标识鉴权，如果鉴权成功，L_IdP/AS和IMS UE之间建立安全联盟；本发明还提供一种IMS单点登录的组合鉴权***。根据本发明的技术方案，能够实现SSO_APS中，SSO架构和自由联盟架构的融合互通。

Description

一种 IMS单点登录的组合鉴权方法及*** 技术领域
本发明涉及网络通信安全技术， 尤其涉及一种 IMS单点登录的组合鉴 权方法及***。 背景技术
在 3GPP组织中，有研究项目为：在非通用集成电路卡（UICC, Universal Integrated Circuit Card)环境下的统一 IP多媒体子***（ IMS , IP Multimedia Subsystem ) UE利用 SIP摘要 ( SIP Digest, Session Initiation Protocol Digest ) 认证机制实现其访问应用服务器（ AS, Application Server )的单点登录（ SSO, Single Sign On )功能， 其中的一个在 SSO— APS中的 SSO架构可以实现该 功能，架构通常由统一 IMS用户（如 IMS UE或 IP多媒体业务子***用户）、 用户归属网络服务器（ HSS, Home Subscriber Server )、 AS和身份鉴权认证 提供者实体（IdP ); 其中， IMS UE与 IdP通过 SSOb接口连接， IMS UE 与 AS通过 SSOa接口连接， IdP与 HSS通过 SSOh接口连接； IdP用于与 IMS UE利用 SIP Digest认证机制进行交互验证身份， 并认证 AS, 同时生 成 IdP与 IMS UE的共享密钥 K。； HSS中存储用于描述用户信息的签约文 件， 同时 HSS还兼有产生鉴权信息的功能； AS为 IMS UE提供网络服务业 务。
在该 SSO— APS中的 SSO架构的实现方案中， 针对运营商未部署通用 引导体系（ GBA, Generic Bootstrapping Architecture ), 同时 IMS UE不具有 UICC的场景下，利用 SIP Digest认证机制对 IMS UE进行认证，实现该 IMS UE对 AS的 SSO功能。 现有技术中， 上述的具体过程如下： IMS UE向 AS ( RP )发送服务请求； AS重定向该服务请求到一个统一的认证中心 IdP , 该重定向信息流中包含 IMS UE和 AS的私有身份标识符； IdP依据接收到 的 AS的私有身份标识符对该 AS进行认证， 并保存认证结果， 同时判断是 否存在对应 IMS UE的密钥 Ko, 如果存在该密钥， 则该 IMS UE已认证过， 不需要再次利用 SIP Digest认证机制进行认证，跳过该认证， 直接执行后续 步驟； IdP从 HSS取得 SIP Digest认证向量以及基于 IMPI的用户终端信息； IdP产生一个随机数 nonce, 并储存该 nonce和从 HSS下载的 H(A1); IdP 使用 SIP Digest认证机制向 IMS UE发送一个 401认证挑战消息； IMS UE 产生一个随机数 cnonce并生成 H(A1), 进而产生密钥 KQ, 利用参数计算响 应值 response; IMS UE对 401认证挑战消息向 IdP发送一个响应消息， 在 IdP中完成对 IMS UE的认证， 并产生共享密钥 Ko; IdP再次产生一个随机 数 noncel , 利用 noncel和 Ko产生密钥 , IdP利用密钥 Ko加密密钥 和 AS的认证结果，利用 AS和 IdP的共享密钥加密 和对 IMS UE的认证 结果； IdP将加密后的 和对 IMS UE的认证结果重定向到 AS; IMS UE 解密获得 AS的认证结果， 并产生共享密钥 Kl Q 信息被重定向到 AS; AS 解密信息，获得 IMS UE的认证结果和密钥 此时 IMS UE和 AS之间拥 有共享密钥 Kl 从而 IMS UE与 AS之间后续的通信可以安全的进行。
另外， 自由联盟工程（ LAP, Liberty Alliance Project )组织也定义了一 些架构和规范，用于实现对 Web业务的访问，其架构主要包括三个子架构： 身份标识联盟架构（ID-FF, Identity Federation Framework ), 身份标识 Web 业务架构 （ID-WSF, Identity Web Service Framework ), 身份标识业务接口 规范（ ID-SIS, Identity Services Interface Specification )； 其中 ID-FF主要包 含身份标识联盟 ( Identity Federation )功能和 SSO功能， ID-FF架构主要包 含三个实体： IMS UE、 身份鉴权提供商 IdP、 业务提供商 SP。 身份标识联 盟功能是指 IMS UE在 IdP和 SP上都有自身的身份标识， 即用户标识， 这 些身份标识可以结成一个联盟。 SSO 功能是指在上述身份标识联盟功能的 基础上， 只要 IMS UE在 IdP上通过了鉴权， 就等于同时在所有结成联盟的 SP上也同时通过了鉴权。
对于 IMS UE,有两种鉴权方式： 一种是 IMS UE在 IdP上鉴权通过后， IdP会将 IMS UE的鉴权申明 Assertion直接返回给 IMS UE, IMS UE再将 该鉴权申明 Assertion发给 SP, SP通过分析 Assertion来对 IMS UE进行鉴 权。 另一种是 IMS UE在 IdP上鉴权通过后， IdP会将该 IMS UE的鉴权申 明链接 Artiface返回给 IMS UE; IMS UE再将该鉴权申明链接 Artifact发给 SP , SP将该 Artifact通过简单对象访问协议 ( SOAP , Simple Object Access Protocol )发给 IdP, IdP根据该 Artifact查询相应的 Assertion,并返回给 SP; 最后 SP通过分析 Assertion来对 IMS UE进行鉴权。
一方面， SSO— APS架构中 IMS UE和 SSO服务器交互进行认证获得共 享密钥 Ko, 可以为后续访问 RP应用提供安全会话密钥， 可以方便的完成 单点认证过程， 增强了认证的安全性和消息传递的安全性， 但增加了 IMS UE操做的复杂性和不方便性。 另一方面， 身份标识联盟架构中通过身份标 识联盟功能在各个 SP与 IdP之间建立身份标识安全联盟， 并组成一个安全 信任圈， 只要在 IdP上通过了鉴权， 就等于在 IdP所属的安全信任圈内的所 有 SP上也通过了鉴权。
因此， 如果这两种架构之间能够实现互通， 既不会降低原有的安全性， 还可以增加 IMS UE操作的简便性， 并扩展 IMS UE的应用场景， 以便用已 有的多种多样的 WEB业务。
目前 3GPP规范 33.980中定义了 GBA架构和身份标识联盟架构实现互 通的典型场景， 即 IdP和 NAF为一个实体。 其特点是原 GBA架构的 Ub接 口和 Zn接口功能基本不变，身份标识联盟架构的 IdP和 IMS UE需增加 GBA 功能； 相关的 SP和 IdP/NAF通过身份标识联盟功能组成一个安全信任圈； IMS UE访问每个 SP时， 首先在 IdP/NAF上通过鉴权认证后， 就等于在所 有相关的其他 SP上也通过了鉴权认证。
对于在非 ULCC环境下的统一 IMS UE, 其不能使用 GBA架构进行鉴 权认证， 针对该类 IMS UE, 在 SSO— APS中设计了利用 SIP Digest认证机 制实现 SSO功能的架构，现在需要解决该 SSO架构和自由联盟架构的融合 互通，使得该类 IMS UE能够支持自由联盟架构，进而获得多种多样的 WEB 业务。 发明内容
有鉴于此， 本发明的主要目的在于提供一种 IMS单点登录的组合鉴权 方法及***， 能够实现 SSO— APS 中， SSO架构和自由联盟架构的融合互 通。
为达到上述目的， 本发明的技术方案是这样实现的：
本发明提供一种 IMS单点登录的组合鉴权方法， 包括：
SP向 IMS UE发送响应消息， 所述响应消息中携带身份标识鉴权请求 信息 AuthnRequest和 L— IdP/AS的地址信息；
IMS UE根据所述 L— IdP/AS的地址信息，向 L— IdP/AS发送 HTTP服务 请求消息， 所述 HTTP服务请求消息中携带所述 AuthnRequest;
L— IdP/AS向 IMS UE发送挑战响应消息， IMS UE采用基于 SSO— ASP 中的 SSO架构的认证方法进行自身的认证；
IMS UE认证成功后， L— IdP/AS对 IMS UE进行身份标识鉴权，如果鉴 权成功， L— IdP/AS和 IMS UE之间建立安全联盟。
上述方法中，该方法还包括： IMS UE与 SP进行交互， 完成 SSO鉴权。 上述方法中， 所述 HTTP服务请求消息中携带所述 AuthnRequest为： 所述 HTTP服务请求消息中携带从 SP获取的 AuthnRequest和表示 IMS UE 支持 SSO— APS认证机制的标识。
上述方法中， 所述 L— IdP/AS向 IMS UE发送挑战响应消息为： 收到 IMS UE发送的 HTTP服务请求消息后 , L— IdP/AS找到对应的 IdP 的地址信息， 并向 IMS UE发送重定向 HTTP挑战响应消息， 所述重定向 HTTP挑战响应消息携带要求 IMS UE携带身份标识信息到相应的 IdP上进 行认证的指示信息， 还携带 IdP的地址信息、 L— IdP/AS的身份标识信息以 及表示需要 IMS UE执行 SSO— APS认证机制的标识。
上述方法中，所述 IMS UE采用基于 SSO— ASP中的 SSO架构的认证方 法进行自身的认证为：
IMS UE向 IdP发送认证请求消息， IdP对 L— IdP/AS进行认证； 如果 IdP判断出存在 UE与 IdP的共享密钥 K。， 则利用共享密钥 Κο生 成 EK。(noncel,OP/AS— Auth), 利用预先生成的 L— IdP/AS和 IdP的共享密钥 生成
Figure imgf000007_0001
IdP 将 IMS UE 重定向到 L— IdP/AS ; 其中的重定向消息中携带 EK0(noncel,OP/AS— Auth)和
Figure imgf000007_0002
rapauth;
IMS UE根据 EK。(noncel, OP/AS— Auth)判断 L— IdP/AS的合法性， 如果 合法 , IMS UE计算 rspauth, 并根据 rspauth和收到的 rapauth对网络进行认 证， 认证成功时， 生成密钥 Kl Q
上述方法中， 如果 IdP判断出不存在 UE与 IdP的共享密钥 Ko, 所述 利用共享密钥 Κο生成 EK。(nonce 1 ,OP/AS— Auth)之前， 该方法还包括：
IdP从 HSS获取 SIP Digest认证向量（ SD-AV ) , 并生成随机数 nonce, 保存该 nonce和 SD-AV中的哈希函数值 H(A1);
IdP向 IMS UE发送 401未认证挑战消息 , IMS UE生成随机数 cnonce 和 H(A1), 利用 cnonce和 H(A1)生成 IMS UE和 IdP的共享密钥 K。， 并计 算 response;
IMS UE向 IdP发送 401未认证挑战消息的响应消息， IdP对响应消息 中的 nonce进行检验，如果校验正确， IdP计算 Xresponse,并利用 Xresponse 对 IMS UE进行认证，如果认证通过，IdP计算 rspauth,并利用 H(A1)和 cnonce 生成共享密钥 Ko。
上述方法中， 所述 IMS UE认证成功后， L— IdP/AS对 IMS UE进行身 份标识鉴权， 如果鉴权成功， L— IdP/AS和 IMS UE之间建立安全联盟为： IdP将 IMS UE重定向到 L— IdP/AS的过程中， 发送的消息被重定向到
L— IdP/AS,该消息中携带
Figure imgf000008_0001
紧随重定向过程中的消息， IMS UE向 L— IdP/AS发送 HTTP请求消息；
L— IdP/AS收到请求消息后， 利用共享密钥解密
Figure imgf000008_0002
同 时 L— IdP/AS根据所述 AuthnRequest对 IMS UE进行身份标识鉴权，如果鉴 权成功， L— IdP/AS将通知 IMS UE可以结成身份标识联盟的 SP, IMS UE 接受并完成与 SP的身份标识联盟， IMS UE和 L— IdP/AS之间建立安全联 盟。
上述方法中， 所述 IMS UE与 SP进行交互， 完成 SSO鉴权为：
L— IdP/AS向 IMS UE返回 HTTP鉴权成功响应消息 , 所述 HTTP鉴权 成功响应消息中携带 Assertion;
IMS UE重新向 SP发起 HTTP应用请求消息， 所述 HTTP应用请求消 息中携带 Assertion;
SP对 Assertion进行处理， 并根据 IMS UE和 L— IdP/AS之间建立安全 联盟过程中产生的 L— IdP/AS的身份标识联盟信息，对 IMS UE完成 SSO鉴 权， 并向 IMS UE返回成功的 HTTP响应消息。
上述方法中， 所述 IMS UE与 SP进行交互， 完成 SSO鉴权为：
L— IdP/AS生成对应的 Artifact和 Assertion, 并保存两者之间的对应关 系 , 向 IMS UE返回 HTTP鉴权成功响应消息 ,所述 HTTP鉴权成功响应消 息中携带所述 Artifact;
IMS UE重新向 SP发起 HTTP应用请求消息， 所述 HTTP应用请求消 息中携带 Artifact; SP向 L— IdP/AS发送 HTTP请求消息 , 所述 HTTP请求 消息中携带 Artifact;
L— IdP/AS根据 Artifact找到对应的 Assertion, 并向 SP返回 HTTP响应 消息， 所述 HTTP响应消息中携带 Assertion; SP对 Assertion进行处理， 根 据 IMS UE和 L— IdP/AS之间建立安全联盟过程中产生的 L— IdP/AS的身份 标识联盟信息，对 IMS UE完成 SSO鉴权， 并向 IMS UE返回成功的 HTTP 响应消息。
本发明还提供一种 IMS单点登录的组合鉴权***， 包括： SP、 IMS UE、 L— IdP/AS; 其中，
SP, 用于向 IMS UE发送响应消息， 所述响应消息中携带身份标识鉴 权请求信息 AuthnRequest和 L— IdP/AS的地址信息；
IMS UE,用于根据所述 L— IdP/AS的地址信息，向 L— IdP/AS发送 HTTP 服务请求消息， 所述 HTTP服务请求消息中携带所述 AuthnRequest;
L— IdP/AS , 用于向 IMS UE发送挑战响应消息；
IMS UE, 还用于采用基于 SSO— ASP中的 SSO架构的认证方法进行自 身的认证；
L— IdP/AS,还用于 IMS UE认证成功后，对 IMS UE进行身份标识鉴权， 如果鉴权成功， L— IdP/AS和 IMS UE之间建立安全联盟。
上述***中， 所述 IMS UE还用于， 与所述 SP进行交互， 完成 SSO鉴 权。
本发明提供的 IMS单点登录的组合鉴权方法及***， SP向 IMS UE发 送响应消息，其中携带身份标识鉴权请求信息 AuthnRequest和 L— IdP/AS 的地址信息； IMS UE根据所述 L— IdP/AS的地址信息， 向 L— IdP/AS发 送 HTTP服务请求消息， 其中携带所述 AuthnRequest; L— IdP/AS向 IMS UE发送挑战响应消息， IMS UE采用基于 SSO— ASP中的 SSO架构的认 证方法进行自身的认证； IMS UE认证成功后， L— IdP/AS对 IMS UE进 行身份标识鉴权， 如果鉴权成功， L— IdP/AS和 IMS UE之间建立安全联 盟， 能够实现 SSO— APS中， SSO架构和自由联盟架构的融合互通以满足 非 UICC场景中统一 IMS UE利用该组合鉴权方法和***实现对应用服务器 的 SSO功能。 附图说明
图 1是本发明实现 IMS单点登录的组合鉴权方法的流程示意图； 图 2是本发明实现步驟 104的方法的流程示意图；
图 3是本发明实现步驟 106的方法的实施例一的流程示意图； 图 4是本发明实现步驟 106的方法的实施例二的流程示意图； 图 5是本发明实现 IMS单点登录的组合鉴权***的结构示意图。 具体实施方式
本发明的基本思想是： SP向 IMS UE发送响应消息， 其中携带身份 标识鉴权请求信息 AuthnRequest和 L— IdP/AS的地址信息； IMS UE根据 所述 L— IdP/AS的地址信息， 向 L— IdP/AS发送 HTTP服务请求消息， 其 中携带所述 AuthnRequest; L— IdP/AS向 IMS UE发送挑战响应消息， IMS UE采用基于 SSO— ASP中的 SSO架构的认证方法进行自身的认证； IMS UE认证成功后， L— IdP/AS对 IMS UE进行身份标识鉴权， 如果鉴权成 功， L— IdP/AS和 IMS UE之间建立安全联盟。
下面通过附图及具体实施例对本发明再做进一步的详细说明。
本发明提供一种 IMS单点登录的组合鉴权方法，图 1是本发明实现 IMS 单点登录的组合鉴权方法的流程示意图， 如图 1 所示， 该方法包括以下步 驟：
步驟 101 , SP向 IMS UE发送响应消息， 其中携带身份标识鉴权请求 信息 AuthnRequest和 L— IdP/AS的地址信息；
具体的， IP多媒体业务子***用户 （IMS UE ) 向 SP发送应用请求消 息； SP收到应用请求消息后， 获取 L— IdP/AS的地址； SP发送响应消息给 IMS UE,要求 IMS UE在相应的 L— IdP/AS上进行认证， 所述响应消息中携 带身份标识鉴权请求信息 AuthnRequest和 L— IdP/AS的地址信息。
步驟 102, 收到响应消息后，根据响应消息中的 L— IdP/AS的地址信息， IMS UE 向 L— IdP/AS 发送 HTTP 服务请求消息， 其中携带获取的 AuthnRequest;
具体的， 收到 SP发送的响应消息后， 根据响应消息中的 L— IdP/AS的 地址信息， IMS UE向该 L— IdP/AS发送 HTTP服务请求消息， HTTP服务 请求消息中携带从 SP获取的 AuthnRequest,还携带表示自身支持 SSO— APS 认证机制的标识。
步驟 103 , L— IdP/AS向 IMS UE发送挑战响应消息；
具体的， 收到 IMS UE发送的 HTTP服务请求消息后， L— IdP/AS发现 IMS UE支持 SSO— APS认证机制，并找到对应的 IdP的地址信息； L— IdP/AS 与 IdP利用现有机制如 Diffie-Hellman密钥交换机制或预配置密钥等方式在 两者之间生成共享密钥 Κ^, 然后 L— IdP/AS 向 IMS UE发送一个重定向 HTTP挑战响应消息 ,该重定向 HTTP挑战响应消息携带要求 IMS UE携带 身份标识信息到相应的 IdP上进行认证的指示信息，同时还携带 IdP的地址 信息、 L— IdP/AS的身份标识信息以及一个表示需要 IMS UE执行 SSO— APS 认证机制的标识。
步驟 104, IMS UE收到挑战响应消息后，采用基于 SSO— ASP中的 SSO 架构的认证方法进行自身的认证。
步驟 105, IMS UE认证成功后， L— IdP/AS对 IMS UE进行身份标识鉴 权， 如果鉴权成功， L IdP/AS和 IMS UE之间建立安全联盟； 具体的， IdP将 IMS UE重定向到 L— IdP/AS的过程中， 发送的消息被 重定向到 L— IdP/AS , 该消息中携带有
Figure imgf000012_0001
紧随重定向过程 中的消息， IMS UE向 L— IdP/AS发送 HTTP请求消息， 该请求消息中携带 认证请求 AuthnRequest, 该 AuthnRequest是原有认证架构 Liberty Alliance 定义的固定格式和命名方式；
L— IdP/AS收到请求消息后， 利用共享密钥解密
Figure imgf000012_0002
得 到 和 UE— Auth; 同时 L— IdP/AS根据 AuthnRequest对 IMS UE进行身份 标识鉴权， 如果鉴权成功， L— IdP/AS将通知 IMS UE可以结成身份标识联 盟的 SP, IMS UE接受并完成与 SP的身份标识联盟， 此时在 IMS UE和业 务鉴权提供商 L— IdP/AS之间建立了安全联盟， 此后 IMS UE可以和相应的 SP进行 SSO鉴权。
步驟 106, IMS UE与 SP进行交互， 完成 SSO鉴权。
图 2是本发明实现步驟 104的方法的流程示意图，即 IMS UE收到挑战 响应消息后， 采用基于 SSO— ASP中的 SSO架构的认证方法进行自身的认 证的具体实现方法， 如图 2所示， 该方法包括以下步驟：
步驟 201 , IMS UE向 IdP发送认证请求消息， IdP对 L— IdP/AS进行认 证；
具体的， IMS UE根据从 L— IdP/AS获得的 IdP的地址信息找到对应的 IdP, 向该 IdP发送认证请求消息， 其中携带身份标识信息 U— credential和 L— IdP/AS的身份标识信息；
IdP从认证请求消息中获得 L— IdP/AS的身份标识信息， 并根据该身份 标识信息对 L— IdP/AS进行认证，生成 L— IdP/AS的认证结果 L— IdP/AS— Auth, 并保存该认证结果。
步驟 202 , IdP判断是否存在 UE与 IdP的共享密钥 Ko, 如果存在， 执 行步驟 203 , 如果不存在， 执行步驟 208; 具体的 , IdP根据 IMS UE发送的认证请求消息中携带的 U— credential , 检查是否存在与该 U— credential对应的 IMS UE与 IdP的共享密钥 Ko,如果 存在， 执行步驟 202 , 如果不存在， 执行步驟 208。
步驟 203 , IdP从 HSS获取 SIP Digest认证向量（ SD-AV )和用户配置 信息，并生成随机数 nonce,保存该 nonce和 SD-AV中的哈希函数值 H(A1); 具体的， IdP 向 HSS 发送一个认证请求， 根据 IMS UE 发送的 U— credential, IdP在 HSS中查找并下载与该 U— credential对应的 SIP Digest 认证向量（SD-AV )和用户配置信息； 其中， SD-AV中包括 U— credential, 领域（realm ) 、 质量保证（ qop ) 、 认证算法（algorithm )和 H(A1); 其中， H(A1)是由 U— credential, realm和密码 ( assword )组成的一个哈希函数值； 如果场景中存在多 HSS, IdP可以通过询问 SLF获得对应的储存用户信息 的 HSS的地址， 从而找到该对应的 HSS;
IdP生成一个随机数 nonce ,并把根据 U— credential从 HSS获取的 SD-AV 中的 H(A1)和该 nonce一并存储。
步驟 204, IdP向 IMS UE发送 401未认证挑战消息， 401未认证挑战 消息中携带 U— credential, realm、 qop, algorithm和 nonce。
步驟 205 , IMS UE生成随机数 cnonce和 H(A1), 利用 cnonce和 H(A1) 生成 IMS UE和 IdP的共享密钥 Ko, 并计算 response;
具体的， 收到 401未认证挑战消息后， IMS UE生成随机数 cnonce和 H(A1), 利用 cnonce和 H(A1)生成 IMS UE和 IdP的共享密钥 Ko, IMS UE 利 用 单 向 哈 希 函 数 F 计 算 response 值 ， 即 response=F(H(Al),cnonce,nonce,qop,nonce-count); 这里, IMS UE可以利用 cnonce 进行网络认证和避免纯文本攻击（ "chosen plaintext" ) ; 其中， nonce-count 为计数器, 每使用同一个 nonce 计算一次 response 值, nonce-count ^)寻力口 1 , 利用 nonce-count参与 response值的计算, 能够降 [氐重 放攻击的可能性。
步驟 206 , IMS UE向 IdP发送 401未认证挑战消息的响应消息， 响应 消息中携带 cnonce、 nonce , response, realm, U— credential, qop, algorithm, Digest-url和 nonce-count; 其中， 所述 Digest-url为地址标识， IMS UE根据 该地址标识确定需要发送响应消息的 IdP。
步驟 207, IdP对响应消息中的 nonce进行检验， 如果校验正确， IdP 计算 Xresponse,并利用 Xresponse对 IMS UE进行认证，如果认证通过， IdP 计算 rspauth, 并利用 H(A1)和 cnonce生成共享密钥 Ko;
具体的， 收到 401未认证挑战消息的响应消息后， IdP利用之前存储的 nonce对响应消息中的 nonce进行检验，如果两个 nonce相同，则检验正确， IdP利用响应消息中的参数 cnonce、 nonce-count、 qo 等、 以及之前储存在 本地的 nonce和 H(A1)计算期望值 Xresponse, ^寻计算的 Xresponse与 4史到 的 response进行比较，如果两者的比较结果是相同，则 IMS UE的认证通过； 反之， IMS UE认证失败； IMS UE认证通过后， IdP依据 RFC2617中的方 法利用 cnonce生成 rspauth值 ,即 rspauth= "response-digest" =<">*LHEX<"> , 并利用 Η(Α1)和 cnonce等参数生成共享密钥 KQ。
步驟 208 , IdP利用共享密钥 Ko生成 EK。(noncel,OP/AS— Auth), 利用 L— IdP/AS和 IdP的共享密钥 生成 EKo^ ^UE— Auth);
具体的， IdP保存 IMS UE认证结果的相关信息 UE— Auth , IdP生成一 个随机数 noncel , 利用共享密钥 KQ和 noncel生成密钥 利用共享密钥 Ko对 noncel 和之前保存的 L— IdP/AS— Auth 信息进行加密操作， 生成 EK0(nonce 1 ,ΟΡ/AS Auth)； 利用 L— IdP/AS和 IdP的共享密钥 加密 和 UE Auth, 生成 EKoJ ^UE Auth
步驟 209, IdP将 IMS UE重定向到 L— IdP/AS; 其中的重定向消息中携 带 EK。(nonce 1 ,OP/AS— Auth)和 ΕΚο, ^υΕ— Auth)和 rapauth。 步驟 210, IMS UE根据 EK。(noncel,OP/AS— Auth)判断 L— IdP/AS的合法 性， 如果合法， IMS UE计算 rspauth, 并根据 rspauth和收到的 rapauth对网 络进行认证， 认证成功时， 生成密钥 I ;
具体的， IMS UE解密收到的 EK。(noncel,OP/AS— Auth), 获得 nonce 1 和 L— IdP/AS 的认证结果 L— IdP/AS— Auth , 根据 L— IdP/AS— Auth 判断 L— IdP/AS的合法性， 如果非法， IMS UE停止访问 AS; 如果合法， IMS UE 使用同步驟 206中一样的方法计算 rspauth值，并将该 rspauth值与从 IdP收 到的 rspauth值进行比较， 如果两者相同， 认证网络成功， 反之， 认证网络 失败； 网络认证成功后， IMS UE将按照步驟 208中的方法生成密钥 Kl Q 图 3 是本发明实现步驟 106 的方法的实施例一的流程示意图， 针对
L— IdP/AS返回给 IMS UE的认证响应中不包含 Artifact时的情景， 如图 3 所示， 该方法包括：
步驟 301 , L— IdP/AS向 IMS UE返回 HTTP鉴权成功响应消息 , HTTP 鉴权成功响应消息中认证响应消息 AuthnResponse 中携带对应的断言 Assertion, 该 Assertion包含 L— IdP/AS的数字签名； 这里， AuthnResponse 是原有认证架构 Liberty Alliance定义的固定格式和命名方式。
步驟 302, IMS UE重新向 SP发起 HTTP应用请求消息， HTTP应用请 求消息中 AuthnResponse为在上一步中返回的 AuthnResponse, 其中携带对 应的 Assertion, Assertion中包含 L— IdP/AS的数字签名。
步驟 303 , SP对 Assertion进行相应处理， 即 SP识别 Assertion的数据 签名， 判断该 Assertion的正确性和拥有者， SP根据步驟 105中 IMS UE和 L— IdP/AS之间建立安全联盟过程中产生的 L— IdP/AS的身份标识联盟信息， 对 IMS UE完成 SSO鉴权。
步驟 304 , SP向 IMS UE返回成功的 HTTP响应消息。
此后， IMS UE和 SP之间继续进行通讯， 直到密钥过期或即将过期为 止。
图 4是本发明实现步驟 106 的方法的实施例二的流程示意图， 针对 该方法包括：
步驟 401 , L— IdP/AS生成对应的诊断文件 Artifact和 Assertion, 并保存 两者之间的对应关系， L— IdP/AS向 IMS UE返回 HTTP鉴权成功响应消息， 其中携带生成的 Artifact。
步驟 402 , IMS UE重新向 SP发起 HTTP应用请求消息， HTTP应用请 求消息中 AuthnResponse为上一步中返回的 AuthnResponse, 其中携带对应 的 Artifact, Artifact中包含 Assertion的链接。
步驟 403 , SP向 L— IdP/AS发送通过 SOAP协议封装的 HTTP请求消息； HTTP请求消息中携带对应的 Artifact。
步驟 404, L— IdP/AS根据 Artifact找到对应的 Assertion, 并向 SP返回 通过 SOAP协议封装的 HTTP响应消息， 其中携带对应的 Assertion, 其包 含 IdP的数字签名。
步驟 405 , SP对 Assertion进行相应处理， 根据 IMS UE和 L— IdP/AS 之间建立安全联盟过程中产生的 L— IdP/AS的身份标识联盟信息，对 IMS UE 完成 SSO鉴权。
步驟 406 , SP 向 IMS UE返回成功的 HTTP响应消息。
此后， IMS UE和 SP之间继续进行通讯， 直到密钥过期或者即将过期 为止。
为实现上述方法， 本发明还提供一种 IMS单点登录的组合鉴权***， 图 5是本发明实现 IMS单点登录的组合鉴权***的结构示意图， 如图 5所 示， 该***包括： SP 51、 IMS UE 52、 L_IdP/AS 53; 其中，
SP 51 , 用于向 IMS UE 52发送响应消息， 其中携带身份标识鉴权请求 信息 AuthnRequest和 L— IdP/AS的地址信息；
IMS UE 52, 用于根据所述 L— IdP/AS 53的地址信息， 向 L— IdP/AS 53 发送 HTTP服务请求消息， HTTP服务请求消息中携带所述 AuthnRequest;
L— IdP/AS 53 , 用于向 IMS UE 52发送挑战响应消息；
IMS UE 52,还用于采用基于 SSO— ASP中的 SSO架构的认证方法进行 自身的认证；
L— IdP/AS 53 , 还用于 IMS UE 52认证成功后， 对 IMS UE 52进行身份 标识鉴权， 如果鉴权成功， L— IdP/AS 53和 IMS UE 52之间建立安全联盟。
所述 IMS UE 52还用于， 与所述 SP 51进行交互， 完成 SSO鉴权。 所述 IMS UE 52向 L— IdP/AS 53发送 HTTP服务请求消息， HTTP服务 请求消息中携带所述 AuthnRequest为： IMS UE向 L— IdP/AS发送 HTTP服 务请求消息， HTTP服务请求消息中携带从 SP获取的 AuthnRequest和表示 自身支持 SSO— APS认证机制的标识。
所述 L— IdP/AS 53向 IMS UE 52发送^ 战响应消息为：收到 IMS UE发 送的 HTTP服务请求消息后， L— IdP/AS找到对应的 IdP的地址信息， 并向 IMS UE发送重定向 HTTP ^ 战响应消息 , 重定向 HTTP ^ 战响应消息携带 要求 IMS UE携带身份标识信息到相应的 IdP上进行认证的指示信息，还携 带 IdP的地址信息、 L— IdP/AS的身份标识信息以及表示需要 IMS UE执行 SSO APS认证机制的标识。
所述 IMS UE 52采用基于 SSO— ASP中的 SSO架构的认证方法进行自 身的认证为： IMS UE向 IdP发送认证请求消息， IdP对 L— IdP/AS进行认证； 如果 IdP判断出存在 UE与 IdP的共享密钥 Ko, 则利用共享密钥 Κο生成 EK0(nonce 1 ,ΟΡ/AS Auth) , 利用预先生成的 L— IdP/AS和 IdP的共享密钥 生成
Figure imgf000017_0001
IdP将 IMS UE重定向到 L— IdP/AS; 其中的重定向 消息中携带 EK0(nonce 1 ,OP/AS— Auth)和
Figure imgf000017_0002
UE 根据 EK。(noncel,OP/AS— Auth)判断 L— IdP/AS的合法性， 如果合法， IMS UE 计算 rspauth, 并根据 rspauth和收到的 rapauth对网络进行认证， 认证成功 时， 生成密钥 I ;
如果 IdP判断出不存在 UE与 IdP的共享密钥 Ko, 所述利用共享密钥 Ko生成 EK。(noncel,OP/AS— Auth)之前， 还包括： IdP从 HSS获取 SIP Digest 认证向量（SD-AV ) , 并生成随机数 nonce, 保存该 nonce和 SD-AV中的 哈希函数值 H(A1); IdP向 IMS UE发送 401未认证挑战消息， IMS UE生 成随机数 cnonce和 H(A1), 利用 cnonce和 H(A1)生成 IMS UE和 IdP的共 享密钥 Ko, 并计算 response; IMS UE向 IdP发送 401未认证挑战消息的响 应消息， IdP对响应消息中的 nonce 进行检验, 如果校验正确 , IdP计算 Xresponse, 并利用 Xresponse对 IMS UE进行认证， 如果认证通过， IdP计 算 rspauth, 并利用 H(A1)和 cnonce生成共享密钥 Ko。
所述 IMS UE 52认证成功后， L— IdP/AS 53对 IMS UE 52进行身份标识 鉴权，如果鉴权成功， L— IdP/AS 53和 IMS UE 52之间建立安全联盟为： IdP 将 IMS UE重定向到 L— IdP/AS的过程中，发送的消息被重定向到 L— IdP/AS, 该消息中携带
Figure imgf000018_0001
紧随重定向过程中的消息， IMS UE 向 L— IdP/AS发送 HTTP请求消息； L— IdP/AS收到请求消息后， 利用共享密钥 解密
Figure imgf000018_0002
同时 L_IdP/AS根据所述 AuthnRequest对 IMS UE 进行身份标识鉴权， 如果鉴权成功， L— IdP/AS将通知 IMS UE可以结成身 份标识联盟的 SP, IMS UE接受并完成与 SP的身份标识联盟， IMS UE和 L— IdP/AS之间建立安全联盟。
所述 IMS UE 52与 SP 51进行交互，完成 SSO鉴权为： L— IdP/AS向 IMS UE 返回 HTTP 鉴权成功响应消息， HTTP 鉴权成功响应消息中携带 Assertion; IMS UE重新向 SP发起 HTTP应用请求消息， HTTP应用请求消 息中携带 Assertion; SP对 Assertion进行处理，并根据 IMS UE和 L— IdP/AS 之间建立安全联盟过程中产生的 L— IdP/AS的身份标识联盟信息，对 IMS UE 完成 SSO鉴权， 并向 IMS UE返回成功的 HTTP响应消息。
或， 所述 IMS UE 52与 SP 51进行交互， 完成 SSO鉴权为： L— IdP/AS 生成对应的 Artifact和 Assertion, 并保存两者之间的对应关系， L— IdP/AS 向 IMS UE返回 HTTP鉴权成功响应消息， HTTP鉴权成功响应消息中携带 所述 Artifact; IMS UE重新向 SP发起 HTTP应用请求消息 , HTTP应用请 求消息中携带 Artifact; SP向 L— IdP/AS发送 HTTP请求消息， HTTP请求 消息中携带 Artifact; L— IdP/AS根据 Artifact找到对应的 Assertion, 并向 SP 返回 HTTP响应消息， HTTP响应消息中携带 Assertion; SP对 Assertion进 行处理， 根据 IMS UE 和 L— IdP/AS 之间建立安全联盟过程中产生的 L— IdP/AS的身份标识联盟信息， 对 IMS UE完成 SSO鉴权， 并向 IMS UE 返回成功的 HTTP响应消息。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围， 凡在本发明的精神和原则之内所作的任何修改、 等同替换和改进 等， 均应包含在本发明的保护范围之内。

Claims

权利要求书
1、 一种 IMS单点登录的组合鉴权方法， 包括：
SP向 IMS UE发送响应消息， 所述响应消息中携带身份标识鉴权请求 信息 AuthnRequest和 L— IdP/AS的地址信息；
IMS UE根据所述 L— IdP/AS的地址信息，向 L— IdP/AS发送 HTTP服务 请求消息， 所述 HTTP服务请求消息中携带所述 AuthnRequest;
L— IdP/AS向 IMS UE发送挑战响应消息， IMS UE采用基于 SSO— ASP 中的 SSO架构的认证方法进行自身的认证；
IMS UE认证成功后， L— IdP/AS对 IMS UE进行身份标识鉴权，如果鉴 权成功， L— IdP/AS和 IMS UE之间建立安全联盟。
2、 根据权利要求 1所述的方法， 其中， 该方法还包括： IMS UE与 SP 进行交互， 完成 SSO鉴权。
3、 根据权利要求 1所述的方法， 其中， 所述 HTTP服务请求消息中携 带所述 AuthnRequest为：
所述 HTTP服务请求消息中携带从 SP获取的 AuthnRequest和表示 IMS
UE支持 SSO— APS认证机制的标识。
4、 根据权利要求 1所述的方法， 其中， 所述 L— IdP/AS向 IMS UE发 iiU兆战响应消息为：
收到 IMS UE发送的 HTTP服务请求消息后， L— IdP/AS找到对应的 IdP 的地址信息， 并向 IMS UE发送重定向 HTTP挑战响应消息， 所述重定向 HTTP挑战响应消息携带要求 IMS UE携带身份标识信息到相应的 IdP上进 行认证的指示信息， 还携带 IdP的地址信息、 L— IdP/AS的身份标识信息以 及表示需要 IMS UE执行 SSO— APS认证机制的标识。
5、根据权利要求 1所述的方法，其中，所述 IMS UE采用基于 SSO— ASP 中的 SSO架构的认证方法进行自身的认证为：
IMS UE向 IdP发送认证请求消息， IdP对 L— IdP/AS进行认证； 如果 IdP判断出存在 UE与 IdP的共享密钥 K。， 则利用共享密钥 Κο生 成 EK。(noncel,OP/AS— Auth), 利用预先生成的 L— IdP/AS和 IdP的共享密钥 Ko'i生成 EKo,i(K! ,UE— Auth)；
IdP 将 IMS UE 重定向到 L— IdP/AS ; 其中的重定向消息中携带 EK0(noncel,OP/AS— Auth)和
Figure imgf000021_0001
rapauth;
IMS UE根据 EK。(noncel, OP/AS— Auth)判断 L— IdP/AS的合法性， 如果 合法， IMS UE计算 rspauth, 并根据 rspauth和收到的 rapauth对网络进行认 证， 认证成功时， 生成密钥 I 。
6、 根据权利要求 5所述的方法， 其中， 如果 IdP判断出不存在 UE与 IdP的共享密钥 Ko, 所述利用共享密钥 Κο生成 EK。(noncel,OP/AS— Auth)之 前， 该方法还包括：
IdP从 HSS获取 SIP Digest认证向量（ SD-AV ) , 并生成随机数 nonce, 保存该 nonce和 SD-AV中的哈希函数值 H(A1);
IdP向 IMS UE发送 401未认证挑战消息 , IMS UE生成随机数 cnonce 和 H(A1), 利用 cnonce和 H(A1)生成 IMS UE和 IdP的共享密钥 K。， 并计 算 response;
IMS UE向 IdP发送 401未认证挑战消息的响应消息， IdP对响应消息 中的 nonce进行检验，如果校验正确， IdP计算 Xresponse,并利用 Xresponse 对 IMS UE进行认证，如果认证通过， IdP计算 rspauth,并利用 H(A1)和 cnonce 生成共享密钥 Ko。
7、 根据权利要求 1 所述的方法， 其中， 所述 IMS UE认证成功后， L— IdP/AS对 IMS UE进行身份标识鉴权， 如果鉴权成功， L— IdP/AS和 IMS UE之间建立安全联盟为： IdP将 IMS UE重定向到 L— IdP/AS的过程中， 发送的消息被重定向到 L— IdP/AS,该消息中携带
Figure imgf000022_0001
紧随重定向过程中的消息， IMS UE向 L— IdP/AS发送 HTTP请求消息；
L— IdP/AS收到请求消息后， 利用共享密钥解密
Figure imgf000022_0002
同 时 L— IdP/AS根据所述 AuthnRequest对 IMS UE进行身份标识鉴权，如果鉴 权成功， L— IdP/AS将通知 IMS UE可以结成身份标识联盟的 SP, IMS UE 接受并完成与 SP的身份标识联盟， IMS UE和 L— IdP/AS之间建立安全联盟。
8、 根据权利要求 2所述的方法， 其中， 所述 IMS UE与 SP进行交互， 完成 SSO鉴权为：
L— IdP/AS向 IMS UE返回 HTTP鉴权成功响应消息 , 所述 HTTP鉴权 成功响应消息中携带 Assertion;
IMS UE重新向 SP发起 HTTP应用请求消息， 所述 HTTP应用请求消 息中携带 Assertion;
SP对 Assertion进行处理， 并根据 IMS UE和 L— IdP/AS之间建立安全 联盟过程中产生的 L— IdP/AS的身份标识联盟信息，对 IMS UE完成 SSO鉴 权， 并向 IMS UE返回成功的 HTTP响应消息。
9、 根据权利要求 2所述的方法， 其中， 所述 IMS UE与 SP进行交互， 完成 SSO鉴权为：
L— IdP/AS生成对应的 Artifact和 Assertion, 并保存两者之间的对应关 系 , 向 IMS UE返回 HTTP鉴权成功响应消息 ,所述 HTTP鉴权成功响应消 息中携带所述 Artifact;
IMS UE重新向 SP发起 HTTP应用请求消息， 所述 HTTP应用请求消 息中携带 Artifact; SP向 L— IdP/AS发送 HTTP请求消息， 所述 HTTP请求 消息中携带 Artifact;
L IdP/AS根据 Artifact找到对应的 Assertion, 并向 SP返回 HTTP响应 消息， 所述 HTTP响应消息中携带 Assertion; SP对 Assertion进行处理， 根 据 IMS UE和 L— IdP/AS之间建立安全联盟过程中产生的 L— IdP/AS的身份 标识联盟信息，对 IMS UE完成 SSO鉴权， 并向 IMS UE返回成功的 HTTP 响应消息。
10、一种 IMS单点登录的组合鉴权***，包括： SP、 IMS UE、 L— IdP/AS; 其中，
SP, 用于向 IMS UE发送响应消息， 所述响应消息中携带身份标识鉴 权请求信息 AuthnRequest和 L— IdP/AS的地址信息；
IMS UE,用于根据所述 L— IdP/AS的地址信息，向 L— IdP/AS发送 HTTP 服务请求消息， 所述 HTTP服务请求消息中携带所述 AuthnRequest;
L— IdP/AS , 用于向 IMS UE发送挑战响应消息；
IMS UE, 还用于采用基于 SSO— ASP中的 SSO架构的认证方法进行自 身的认证；
L— IdP/AS,还用于 IMS UE认证成功后，对 IMS UE进行身份标识鉴权， 如果鉴权成功， L— IdP/AS和 IMS UE之间建立安全联盟。
11、 根据权利要求 10所述的***， 其中， 所述 IMS UE还用于， 与所 述 SP进行交互， 完成 SSO鉴权。
PCT/CN2012/083623 2011-10-31 2012-10-26 一种ims单点登录的组合鉴权方法及*** WO2013064040A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2011103382432A CN103095649A (zh) 2011-10-31 2011-10-31 一种ims单点登录的组合鉴权方法及***
CN201110338243.2 2011-10-31

Publications (1)

Publication Number Publication Date
WO2013064040A1 true WO2013064040A1 (zh) 2013-05-10

Family

ID=48191313

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/083623 WO2013064040A1 (zh) 2011-10-31 2012-10-26 一种ims单点登录的组合鉴权方法及***

Country Status (2)

Country Link
CN (1) CN103095649A (zh)
WO (1) WO2013064040A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107103058B (zh) * 2017-04-13 2020-09-15 华南理工大学 基于Artifact的大数据服务组合方法及复合服务组合方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101022651A (zh) * 2006-02-13 2007-08-22 华为技术有限公司 一种组合鉴权架构及其实现方法
US20080301785A1 (en) * 2007-05-31 2008-12-04 At&T Intellectual Property, Inc. Systems, methods and computer program products for providing additional authentication beyond user equipment authentication in an ims network

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100397942C (zh) * 2004-03-26 2008-06-25 华为技术有限公司 通用鉴权框架中一种接入用户归属网络服务器的方法
CN100355314C (zh) * 2004-06-28 2007-12-12 华为技术有限公司 一种应用通用鉴权框架的方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101022651A (zh) * 2006-02-13 2007-08-22 华为技术有限公司 一种组合鉴权架构及其实现方法
US20080301785A1 (en) * 2007-05-31 2008-12-04 At&T Intellectual Property, Inc. Systems, methods and computer program products for providing additional authentication beyond user equipment authentication in an ims network

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"Technical Specification Group Services and System Aspects; Liberty Alliance and 3GPP security interworking; Interworking of Liberty Alliance Identity Federation Framework (ID-FF), Identity Web Services Framework (ID-WSF) and Generic Authentication Architecture (GAA) (Release 10)", 3GPP TR 33.980 V10.0.0 3RD GENERATION PARTNERSHIP PROJECT, March 2011 (2011-03-01) *
"Technical Specification Group Services and System Aspects; Single Sign On Application Security for Common IMS - based on SIP Digest(Release 11)", 3GPP TR 33.914 V 1.0.0 3RD GENERATION PARTNERSHIP PROJECT, May 2011 (2011-05-01) *

Also Published As

Publication number Publication date
CN103095649A (zh) 2013-05-08

Similar Documents

Publication Publication Date Title
JP6732095B2 (ja) 異種ネットワークのための統一認証
CN111327582B (zh) 一种基于OAuth协议的授权方法、装置及***
KR101038064B1 (ko) 애플리케이션 인증
US10880291B2 (en) Mobile identity for single sign-on (SSO) in enterprise networks
WO2010012203A1 (zh) 鉴权方法、重认证方法和通信装置
WO2007104245A1 (fr) Système de cadre de référence pour développement des services web et son procédé d&#39;authentification
US20110004754A1 (en) Method And Apparatuses For Authentication And Reauthentication Of A User With First And Second Authentication Procedures
WO2007085175A1 (fr) Procédé, système d&#39;authentification et centre d&#39;authentification reposant sur des communications de bout en bout dans le réseau mobile
WO2012058896A1 (zh) 单点登录方法及***
KR20150052840A (ko) 무선 유닛의 사용자를 인증하는 방법들 및 시스템들
WO2013004112A1 (zh) 数据传输的方法及装置
KR20050064119A (ko) 인터넷접속을 위한 확장인증프로토콜 인증시 단말에서의서버인증서 유효성 검증 방법
WO2006116921A1 (fr) Procede d&#39;authentification d&#39;un terminal utilisateur dans un sous-systeme multimedia ip
WO2007028328A1 (fr) Procede, systeme et dispositif de negociation a propos d&#39;une cle de chiffrement partagee par equipement utilisateur et equipement externe
WO2009074050A1 (fr) Procede, systeme et appareil d&#39;authentification de dispositif de point d&#39;acces
WO2007104248A1 (en) Method, system, apparatus and bsf entity for preventing bsf entity from attack
WO2007147354A1 (fr) Procédé et système pour extraire une clé de messagerie instantanée
CN112333705B (zh) 一种用于5g通信网络的身份认证方法及***
CN102694779B (zh) 组合认证***及认证方法
WO2011035579A1 (zh) Wapi终端接入ims网络的认证方法、***和终端
WO2013004104A1 (zh) 单点登录方法及***
WO2012000313A1 (zh) 一种家庭网关认证方法和***
WO2010124490A1 (zh) 获取无线局域网鉴别和保密基础结构证书的方法及***
WO2013127342A2 (zh) 一种ims单点登录组合鉴权方法和***
WO2013064040A1 (zh) 一种ims单点登录的组合鉴权方法及***

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12846682

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12846682

Country of ref document: EP

Kind code of ref document: A1