IMS Registration for an Unauthenticated User - …

1 IMS Registration (IMS Registration for an Unauthenticated user )Visited NetworkInternetHome NetworkUserEquipmentVisited CNVisited IMSDNS ServerHome IMSHome CNSubscriberSGSNGGSNP-CSCFDNS ServerI-CSCFS-CSCFHSSE ventStudio System Designer 18:36 (Page 1)This sequence diagram describes the IMS Registration of a terminal. The IMS Registration goes through the following sequence: (1) GPRS Attach: The terminal registers to the GPRS Network. (2) PDP Context Activation: An IP address is assigned to the terminal. (3) Unauthenticated IMS Registration Attempt: The terminal attempts an IMS Registration but is challenged by the IMS network to authenticate itself. (4) IPSec Security Association Establishment: The terminal establishes a protected session with the IMS network. (5) Authenticated IMS Registration : Registration is reattempted. This time the terminal is successfully authenticated and accepted. This sequence diagram was generated with EventStudio System Designer ( ).

2 Copyright 2007 Inc. All Rights Reserved. GPRS Attach GMM Attach RequestThe terminal powers up and attaches to the Attach AcceptGMM Attach CompletePDP Context Activation Activate PDP ContextOnce the attach is completed, the terminal initiates aPDP context PDP Context RequestCreate PDP Context RequestActivate PDP Context AcceptP-CSCF IP AddressThe terminal receives an IP address for the PDPcontext. The terminal also receives the IP address ofthe P-CSCF. The P-CSCF serves as the initial SIPproxy into the IP Multimedia System (IMS). Unauthenticated IMS Registration Attempt Store P-CSCF IP AddressThe P-CSCF IP address obtained from the PDPC ontext Accept message is user public identityfrom ISIMThe subscriber extracts the user public identify fromthe ISIM module of the side client andserver portsThe SIP terminal allocates the subscriber side clientand server ports. These ports will be included in theREGISTER message sent to the Registration (IMS Registration for an Unauthenticated user )Visited NetworkInternetHome NetworkUserEquipmentVisited CNVisited IMSDNS ServerHome IMSHome CNSubscriberSGSNGGSNP-CSCFDNS ServerI-CSCFS-CSCFHSSE ventStudio System Designer 18:36 (Page 2)REGISTERREGISTER ,Via: UE-IP;branch=0abab,Route: sip:[P-CSCF-IP],Max-Forwards: 20,From: <sip:[UE-IP]>;expires=90000,Call-ID: ababab,CSeq: 25 REGISTER,Security-Client: port-s, port-c,Authorization: Digest username = 0 The subscriber sends a Register message to informthe network that the specified user public is available at the IPaddress indicated in the Contact Header.

3 The UserEquipment (UE) also adds a via header to record thatthe message had traversed the UE. The REGISTER message also includes the server and client that the message itself is sent on the standardSIP port SIP REGISTER message also includes the privateidentity of the user . This identity will be used by theS-CSCF and HSS to identify the Querydomain = P-CSCF receives the REGISTER message anduses the DNS to translate from the domain the IP address of the home Responseip = ICSCF-IPREGISTERREGISTER ,Via: ;branch=0aab1,Via: UE-IP;branch=0abab,Max-Forwards: 19,From: <sip:[UE-IP]>;expires=90000,Call-ID: ababab,CSeq: 25 REGISTER,Content-Length: 0,Authorization: Digest username integrity protection:noP-CSCF adds a Via header and removes the Routeheader. The REGISTER message will be routed to theIP address obtained from the DNS response. Notethat the integrity protection flag is set to false tosignify that the user has not been Authorization the HSS to assign the Authorization AnswerS-CSCF Name,S-CSCF CapabilitiesHSS replies with the S-CSCFI-CSCF selects the S-CSCF based on the ,Via: ;branch=0aab2,Via: ;branch=0aab1,Via: UE-IP;branch=0abab,Route: ,Max-Forwards: 18,From: <sip:[UE-IP]>.

4 Expires=90000,Call-ID: ababab,CSeq: 25 REGISTER,Content-Length: 0,Authorization: Digest username integrity protection:noThe I-CSCF forwards the REGISTER message to theselected Registration (IMS Registration for an Unauthenticated user )Visited NetworkInternetHome NetworkUserEquipmentVisited CNVisited IMSDNS ServerHome IMSHome CNSubscriberSGSNGGSNP-CSCFDNS ServerI-CSCFS-CSCFHSSE ventStudio System Designer 18:36 (Page 3)Multimedia Authentication Authentication AnswerRAND, AUTN, XRES, CK, IKHSS passes the Random number (RAND),Authentication token (AUT), signed result (XRES),Cipher key (CK) and Integrity Key (IK).Select Authentication vectorsSave the selected authenticationvector401 UnauthorizedWWW-Authenticate: nonce=RAND-AUTN, ck, ik,Via: icscf1, pcscf1, ue-ipThe user is currently not authenticated, so theregistration request is rejected. The terminal ischallenged to authenticate the user . RAND, AUTN, CKand IK are passed in the WWW-Authenticate UnauthorizedWWW-Authenticate: nonce=RAND-AUTN, ck, ik,Via: pcscf1, ue-ipPass the message to the P-CSCF.

5 CK and IK arecarried in the WWW-Authenticate CK and IKThe P-CSCF saves the ciphering and integrity keys will be needed for establishing the IPSecsecurity side client and server portsThe P-CSCF allocates the subscriber side client andserver ports. These ports will be included in the 401 Unauthorized message sent to the UnauthorizedWWW-Authenticate: nonce=RAND-AUTN,Security-Server: port-s, port-cPass the RAND and AUTN values to the CK and IK are removed from theWWW-Authenticate header. The P-CSCF side clientand server ports are also included in the message itself is sent on the standard SIP AUTN and ComputeRESA uthenticate the IMS network by verifying theauthentication token (AUTN). Also compute the RESvalue that will be passed back to the IMS network foruser Security Association Establishment IPSec SA for UE Initiated RequestsUE-Client -> P-CSCF-ServerEstablish IPSec security associations for all the clientand server SA for Responses to UEUE-Server <- P-CSCF-ClientIPSec SA for P-CSCF Initiated RequestsUE-Server <- P-CSCF-ClientIPSec SA for Responses to P-CSCFUE-Client -> P-CSCF-ServerAuthenticated IMS Registration IMS Registration (IMS Registration for an Unauthenticated user )Visited NetworkInternetHome NetworkUserEquipmentVisited CNVisited IMSDNS ServerHome IMSHome CNSubscriberSGSNGGSNP-CSCFDNS ServerI-CSCFS-CSCFHSSE ventStudio System Designer 18:36 (Page 4)REGISTERVia: UE-IP.

6 UE-Server-Port,Route: pcscf1, pcscf-server-port,Contact: UE-IP ue-server-port,Authorization: Digest username = Subscriber has now established the IPSecsecurity associations with the P-CSCF. At this point,the SIP REGISTER message is sent again. This timethe message is protected by IPSec and the messageis addressed to the P-CSCF server port passed in the401 Unauthorized message. The message containsthe RES in the Authorization : pcscf1 UE-IP;UE-Server-Port,Contact: UE-IP ue-server-port,Authorization: Digest username response=RES integrityprotection: yes,RESPass the REGISTER message to the I-CSCF. This timethe Authorization header indicates that integrityprotection is Authorization the HSS to assign the Authorization AnswerS-CSCF Name,S-CSCF CapabilitiesHSS replies with the : icscf1 pcscf1 UE-IP;UE-Server-Port,Contact: UE-IP ue-server-port,Authorization: Digest username response=RES integrityprotection: yes,RESThe SIP REGISTER message is finally delivered to Assignment subscriber related information from the Assignment AnswerReceived subscriber related RES and XRESC ompare the RES reported by the subscriber witheXRES OKVia: icscf1, pcscf1, UE-IP;UE-Server-PortThe RES and the XRES matched, so the S-CSCF replies with OKVia: pcscf1, UE-IP;UE-Server-PortThe success is relayed back to the OKVia: UE-IP;UE-Server-PortThe IMS Registration of the user is now complete.