Abstract:
A method of authentication in an IP Multimedia Subsystem (IMS) is provided. After receiving a Register message from a User Equipment (UE), a Proxy-Call Session Control Function (P-CSCF) locates a Connection Location Function (CLF) according to information contained in the Register message and a pre-configured corresponding relationship between the information contained in the Register message and the CLF. The P-CSCF obtains a query result by querying the CLF about attachment information of the UE in an access network, and sends the Register message carrying the query result to an Interrogating-Call Session Control Function (I-CSCF). The I-CSCF forwards the Register message carrying the query result to a Service-Call Session Control Function (S-CSCF). The S-CSCF authenticates the UE according to an authentication mechanism obtained from a User Profile Service Function (UPSF) or a Home Subscriber Server (HSS), and sends an authentication result to the UE.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation of U.S. patent application Ser. No. 11/842,668, filed on Aug. 21, 2007, which is a continuation of International Application No. PCT/CN2006/001569, filed on Jul. 5, 2006. The International Application claims priority to Chinese Patent Application No 200510082907.8, filed on Jul. 5, 2005, Chinese Patent Application No. 200510093216.8, filed on Aug. 19, 2005, and Chinese Patent Application No. 200510109162.X, filed on Oct. 18, 2005. The aforementioned patent applications are hereby incorporated by reference in their entireties. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates to an IP Multimedia Subsystem (IMS), and more particularly, to a method of authentication in the IMS. 
       BACKGROUND OF THE INVENTION 
       [0003]    A Next Generation Network (NGN) as well as a mobile network may generally be divided into an access network and a service network. A user may access an IP network via the access network provided by an access network operator, and then enjoy different services such as voice, video, stream media, etc., through service networks provided by one or multiple service network operators. 
         [0004]    When the access network and the service network belong to different operators, authentications of the user in the access network and the service network are independent. In such a scenario, the user needs two types of authentications before enjoying the service. One authentication is in the access layer; after the authentication in the access layer succeeds, the user is able to access to the NGN network. The other authentication is in the service layer; and after the authentication in the service layer succeeds, the user is able to enjoy the services provided by the service network. 
         [0005]    When the service network and the access network belong to the same operator, or when there exists cooperation between the access network operator and the service network operator, the service network operator may bind the authentication in the service layer with that in the access layer under some networking scenarios. In other words, the user is regarded to be legal after the authentication in the access layer succeeds, and the authentication in the service layer is no longer required. 
         [0006]    In the IMS access layer, an Authentication and Key Agreement (AKA) scheme is usually employed for the authentication of the UE in the IMS service layer. 
         [0007]    Referring to  FIG. 1 , the IMS AKA scheme includes: 
         [0008]    Block s 101 : a User Equipment (UE) sends a Register message to a Proxy-Call Session Control Function (P-CSCF). 
         [0009]    Block s 102 : The P-CSCF, acting as a Session Initial Protocol (SIP) proxy server, forwards the Register message of the UE to an Interrogating-CSCF (I-CSCF). 
         [0010]    Block s 103 : The I-CSCF interacts with a Home Subscriber Server (HSS) through a Cx-Selection-Info message to select a corresponding Service-CSCF (S-CSCF), i.e., the I-CSCF sends a request to the HSS to search a user profile in the HSS to select the S-CSCF for processing the Register message. 
         [0011]    Block s 104 : The I-CSCF forwards the Register message of the UE to the S-CSCF selected in the Block s 103 . 
         [0012]    Block s 105 : The S-CSCF sends a Cx-Put message to the HSS to update S-CSCF indication information in the HSS and notify the HSS that it has been assigned to serve this user. 
         [0013]    Block s 106 : The S-CSCF sends an AV-Req message to the HSS requesting an authentication vector of the user. 
         [0014]    Block s 107 : The HSS returns an AV-Req-Resp message to the S-CSCF carrying the authentication vector of the user. 
         [0015]    Block s 108 : The S-CSCF determines that the UE needs to be authenticated according to the authentication vector received in Block s 107  and the Register message of the UE, then the S-CSCF sends a 4xx Auth_Challenge message containing authentication-relevant information indicating that the UE needs to be authenticated to the I-CSCF. The 4xx denotes a kind of error and the xx stands for a number within 00˜99. 
         [0016]    Block s 109 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0017]    Block s 110 : The P-CSCF forwards the 4xx Auth_Challenge message to the UE. 
         [0018]    Block s 111 : after receiving the 4xx Auth_Challenge message, the UE sends another Register message to the P-CSCF, at this time, the Register message carries an authentication parameter. 
         [0019]    Block s 112 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0020]    Block s 113 : after receiving the Register message, the I-CSCF sends a Cx-Query message to the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the HSS about the S-CSCF which has been assigned to serve this user. The HSS returns the S-CSCF name which was previously selected to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0021]    Block s 114 : The I-CSCF forwards the Register message to the S-CSCF determined in the Block s 113 . 
         [0022]    Block s 115 : The S-CSCF sends a Cx-Put message to the HSS to update the S-CSCF indication information in the HSS and notify the HSS that it has been assigned to serve this user. 
         [0023]    Block s 116 : The S-CSCF downloads a user profile from the HSS through a Cx-Pull message. 
         [0024]    Block s 117 : The S-CSCF authenticates the UE according to the user profile and the authentication parameter in the Register message of the UE. If the authentication succeeds, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the registration succeeds, wherein the 2xx indicates that the message is success relevant, and the xx is a number within 00˜99. If the authentication fails, the S-CSCF sends an authentication failure message indicating that the authentication is failed to the I-CSCF. 
         [0025]    Block s 118 : if the authentication succeeds, the I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. If the authentication fails, the I-CSCF forwards the authentication failure message to the P-CSCF. 
         [0026]    Block s 119 : if the authentication succeeds, the P-CSCF forwards the 2xx Auth_OK message to the UE. If the authentication fails, the P-CSCF forwards the authentication failure message to the UE. 
         [0027]    France Telecom has put forward a Network Attach Sub System (NASS) Bundled Authentication (NBA) scheme to implement IMS-NASS bundled authentication at the Telecommunications and Internet Converged Services and Protocols for Advanced Networking (TISPAN) #6bis. In the NBA scheme, a Connection Location Function (CLF) in the NASS holds a bundled indication and a corresponding relationship between an IP address of the UE and association information of the UE in the access network. Each connection of the user holds one piece of association information. 
         [0028]    Referring to  FIG. 2 , the NBA scheme includes: 
         [0029]    Block s 201 : The UE sends a Register message to the P-CSCF. 
         [0030]    Block s 202 : The P-CSCF queries the CLF about NASS attachment information of the UE according to a source IP address of the Register message, wherein the NASS attachment information contains the association information of the UE and the bundled indication. 
         [0031]    Block s 203 : The P-CSCF compares the association information and an IP Multimedia Private Identity (IMPI) in an authentication header of the Register message. If the association information is consistent with the IMPI, it means that the authentication in the IMS service layer succeeds, proceed to Block s 205 ; otherwise, it means that the authentication in the IMS service layer is failed, proceed to Block s 204  to send a 403 Forbidden to the UE. 
         [0032]    Block s 205 : The P-CSCF forwards the Register message carrying an indicator indicating whether the authentication succeeds to the I-CSCF. 
         [0033]    Block s 206 : The I-CSCF interacts with the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the HSS to search the user profile in the HSS to select the S-CSCF for processing the Register message. 
         [0034]    Block s 207 : The I-CSCF forwards the Register message to the S-CSCF selected in the Block s 206 . 
         [0035]    Block s 208 : after confirming that the user has successfully registered, without requesting the HSS for the authentication vector of the user, the S-CSCF sends a Cx-Put message to the HSS to update the S-CSCF indication information in the HSS and notify the HSS that it has been assigned to serve this user, and downloads the user profile from the HSS through a Cx-Pull message. 
         [0036]    Block s 209 : The S-CSCF returns a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0037]    Block s 210 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0038]    Block s 211 : The P-CSCF forwards the 2xx Auth_OK message to the UE. 
         [0039]    In the above scheme, the IMPI contained in the Register message is required to be consistent with the association information, i.e., the IMPI in the service layer and the association information in the access layer are the same identity. However, the service network operator is usually not the same with the access network operator. Thus the requirement of using the same identity for the service network operator and the access network operator restricts the flexibility of network applications. Moreover, it is unreasonable that the bundled indication is saved in the NASS. The reasonable method should be that the bundled indication is saved in the service layer (e.g., the HSS), while the access layer is only responsible for providing relevant information. Further, it is also unreasonable for the P-CSCF to implement the authentication. It may be more reasonable that the S-CSCF in a home network implements the authentication in the service layer, and the P-CSCF only provides relevant information of the authentication. 
         [0040]    Further, when the state of the user changes, e.g., the user may employ different terminals when in different locations, the authentication adopting the IMS authentication bundled with NASS, which is configured as a default authentication mechanism, will fail. Thus the quality of service is decreased. Therefore, a second authentication mechanism pre-configured in the HSS is required to authenticate the user. However, there are no such solutions in the related art. 
       SUMMARY OF THE INVENTION 
       [0041]    Embodiments of the present invention provide a method of authentication in an IP Multimedia Subsystem (IMS) in which an authentication mechanism is determined by a service layer, so as to guarantee retral-compatibility and maintainability of the authentication. 
         [0042]    According to one aspect of the present invention, the method of authentication in the IMS includes: 
         [0043]    after receiving a Register message from a User Equipment (UE), locating, by a Proxy-Call Session Control Function (P-CSCF), a Connection Location Function (CLF) according to information contained in the Register message and a pre-configured corresponding relationship between the information contained in the Register message and the CLF; 
         [0044]    querying, by the P-CSCF, the CLF about Network Attach Sub System (NASS) information of the UE in an access network to obtain a query result, and sending the Register message carrying the query result to an Interrogating-Call Session Control Function (I-CSCF); 
         [0045]    forwarding, by the I-CSCF, the Register message carrying the query result to a Service-Call Session Control Function (S-CSCF); 
         [0046]    authenticating, by the S-CSCF, the UE according to an authentication mechanism obtained from a User Profile Service Function (UPSF) or a Home Subscriber Server (HSS), and sending an authentication result to the UE. 
         [0047]    It can be seen from the above technical solution that, in the method provided by embodiments of the present invention, the UPSF or the HSS determines the authentication mechanism of the user and the S-CSCF implements the authentication, which is in accordance with the principle of implementing the authentication in the service layer and may be more reasonable. Compared with the related art, the technical solution provided by the embodiments of the present invention requires little modification to the existing IMS AKA procedure, thereby is more applicable and flexible, and more compatible with the existing IMS AKA. 
         [0048]    Additionally, the UPSF or the HSS pre-stores the authentication mechanism of the user. Thus, the user may be provided with different kinds of combinations of authentication mechanisms. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0049]      FIG. 1  is a message flow illustrating an IMS AKA scheme according to the related art. 
           [0050]      FIG. 2  is a message flow illustrating the NBA scheme according to the related art. 
           [0051]      FIGS. 3   a  and  3   b  are message flows of an authentication according to a first embodiment the present invention. 
           [0052]      FIGS. 4   a  and  4   b  are message flows of an authentication according to a second embodiment the present invention. 
           [0053]      FIGS. 5   a  and  5   b  are message flows of an authentication according to a third embodiment the present invention. 
           [0054]      FIGS. 6   a  and  6   b  are message flows of an authentication according to a fourth embodiment the present invention. 
           [0055]      FIGS. 7   a  and  7   b  are message flows of an authentication according to a fifth embodiment the present invention. 
           [0056]      FIG. 8  is a message flow illustrating an HTTP DIGEST authentication. 
           [0057]      FIGS. 9   a  and  9   b  are message flows of an authentication according to a sixth embodiment the present invention. 
           [0058]      FIGS. 10   a  and  10   b  are message flows of an authentication according to a seventh embodiment the present invention. 
           [0059]      FIGS. 11   a  and  11   b  are message flows of an authentication according to an eighth embodiment the present invention. 
           [0060]      FIGS. 12   a  and  12   b  are message flows of an authentication according to a ninth embodiment the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0061]    In order to make the technical solution and merits of the present invention clearer, a detailed description of the present invention is hereinafter given with reference to accompanying drawings and preferred embodiments. 
         [0062]    A first embodiment of the present invention is based on the IMS AKA scheme, provides a method of IMS authentication bundled with NASS. In the first embodiment, the UPSF or the HSS pre-stores a user profile indicating whether the authentication mechanism of the user is IMS authentication bundled with NASS. 
         [0063]    Referring to  FIGS. 3   a  and  3   b , the method of the first embodiment includes: 
         [0064]    Block  101 : The UE sends a Register message to the P-CSCF. 
         [0065]    Block  102 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0066]    Block  103 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to select the S-CSCF for processing the Register message by analyzing the user profile in the UPSF or the HSS. 
         [0067]    Block  104 : The I-CSCF forwards the Register message of the UE to the S-CSCF selected in the Block  103 . 
         [0068]    Block  105 : The S-CSCF sends a Cx-Put message to the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0069]    Block  106 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting authentication data of the user. 
         [0070]    Block  107 : The UPSF or the HSS checks the user profile to get the authentication mechanism which indicates the IMS authentication is bundled with NASS. 
         [0071]    Block  108 : The UPSF or the HSS returns an AV-Req-Resp message to the S-CSCF. Different from the authentication data sent in the related art, an indication of the authentication mechanism is sent together with the authentication data to the S-CSCF. 
         [0072]    Block  109 : The S-CSCF determines that the authentication mechanism of the user is the IMS authentication bundled with NASS according to the indication of the authentication mechanism, and then sends to the I-CSCF a 4xx Auth_Challenge message carrying the indication of the authentication mechanism, i.e., an bundled indication, in the authentication header of the 4xx Auth_Challenge message (e.g. WWW-Authenticate) to indicate that the authentication mechanism of the user is the IMS authentication bundled with NASS. 
         [0073]    Block  110 : The I-CSCF forwards the 4xx Auth_Challenge message carrying the bundled indication to the P-CSCF. 
         [0074]    Block  111 : After receiving the 4xx Auth_Challenge message, the P-CSCF determines that an “algorithm” parameter in a WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism of the user is the IMS authentication bundled with NASS. Therefore, the P-CSCF needs not establish a security association with the UE. The P-CSCF forwards the 4xx Auth_Challenge message carrying the bundled indication but no Security-Server header to the UE. 
         [0075]    Block  112 : After receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism of the user is the IMS authentication bundled with NASS. Therefore, the UE needs not establish the security association with the P-CSCF. The UE sends to the P-CSCF another Register message carrying an access network identity and association information of the UE in the access network. 
         [0076]    Block  113 : The P-CSCF locates the CLF according to the access network identity in the Register message and the pre-set corresponding relationship between the CLF and the access network identity. 
         [0077]    Block  114 : The P-CSCF queries the CLF located in block  113  about the NASS attachment information of the UE in the access layer according to the association information in the Register message. Different from that of the related art, the CLF pre-stores data record of the NASS attachment information corresponding to the association information, wherein the NASS attachment information includes IP address information, location information, etc., but no bundled indication. If there is no data record of the NASS attachment information corresponding to the association information, the CLF returns a query failure message to the P-CSCF. 
         [0078]    Block  115 : The P-CSCF sends the Register message carrying the query result of block  114  and the source IP address of the Register message received by the P-CSCF to the I-CSCF; if the query in block  114  succeeds, the P-CSCF sends the NASS attachment information queried to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0079]    Block  116 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  103  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0080]    Block  117 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF determined in the Block  116 . If the query succeeds, the query result is the NASS attachment information; otherwise, the query result is the query failure message reported. 
         [0081]    Block  118 : If the query result is the NASS attachment information, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  119 , i.e., send an authentication success message to the UE; otherwise, it means that the authentication is failed, proceed to Block  131 , i.e., send an authentication failure message to the UE. 
         [0082]    If the query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  131 , i.e., send the authentication failure message to the UE. 
         [0083]    Block  119 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0084]    Block  120 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0085]    Block  121 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0086]    Block  122 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0087]    Block  123 : The P-CSCF forwards the 2xx Auth_OK message to the UE. 
         [0088]    Block  131 , as shown in  FIG. 3   b : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0089]    Block  132 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0090]    Block  133 : The S-CSCF sends an authentication failure message to the I-CSCF to indicate that the authentication is failed. 
         [0091]    Block  134 : The I-CSCF forwards the authentication failure message to the P-CSCF. 
         [0092]    Block  135 : The P-CSCF forwards the authentication failure message to the UE. 
         [0093]    When the access network operator is the same with the service network operator, since the association information and the IMPI are the same, the NASS does not issue the access network identity and the association information to the UE. At this time, a second embodiment may be adopted, as shown in  FIGS. 4   a  and  4   b . The second embodiment is a simplification of the first embodiment. In the second embodiment, the source IP address of the Register message may be used to locate the CLF, and the IMPI in the IMS service layer may be used to query the NASS attachment information of the UE in the access layer. Similar to the first embodiment, the UPSF or the HSS also pre-stores the user profile indicating whether the authentication mechanism of the user is IMS authentication bundled with NASS. 
         [0094]    Referring to  FIGS. 4   a  and  4   b , the method of the authentication according to the second embodiment of the present invention includes: 
         [0095]    Blocks  201  to  211  are respectively the same as the Blocks  101  to  111  in the first embodiment. 
         [0096]    Block  201 : The UE sends a Register message to the P-CSCF. 
         [0097]    Block  202 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0098]    Block  203 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to search the user profile in the UPSF or the HSS to select which S-CSCF will process the Register message. 
         [0099]    Block  204 : The I-CSCF forwards the Register message of the UE to the S-CSCF selected in the Block  203 . 
         [0100]    Block  205 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0101]    Block  206 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0102]    Block  207 : The UPSF or the HSS checks the user profile to get the authentication mechanism which indicates the IMS authentication is bundled with NASS. 
         [0103]    Block  208 : The UPSF or the HSS returns an AV-Req-Resp message to the S-CSCF. Different from the authentication data sent in the related art, the indication of the authentication mechanism is sent together with the authentication data to the S-CSCF. 
         [0104]    Block  209 : The S-CSCF determines that the authentication mechanism of the user is the IMS authentication bundled with NASS according to the indication of the authentication mechanism obtained in the Block  208 , and then sends to the I-CSCF a 4xx Auth_Challenge message carrying the indication of the authentication mechanism, i.e., the bundled indication, in the authentication header of the 4xx Auth_Challenge message to indicate that the authentication mechanism of the user is the IMS authentication bundled with NASS. 
         [0105]    Block  210 : The I-CSCF forwards the 4xx Auth_Challenge message carrying the bundled indication to the P-CSCF. 
         [0106]    Block  211 : After receiving the 4xx Auth_Challenge message, the P-CSCF determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism of the user is IMS authentication bundled with NASS. Therefore, the P-CSCF needs not establish a security association with the UE. The P-CSCF forwards the 4xx Auth_Challenge message carrying the bundled indication but no Security-Server header to the UE. 
         [0107]    Block  212 : After receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge indicates that the authentication mechanism of the user is IMS authentication bundled with NASS. Therefore, the UE needs not establish the security association with the P-CSCF. The UE sends a Register message to the P-CSCF again. Different from that in the first embodiment, the Register message needs not carry the access network identity and the association information, instead, the Register message carries the IMPI in the authentication header. 
         [0108]    Block  213 : The P-CSCF locates the CLF according to the source IP address of the Register message and the pre-set corresponding relationship between the source IP address and the CLF. 
         [0109]    Block  214 : The P-CSCF queries the CLF about the NASS attachment information of the UE in the access layer according to the IMPI carried in the authentication header of the Register message. The CLF pre-stores the data record of the NASS attachment information corresponding to the IMPI. The NASS attachment information includes IP address information, location information, etc., but no bundled indication in the related art. If the CLF has no data record corresponding to the IMPI, the CLF returns a query failure message to the P-CSCF. 
         [0110]    Blocks  215  to  223  are respectively the same as the Blocks  115  to  123  in the first embodiment. 
         [0111]    Block  215 : The P-CSCF sends the Register message to the I-CSCF with the query result of block  214  and the source IP address of the Register message received by the P-CSCF; if the query in block  214  succeeds, the P-CSCF sends the NASS attachment information queried to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0112]    Block  216 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  203  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0113]    Block  217 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF determined in the Block  216 . If the query succeeds, the query result is the NASS attachment information obtained; otherwise, the query result is the query failure message reported. 
         [0114]    Block  218 : If the query result is the NASS attachment information queried, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  219 , i.e., send an authentication success message to the UE; otherwise, it means that the authentication is failed, proceed to Block  231 , i.e., send an authentication failure message to the UE. 
         [0115]    If the query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  231 , i.e., send the authentication failure message to the UE. 
         [0116]    Block  219 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0117]    Block  220 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0118]    Block  221 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0119]    Block  222 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0120]    Block  223 : The P-CSCF forwards the 2xx Auth_OK message to the UE. 
         [0121]    Block  231 , as shown in  FIG. 4   b : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0122]    Block  232 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0123]    Block  233 : The S-CSCF sends an authentication failure message to the I-CSCF indicating that the authentication is failed. 
         [0124]    Block  234 : The I-CSCF forwards the authentication failure message to the P-CSCF. 
         [0125]    Block  235 : The P-CSCF forwards the authentication failure message to the UE. 
         [0126]    In the methods in accordance with the first and the second embodiments, the UE will not send the Register message carrying the access network identity and the association information until determining that the authentication mechanism is IMS authentication bundled with NASS. While in the third embodiment, the UE sends the Register message carrying the access network identity and the association information at the very start. Similar to the first and the second embodiments, the UPSF or the HSS pre-stores the user profile indicating whether the authentication mechanism of the user is IMS authentication bundled with NASS. 
         [0127]    Referring to  FIGS. 5   a  and  5   b , the method of authentication according to the third embodiment is as follows: 
         [0128]    Block  301 : The UE sends a Register message carrying the access network identity and the association information to the P-CSCF. 
         [0129]    Block  302 : The P-CSCF locates the CLF according to the access network identity in the Register message and the pre-set corresponding relationship between the CLF and the access network identity. 
         [0130]    Block  303 : The P-CSCF queries the CLF located in block  302  about the NASS attachment information of the UE in the access layer according to the association information in the Register message. The CLF pre-stores the data record of the NASS attachment information corresponding to the association information, wherein the NASS attachment information includes IP address information, location information, etc., but no bundled indication in the related art. If there is no data record of the NASS attachment information corresponding to the association information, the CLF returns a query failure message to the P-CSCF. 
         [0131]    Block  304 : The P-CSCF sends to the I-CSCF the Register message carrying the query result in block  303  and the source IP address of the Register message received by the P-CSCF; if the query in block  303  succeeds, the P-CSCF sends the NASS attachment information queried to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0132]    Block  305 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to search the user profile in the UPSF or the HSS to select the S-CSCF for processing the Register message. 
         [0133]    Block  306 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF selected in the Block  305 . If the query succeeds, the query result is the NASS attachment information queried; otherwise, the query result is the query failure message reported. 
         [0134]    Block  307 : The S-CSCF sends a Cx-Put message to the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0135]    Block  308 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0136]    Block  309 : The UPSF or the HSS checks the user profile and determines that the authentication mechanism of the user is the IMS authentication bundled with NASS. 
         [0137]    Block  310 : The UPSF or the HSS returns an AV-Req-Resp message to the S-CSCF. Different from the authentication data sent in the related art, an indication of the authentication mechanism is sent together with the authentication data to the S-CSCF. 
         [0138]    Block  311 : if the query result is the NASS attachment information queried, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  312 , i.e., send an authentication success message to the UE; otherwise, it means that the authentication is failed, proceed to Block  321 , i.e., send an authentication failure message to the UE. 
         [0139]    If the query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  321 , i.e., send the authentication failure message to the UE. 
         [0140]    Block  312 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0141]    Block  313 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0142]    Block  314 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0143]    Block  315 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0144]    Block  316 : after receiving the 2xx Auth_OK message, the P-CSCF determines that it did not receive a 4xx Auth_Challenge message before, therefore the P-CSCF needs not establish a security association with the UE The P-CSCF forwards the 2xx Auth_OK message to the UE; and after receiving the 2xx Auth_OK message, the UE determines that it did not receive the 4xx Auth_Challenge message before, therefore the UE needs not establish the security association with the P-CSCF. 
         [0145]    Block  321 , as shown in  FIG. 5   b : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0146]    Block  322 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0147]    Block  323 : The S-CSCF sends an authentication failure message to the I-CSCF indicating that the authentication is failed. 
         [0148]    Block  324 : The I-CSCF forwards the authentication failure message to the P-CSCF. 
         [0149]    Block  325 : The P-CSCF forwards the authentication failure message to the UE. 
         [0150]    Similar to the second embodiment, when the access network operator is the same with the service network operator, since the association information and the IMPI are the same, the NASS does not issue the access network identity and the association information to the UE. At this time, a fourth embodiment may be adopted, as shown in  FIGS. 6   a  and  6   b . The fourth embodiment is a simplification of the third embodiment. In the fourth embodiment, the access network operator and the CLF are recognized through the source IP address of the Register message, and the NASS attachment information of the UE in the access layer is queried from the CLF according to the IMPI in the IMS service layer. Similar to the first embodiment, the UPSF or the HSS also pre-stores the user profile indicating whether the authentication mechanism of the user is IMS authentication bundled with NASS. 
         [0151]    Referring to  FIGS. 6   a  and  6   b , the method of the fourth embodiment includes: 
         [0152]    Block  401 : The UE sends a Register message to the P-CSCF. Different from the third embodiment, the Register message needs not carry the access network identity and the association information. Instead, the Register message carries the IMPI in the authentication header. 
         [0153]    Block  402 : The P-CSCF locates the CLF according to the source IP address of the Register message and the pre-set corresponding relationship between the source IP address and the CLF 
         [0154]    Block  403 : The P-CSCF queries the CLF about the NASS attachment information of the UE in the access layer according to the IMPI carried in the authentication header of the Register message. The CLF pre-stores the data record of the NASS attachment information corresponding to the IMPI. The NASS attachment information includes IP address information, location information, etc., but no bundled indication in the related art. If the CLF has no data record corresponding to the IMPI, the CLF returns a query failure message to the P-CSCF. 
         [0155]    Blocks  404  to  425  are respectively the same as the Blocks  304  to  325  in the third embodiment. 
         [0156]    Block  404 : The P-CSCF sends to the I-CSCF the Register message carrying the query result in block  403  and the source IP address of the Register message received by the P-CSCF; if the query in block  403  succeeds, the P-CSCF sends the NASS attachment information queried to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0157]    Block  405 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to search the user profile in the UPSF or the HSS to select the S-CSCF for processing the Register message. 
         [0158]    Block  406 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF selected in the Block  405 . If the query succeeds, the query result is the NASS attachment information queried; otherwise, the query result is the query failure message reported. 
         [0159]    Block  407 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0160]    Block  408 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0161]    Block  409 : The UPSF or the HSS checks the user profile to get the authentication mechanism which indicates the IMS authentication is bundled with NASS. 
         [0162]    Block  410 : The UPSF or the HSS returns an AV-Req-Resp message to the S-CSCF. Different from the authentication data sent in the related art, an indication of the authentication mechanism is sent together with the authentication data to the S-CSCF. 
         [0163]    Block  411 : if the query result is the NASS attachment information queried, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  412 , i.e., send an authentication success message to the UE; otherwise, it means that the authentication is failed, proceed to Block  421 , i.e., send an authentication failure message to the UE. 
         [0164]    If the query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  421 , i.e., send the authentication failure message to the UE. 
         [0165]    Block  412 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0166]    Block  413 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0167]    Block  414 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0168]    Block  415 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0169]    Block  416 : after receiving the 2xx Auth_OK message, the P-CSCF determines that it did not receive a 4xx Auth_Challenge message before, therefore the P-CSCF needs not establish a security association with the UE The P-CSCF forwards the 2xx Auth_OK message to the UE; and after receiving the 2xx Auth_OK message, the UE determines that it did not receive the 4xx Auth_Challenge message before, therefore the UE needs not establish a security association with the P-CSCF. 
         [0170]    Block  421 , as shown in  FIG. 6   b : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0171]    Block  422 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0172]    Block  423 : The S-CSCF sends an authentication failure message to the I-CSCF indicating that the authentication is failed. 
         [0173]    Block  424 : The I-CSCF forwards the authentication failure message to the P-CSCF. 
         [0174]    Block  425 : The P-CSCF forwards the authentication failure message to the UE. 
         [0175]    In the methods according to the first to the fourth embodiments, the S-CSCF authenticates the UE by comparing whether the source IP address of the Register message received by the P-CSCF is consistent with the IP address queried from the CLF. In the fifth embodiment of the present invention, the S-CSCF authenticates the UE by comparing whether the association information of the UE in the access network pre-stored in the UPSF or the HSS is consistent with that queried from the CLF. The association information may be an access user identity, location information, IP address information, etc. In the fifth embodiment, the access user identity is taken as an example. And the source IP address of the Register message is taken as an example to illustrate the process of locating the CLF and the process of querying the association information from the CLF. It can be seen from the foregoing embodiments of the present invention, the process of locating the CLF and the process of querying the association information from the CLF may be implemented employing other parameters, which will not be repeated herein. 
         [0176]    Referring to  FIGS. 7   a  and  7   b , the method of authentication in accordance with the fifth embodiment is as follows: 
         [0177]    Block  501 : The UE sends a Register message to the P-CSCF. 
         [0178]    Block  502 : The P-CSCF locates the CLF according to the source IP address of the Register message and the corresponding relationship between the CLF and the source IP address of the Register message. 
         [0179]    Block  503 : The P-CSCF queries the CLF about the access user identity of the user according to the source IP address of the Register message. The CLF pre-stores data record of the NASS attachment information of the UE corresponding to the source IP address; and the NASS attachment information includes at least the association information which is the access user identity herein. If the CLF has no data record corresponding to the source IP address, the CLF returns a query failure message. 
         [0180]    Block  504 : The P-CSCF sends the Register message carrying the query result of block  503  to the I-CSCF. If the querying succeeds, the P-CSCF takes the access user identity as the query result to send to the I-CSCF; if the querying is failed, the P-CSCF reports a query failure message to the I-CSCF as the query result. 
         [0181]    Block  505 : The I-CSCF selects a corresponding S-CSCF by interacting with the UPSF or the HSS through a Cx-Selection-Info message, i.e., the I-CSCF sends a request to the UPSF or the HSS to search a user profile of the UE in the UPSF or the HSS to select the S-CSCF for processing the Register message. 
         [0182]    Block  506 : The I-CSCF forwards the Register message including the query result to the S-CSCF selected in the Block  505 . If the querying succeeds, the query result is the access user identity, if the querying is failed, the query result is the query failure message reported. 
         [0183]    Block  507 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0184]    Block  508 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0185]    Block  509 : The UPSF or the HSS checks the user profile to get the authentication mechanism which indicates the IMS authentication is bundled with NASS. 
         [0186]    Block  510 : The UPSF or the HSS sends an AV-Req-Resp message to the S-CSCF. Different from the authentication data sent in the related art, the authentication mechanism information of the user and the access user identity are issued to the S-CSCF in this block. 
         [0187]    Block  511 : if the query result is the access user identity, the S-CSCF determines whether the access user identity queried from the CLF is consistent with the access user identity issued by the UPSF or the HSS. If the access user identity queried from the CLF is consistent with the access user identity issued by the UPSF or the HSS, it means that the authentication succeeds, proceed to Block  512 , i.e., send an authentication success message to the UE; if the access user identity queried from the CLF is not consistent with the access user identity issued by the UPSF or the HSS, it means that the authentication is failed, proceed to Block  521 , i.e., send an authentication failure message to the UE. 
         [0188]    If the above query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  521 , i.e., send the authentication failure message to the UE. 
         [0189]    Block  512 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0190]    Block  513 : The S-CSCF queries the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0191]    Block  514 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds; 
         [0192]    Block  515 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0193]    Block  516 : after receiving the 2xx Auth_OK message, the P-CSCF determines that it does not receive a 4xx Auth_Challenge message before; therefore, the P-CSCF needs not establish the security association with the UE. The P-CSCF forwards the 2xx Auth_OK message to the UE. After receiving the 2xx Auth_OK message, the UE determines that it does not receive a 4xx Auth_Challenge before; therefore it needs not establish the security association with the P-CSCF. 
         [0194]    Block  521 , as shown in  FIG. 7   b : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0195]    Block  522 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0196]    Block  523 : The S-CSCF sends an authentication failure message to the I-CSCF indicating that the authentication is failed. 
         [0197]    Block  524 : The I-CSCF forwards the authentication failure message to the P-CSCF. 
         [0198]    Block  525 : The P-CSCF forwards the authentication failure message to the UE. 
         [0199]    In the above embodiments, the UPSF or the HSS stores only one authentication mechanism for one user, i.e., the IMS authentication bundled with NASS. In the above embodiments, the user will be rejected to access to the network if the IMS authentication bundled with NASS is failed, which restricts the authentication and use of network services when the user is roaming. The roaming means that the user may change his/her access point when moving, but the ongoing session is completely interrupted and needs to be restarted. 
         [0200]    For example, the user may desire to use a traditional terminal to access to the network at a fixed location, at this time, the IMS authentication bundled with NASS is adopted. When roaming to another place, the user may desire to use another terminal to access to the network. Since the location information of the user is changed, if still using the IMS authentication bundled with NASS to authenticate the user, the authentication will fail, which affects the user from using the network. Therefore, a Hyper Text Transmission Protocol Digest (HTTP DIGEST) authentication mechanism or the IMS AKA authentication mechanism may be adopted after the IMS authentication bundled with NASS mechanism fails, thereby providing a flexible authentication for the user. 
         [0201]    Referring to  FIG. 8 , the process of the HTTP DIGEST authentication mechanism mainly includes: 
         [0202]    Block s 301 : The UE sends a Register message to the P-CSCF. 
         [0203]    Block s 302 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0204]    Block s 303 : The I-CSCF selects a corresponding S-CSCF by interacting with the HSS through a Cx-Selection-Info message, i.e., the I-CSCF sends a request to the HSS to search the user profile in the HSS to select the S-CSCF for processing the Register message. 
         [0205]    Block s 304 : The I-CSCF forwards the Register message of the UE to the S-CSCF selected in the Block s 303 . 
         [0206]    Block s 305 : The S-CSCF sends a Cx-Put message to the HSS to update the S-CSCF indication information and, notify the HSS that it has been assigned to serve this user. 
         [0207]    Block s 306 : The S-CSCF sends an AV-Req message to the HSS requesting the authentication data of the user. 
         [0208]    Block s 307 : The HSS checks the user profile and determines that the authentication mechanism of the user is the HTTP DIGEST, and generates authentication parameters such as nonce and expectation response (XRES), etc. 
         [0209]    The HSS sends an AV-Req-Resp message carrying an indication of the authentication mechanism, HTTP DIGEST, and the authentication parameters such as nonce, XRES to the S-CSCF. 
         [0210]    Block s 308 : The S-CSCF obtains the indication of the authentication mechanism and stores the XRES, then sends a 4xx Auth_Challenge message to the I-CSCF. 
         [0211]    Block s 309 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0212]    Block s 310 : after receiving the 4xx Auth_Challenge message, the P-CSCF determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism of the user is the HTTP DIGEST; therefore the P-CSCF needs not establish a security association with the UE. The P-CSCF sends the 4xx Auth_Challenge message without the Security-Server header to the UE. 
         [0213]    Block s 311 : after receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter indicates that the authentication mechanism of the user is the HTTP DIGEST, therefore the UE needs not establish the security association with the P-CSCF; and the UE sends a Register message carrying a response (RES) to the P-CSCF again. 
         [0214]    Block s 312 : The P-CSCF forwards the Register message carrying the RES to the I-CSCF. 
         [0215]    Block s 313 : The I-CSCF sends a Cx-Query message to the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The HSS returns the S-CSCF name which was previously selected in block s 303  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0216]    Block s 314 : The I-CSCF forwards the Register message to the S-CSCF determined in the Block s 313 . 
         [0217]    The S-CSCF compares the XRES obtained from the HSS with the RES sent by the UE; if the XRES obtained from the HSS is consistent with the RES sent by the UE, it means that the authentication succeeds; otherwise, it means that the authentication is failed. 
         [0218]    Block s 315 : The S-CSCF sends a Cx-Put message to the HSS to update the S-CSCF indication information in the HSS and notify the HSS that it has been assigned to serve this user. 
         [0219]    Block s 316 : The S-CSCF downloads the user profile from the HSS through a Cx-Pull message. 
         [0220]    Block s 317 : The S-CSCF sends a 200 message indicating that the authentication succeeds to the I-CSCF, or a 403 Forbidden message indicating that the authentication is failed to the I-CSCF. For illustrative purpose, only the 200 message sent when the authentication succeeds is shown in  FIG. 8 . 
         [0221]    Block s 318 : The I-CSCF forwards the 200 message or 403 Forbidden message to the P-CSCF. 
         [0222]    Block s 319 : The P-CSCF forwards the 200 message or 403 Forbidden message to the UE. 
         [0223]    In accordance with the first to the fifth embodiments, the authentication data pre-stored in the UPSF or the HSS is configured as the HTTP DIGEST or the IMS AKA authentication mechanism besides the IMS authentication bundled with NASS. 
         [0224]    The sixth embodiment, shown in  FIGS. 9   a  and  9   b , is in respect of the third embodiment. In the sixth embodiment, the HTTP DIGEST authentication mechanism is adopted after the IMS authentication bundled with NASS is failed. 
         [0225]    Referring to  FIGS. 9   a  and  9   b , the method of authentication in accordance with the sixth embodiment of the present invention includes: 
         [0226]    Block  601 : The UE sends a Register message carrying the access network identity and the association information to the P-CSCF. 
         [0227]    Block  602 : The P-CSCF locates the CLF according to the access network identity in the Register message and the pre-set corresponding relationship between the CLF and the access network identity. 
         [0228]    Block  603 : The P-CSCF queries the CLF located in block  602  about the NASS attachment information of the UE in the access layer according to the association information in the Register message. The CLF pre-stores the data record of the NASS attachment information corresponding to the association information, wherein the NASS attachment information includes IP address information, location information, etc., but no bundled indication in the related art. If there is no data record corresponding to the association information, the CLF returns a query failure message to the P-CSCF. 
         [0229]    Block  604 : The P-CSCF sends to the I-CSCF the Register message carrying the query result in block  603  and the source IP address of the Register message received by the P-CSCF; if the query in block  603  succeeds, the P-CSCF sends the NASS attachment information queried to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0230]    Block  605 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to search the user profile in the UPSF or the HSS to determine the S-CSCF for processing the Register message. 
         [0231]    Block  606 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF determined in the Block  605 . If the query succeeds, the query result is the NASS attachment information queried; otherwise, the query result is the query failure message reported. 
         [0232]    Block  607 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0233]    Block  608 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0234]    Block  609 : The UPSF or the HSS checks the user profile and finds out that the authentication data is configured as the NBA and the HTTP DIGEST authentication mechanisms. 
         [0235]    Block  610 : The UPSF or the HSS sends an AV-Req-Resp message to the S-CSCF to send the authentication data of the user to the S-CSCF. 
         [0236]    Block  611 : The S-CSCF stores all the authentication mechanisms and authentication data corresponding to the authentication mechanisms. If the query result is the NASS attachment information, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  612 , i.e., send an authentication success message to the UE. If the source IP address of the Register message received by the P-CSCF is not consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication is failed, proceed to Block  621 , i.e., authenticate the user by the HTTP DIGEST authentication mechanism. 
         [0237]    If the above query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  621 , i.e., authenticate the user by the HTTP DIGEST authentication mechanism. 
         [0238]    Block  612 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0239]    Block  613 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0240]    Block  614 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF to indicate that the authentication succeeds. 
         [0241]    Block  615 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0242]    Block  616 : after receiving the 2xx Auth_OK message, the P-CSCF determines that it did not receive a 4xx Auth_Challenge message before, therefore the P-CSCF needs not establish the security association with the UE; the P-CSCF forwards the 2xx Auth_OK message to the UE; and after receiving the 2xx Auth_OK message, the UE determines that it did not receive the 4xx Auth_Challenge before, so the UE needs not establish the security association with the P-CSCF. 
         [0243]    Block  621 , as shown in  FIG. 9   b : since the S-CSCF has stored authentication data obtained from the UPSF or the HSS in the Block  611  corresponding to the HTTP DIGEST authentication mechanism, the S-CSCF sends a 4xx Auth_Challenge message including authentication information of the HTTP DIGEST to the I-CSCF. 
         [0244]    Block  622 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0245]    Block  623 : after receiving the 4xx Auth_Challenge message, the P-CSCF determines that an “algorithm” parameter in a WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism is the HTTP DIGEST, therefore the P-CSCF need not establish a security association with the UE; the P-CSCF sends the 4xx Auth_Challenge message without the Security-Server header to the UE. 
         [0246]    Block  624 : after receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter indicates that the authentication mechanism is the HTTP DIGEST, therefore the UE needs not establish the security association with the P-CSCF; and the UE sends a Register message carrying a authentication parameter to the P-CSCF again. 
         [0247]    Block  625 : The P-CSCF forwards the Register message carrying the authentication parameter to the I-CSCF. 
         [0248]    Block  626 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  603  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0249]    Block  627 : The I-CSCF forwards the Register message to the S-CSCF determined in the Block  626 . 
         [0250]    The S-CSCF compares the authentication parameter obtained from the UPSF or the HSS with the authentication parameter sent by the UE; if the authentication parameter obtained from the UPSF or the HSS is consistent with the authentication parameter sent by the UE, it means that the authentication succeeds; otherwise, it means that the authentication is failed. 
         [0251]    Block  628 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0252]    Block  629 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0253]    Block  630 : The S-CSCF sends a 200 message indicating that the authentication succeeds to the I-CSCF, or a 403 Forbidden message indicating that the authentication is failed to the I-CSCF. For illustrative purpose, only the 200 message sent when the authentication succeeds is shown in  FIG. 9   b.    
         [0254]    Block  631 : The I-CSCF forwards the 200 message or 403 Forbidden message to the P-CSCF. 
         [0255]    Block  632 : The P-CSCF forwards the 200 message or 403 Forbidden message to the UE. 
         [0256]    In respect of the fourth or the fifth embodiment, the sixth embodiment may be modified according to the differences between the fourth or the fifth embodiment and the third embodiment, which will not be repeated herein. 
         [0257]    The seventh embodiment, as shown in  FIGS. 10   a  and  10   b , in which the IMS AKA authentication mechanism is adopted after the IMS authentication bundled with NASS mechanism is failed. 
         [0258]    Referring to  FIGS. 10   a  and  10   b , the method of the seventh embodiment in accordance with the present invention includes: 
         [0259]    Block  701 : The UE sends a Register message carrying the access network identity and the association information to the P-CSCF. 
         [0260]    Block  702 : The P-CSCF locates the CLF according to the access network identity in the Register message and the pre-set corresponding relationship between the CLF and the access network identity. 
         [0261]    Block  703 : The P-CSCF queries the CLF located in block  702  about the NASS attachment information of the UE in the access layer according to the association information in the Register message. The CLF pre-stores the data record of the NASS attachment information corresponding to the association information, wherein the NASS attachment information includes IP address information, location information, etc., but no bundled indication in the related art. If there is no data record corresponding to the association information, the CLF returns a query failure message to the P-CSCF. 
         [0262]    Block  704 : The P-CSCF sends to the I-CSCF the Register message carrying the query result in block  703  and the source IP address of the Register message received by the P-CSCF; if the query in block  703  succeeds, the P-CSCF sends the NASS attachment information to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0263]    Block  705 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to search the user profile in the UPSF or the HSS to select the S-CSCF for processing the Register message. 
         [0264]    Block  706 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF selected in the Block  705 . If the query succeeds, the query result is the NASS attachment information; otherwise, the query result is the query failure message reported. 
         [0265]    Block  707 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0266]    Block  708 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0267]    Block  709 : The UPSF or the HSS detects that authentication data is configured as the NBA and the IMS AKA authentication mechanism. 
         [0268]    Block  710 : The UPSF or the HSS sends an AV-Req-Resp message to the S-CSCF to send the authentication data of the user to the S-CSCF. 
         [0269]    Block  711 : The S-CSCF stores all the authentication mechanisms and authentication data corresponding to the authentication mechanisms. If the query result is the NASS attachment information, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  712 , i.e., send an authentication success message to the UE. If the source IP address of the Register message received by the P-CSCF is not consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication is failed, proceed to Block  721 , i.e., authenticate the user by the IMS AKA authentication mechanism. 
         [0270]    If the above query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  721 , i.e., authenticate the user by the IMS AKA authentication mechanism. 
         [0271]    Block  712 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0272]    Block  713 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0273]    Block  714 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0274]    Block  715 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0275]    Block  716 : after receiving the 2xx Auth_OK message, the P-CSCF determines that it did not receive a 4xx Auth_Challenge message before, therefore the P-CSCF needs not establish the security association with the UE; the P-CSCF forwards the 2xx Auth_OK message to the UE; and after receiving the 2xx Auth_OK message, the UE determines that it did not receive the 4xx Auth_Challenge message before, therefore the UE needs not establish the security association with the P-CSCF. 
         [0276]    Block  721 , as shown in  FIG. 10   b : since the S-CSCF has stored the authentication data obtained from the UPSF or the HSS in the Block  711  corresponding to the IMS AKA authentication mechanism, the S-CSCF sends the 4xx Auth_Challenge message carrying authentication information of the IMS AKA authentication mechanism to the I-CSCF. 
         [0277]    Block  722 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0278]    Block  723 : after receiving the 4xx Auth_Challenge message, the P-CSCF determines that an “algorithm” parameter in a WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism is the IMS AKA, therefore the P-CSCF needs not establish a security association with the UE; the P-CSCF forwards the 4xx Auth_Challenge message to the UE. 
         [0279]    Block  724 : after receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism is the IMS AKA, therefore the UE needs not establish the security association with the P-CSCF; the UE sends a Register message carrying the authentication parameter to the P-CSCF again. 
         [0280]    Block  725 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0281]    Block  726 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  703  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0282]    Block  727 : The I-CSCF forwards the Register message to the S-CSCF determined in the Block  726 . 
         [0283]    The S-CSCF compares the authentication parameter obtained from the UPSF or the HSS with the authentication parameter sent by the UE; if the authentication parameter obtained from the UPSF or the HSS is consistent with the authentication parameter sent by the UE, it means that the authentication succeeds; otherwise, it means that the authentication is failed. 
         [0284]    Block  728 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the HSS that it has been assigned to serve this user. 
         [0285]    Block  729 : The S-CSCF downloads the user profile from the HSS through a Cx-Pull message. 
         [0286]    Block  730 : if the authentication succeeds, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the registration succeeds, wherein 2xx indicates that the message is success relevant, and xx is a number within 00˜99; if the authentication is failed, the S-CSCF sends a authentication failure message to the I-CSCF. 
         [0287]    Block  731 : The I-CSCF forwards the 2xx Auth_OK message or authentication failure message to the P-CSCF. 
         [0288]    Block  732 : The P-CSCF forwards the 2xx Auth_OK message or authentication failure message to the UE. 
         [0289]    In respect of the fourth or the fifth embodiment, the method of the seventh embodiment may be modified correspondingly according to the difference between the fourth embodiment and the third embodiment, or the difference between the fifth embodiment and the third embodiment, which will not be repeated herein. 
         [0290]    The eighth embodiment, as shown in  FIGS. 11   a  and  11   b , is in respect of the first embodiment. In the eighth embodiment, the HTTP DIGEST authentication mechanism is adopted after the IMS authentication bundled with NASS is failed. 
         [0291]    Referring to  FIGS. 11   a  and  11   b , the method of the eighth embodiment includes: 
         [0292]    Block  801 : The UE sends a Register message to the P-CSCF. 
         [0293]    Block  802 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0294]    Block  803 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to search the user profile in the UPSF or the HSS to select the S-CSCF for processing the Register message. 
         [0295]    Block  804 : The I-CSCF forwards the Register message of the UE to the S-CSCF selected in the Block  803 . 
         [0296]    Block  805 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0297]    Block  806 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0298]    Block  807 : The UPSF or the HSS detects that the authentication data is configured as the NBA and the HTTP DIGEST authentication mechanisms. 
         [0299]    Block  808 : The UPSF or the HSS sends an AV-Req-Resp message to send the authentication data of the user to the S-CSCF. The authentication data includes at least the IMS authentication bundled with NASS mechanism and the authentication data corresponding to the IMS authentication bundled with NASS mechanism, the HTTP DIGEST authentication mechanism and the authentication data corresponding to the HTTP DIGEST authentication mechanism. 
         [0300]    Block  809 : The S-CSCF stores all the authentication mechanisms and the authentication data corresponding to the authentication mechanisms. The default authentication mechanism is the IMS authentication bundled with NASS, and the HTTP DIGEST is used after the default authentication mechanism is failed. The S-CSCF sends a 4xx Auth_Challenge message to the I-CSCF, wherein the authentication header filed of the 4xx Auth_Challenge message indicates that the authentication mechanism is IMS authentication bundled with NASS, i.e., carries an indication of the authentication mechanism. 
         [0301]    Block  810 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0302]    Block  811 : after receiving the 4xx Auth_Challenge message, the P-CSCF determines that an “algorithm” parameter in a WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism of the user is the IMS authentication bundled with NASS. Therefore, the P-CSCF needs not establish a security association with the UE; the P-CSCF forwards the 4xx Auth_Challenge message carrying the bundled indication but no Security-Server header to the UE. 
         [0303]    Block  812 : after receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism of the user is IMS authentication bundled with NASS. Therefore, the UE needs not establish the security association with the P-CSCF; and sends to the P-CSCF another Register message carrying an access network identity and the association information. 
         [0304]    Block  813 : The P-CSCF locates the CLF according to the access network identity in the Register message and the pre-set corresponding relationship between the CLF and the access network identity. 
         [0305]    Block  814 : The P-CSCF queries the CLF located in block  813  about the NASS attachment information of the UE in the access layer according to the association information in the Register message. Different from the related art, the CLF pre-stores data record of the NASS attachment information corresponding to the association information, wherein the NASS attachment information includes IP address information, location information, etc., but no bundled indication in the related art. If there is no data record corresponding to the association information, the CLF returns a query failure message to the P-CSCF. 
         [0306]    Block  815 : The P-CSCF sends to the I-CSCF the Register message carrying the query result in block  814  and the source IP address of the Register message received by the P-CSCF; if the query in block  814  succeeds, the P-CSCF sends the NASS attachment information to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0307]    Block  816 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  703  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0308]    Block  817 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF determined in the Block  816 . If the query succeeds, the query result is the NASS attachment information; otherwise, the query result is the query failure message reported. 
         [0309]    Block  818 : if the query result is the NASS attachment information, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  819 , i.e., send an authentication success message to the UE; otherwise, it means that the authentication is failed, proceed to Block  831 , i.e., send an authentication failure message to the UE. 
         [0310]    If the query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  831 , i.e., send the authentication failure message to the UE. 
         [0311]    Block  819 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0312]    Block  820 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0313]    Block  821 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0314]    Block  822 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0315]    Block  823 : The P-CSCF forwards the 2xx Auth_OK message to the UE. 
         [0316]    Block  831 , as shown in  FIG. 11   b : since the S-CSCF has stored the authentication data obtained from the UPSF or the HSS in the Block  809  corresponding to the HTTP DIGEST authentication mechanism, the S-CSCF sends the 4xx Auth_Challenge message carrying the HTTP DIGEST authentication information to the I-CSCF. 
         [0317]    Block  832 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0318]    Block  833 : after receiving the 4xx Auth_Challenge message, the P-CSCF determines that the “algorithm” parameter in a WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism is the HTTP DIGEST, therefore the P-CSCF needs not establish the security association with the UE; and the P-CSCF sends the 4xx Auth_Challenge message without the Security-Server header to the UE. 
         [0319]    Block  834 : after receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter indicates that the authentication mechanism is the HTTP DIGEST, therefore the UE needs not establish the security association with the P-CSCF; and the UE sends a Register message carrying an authentication parameter to the P-CSCF again. 
         [0320]    Block  835 : The P-CSCF forwards the Register message carrying the authentication parameter to the I-CSCF. 
         [0321]    Block  836 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  803  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0322]    Block  837 : The I-CSCF forwards the Register message to the S-CSCF determined in the Block  836 . 
         [0323]    The S-CSCF compares the authentication parameter obtained from the UPSF or the HSS with the authentication parameter sent by the UE; if the authentication parameter obtained from the UPSF or the HSS is consistent with the authentication parameter sent by the UE, it means that the authentication succeeds; otherwise, it means that the authentication is failed. 
         [0324]    Block  838 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0325]    Block  839 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0326]    Block  840 : The S-CSCF sends a 200 message indicating that the authentication succeeds to the I-CSCF, or a 403 Forbidden message indicating that the authentication is failed to the I-CSCF. For illustrative purpose, only the 200 message sent when the authentication succeeds is shown in  FIG. 10   b.    
         [0327]    Block  841 : The I-CSCF forwards the 200 message or 403 Forbidden message to the P-CSCF. 
         [0328]    Block  842 : The P-CSCF forwards the 200 message or 403 Forbidden message to the UE. 
         [0329]    In respect of the second embodiment, the method of the eighth embodiment may be modified correspondingly according to the difference between the second embodiment and the first embodiment, which will not be repeated herein. 
         [0330]    The ninth embodiment, as shown in  FIGS. 12   a  and  12   b , is in respect of the first embodiment. In the ninth embodiment, the IMS AKA authentication mechanism is adopted after the IMS authentication bundled with NASS is failed. 
         [0331]    Referring to  FIGS. 12   a  and  12   b , the method of the ninth embodiment includes: 
         [0332]    Block  901 : The UE sends a Register message to the P-CSCF. 
         [0333]    Block  902 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0334]    Block  903 : The I-CSCF interacts with the UPSF or the HSS through a Cx-Selection-Info message to select a corresponding S-CSCF, i.e., the I-CSCF sends a request to the UPSF or the HSS to search the user profile in the UPSF or the HSS to select which S-CSCF will process the Register message. 
         [0335]    Block  904 : The I-CSCF forwards the Register message of the UE to the S-CSCF selected in the Block  903 . 
         [0336]    Block  905 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0337]    Block  906 : The S-CSCF sends an AV-Req message to the UPSF or the HSS requesting the authentication data of the user. 
         [0338]    Block  907 : The UPSF or the HSS checks the user profile and determines that the authentication data is configured as the NBA and the IMS AKA authentication mechanisms. 
         [0339]    Block  908 : The UPSF or the HSS sends an AV-Req-Resp message to send the authentication data of the user to the S-CSCF. The authentication data includes at least the IMS authentication bundled with NASS mechanism and the authentication data corresponding to the IMS authentication bundled with NASS mechanism, the IMS AKA authentication mechanism and the authentication data corresponding to the IMS AKA authentication mechanism. 
         [0340]    Block  909 : The S-CSCF stores all the authentication mechanisms and the authentication data corresponding to the authentication mechanisms. The default authentication mechanism of the user is the IMS authentication bundled with NASS mechanism, after the default authentication mechanism is failed, the IMS AKA is used. The S-CSCF sends a 4xx Auth_Challenge message to the I-CSCF, wherein the authentication header filed of the 4xx Auth_Challenge message indicates that the authentication mechanism is the IMS authentication bundled with NASS, i.e., carries the indication of the authentication mechanism. 
         [0341]    Block  910 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0342]    Block  911 : after receiving the 4xx Auth_Challenge, the P-CSCF determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge indicates that the authentication mechanism of the user is IMS authentication bundled with NASS. Therefore, the P-CSCF needs not establish the security association with the UE, and forwards the 4xx Auth_Challenge message carrying the bundled indication but no Security-Server header to the UE. 
         [0343]    Block  912 : after receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism of the user is IMS authentication bundled with NASS. Therefore, the UE needs not establish the security association with the P-CSCF; and sends to the P-CSCF another Register message carrying the access network identity and the association information. 
         [0344]    Block  913 : The P-CSCF locates the CLF according to the access network identity in the Register message and the pre-set corresponding relationship between the CLF and the access network identity. 
         [0345]    Block  914 : The P-CSCF queries the CLF located in block  913  about the NASS attachment information of the UE in the access layer according to the association information in the Register message. Different from the related art, the CLF pre-stores data record of the NASS attachment information corresponding to the association information, wherein the NASS attachment information includes IP address information, location information, etc., but no bundled indication in the related art. If there is no data record corresponding to the association information, the CLF returns a query failure message to the P-CSCF. 
         [0346]    Block  915 : The P-CSCF sends to the I-CSCF the Register message carrying the query result in block  914  and the source IP address of the Register message received by the P-CSCF; if the query in block  914  succeeds, the P-CSCF sends the NASS attachment information to the I-CSCF; otherwise, the P-CSCF reports a query failure message to the I-CSCF. 
         [0347]    Block  916 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  903  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0348]    Block  917 : The I-CSCF forwards the Register message carrying the query result and the source IP address of the Register message received by the P-CSCF to the S-CSCF determined in the Block  916 . If the query succeeds, the query result is the NASS attachment information; otherwise, the query result is the query failure message reported. 
         [0349]    Block  918 : if the query result is the NASS attachment information, the S-CSCF compares the source IP address of the Register message received by the P-CSCF with the IP address in the NASS attachment information queried from the CLF. If the source IP address of the Register message received by the P-CSCF is consistent with the IP address in the NASS attachment information queried from the CLF, it means that the authentication succeeds, proceed to Block  919 , i.e., send an authentication success message to the UE; otherwise, it means that the authentication is failed, proceed to Block  931 , i.e., send an authentication failure message to the UE. 
         [0350]    If the query result is the query failure message reported, it also means that the authentication is failed, proceed to Block  931 , i.e., send the authentication failure message to the UE. 
         [0351]    Block  919 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the UPSF or the HSS that it has been assigned to serve this user. 
         [0352]    Block  920 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0353]    Block  921 : The S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the authentication succeeds. 
         [0354]    Block  922 : The I-CSCF forwards the 2xx Auth_OK message to the P-CSCF. 
         [0355]    Block  923 : The P-CSCF forwards the 2xx Auth_OK message to the UE. 
         [0356]    Block  931 , as shown in  FIG. 12   b , since the S-CSCF has stored the authentication data obtained from the UPSF or the HSS in the Block  909  corresponding to the IMS AKA authentication mechanism, the S-CSCF sends a 4xx Auth_Challenge message carrying the information related to the IMS AKA authentication to the I-CSCF. 
         [0357]    Block  932 : The I-CSCF forwards the 4xx Auth_Challenge message to the P-CSCF. 
         [0358]    Block  933 : after receiving the 4xx Auth_Challenge message, the P-CSCF determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism is the IMS AKA, therefore the P-CSCF need not establish a security association with the UE; the P-CSCF forwards the 4xx Auth_Challenge message to the UE. 
         [0359]    Block  934 : after receiving the 4xx Auth_Challenge message, the UE determines that the “algorithm” parameter in the WWW-Authenticate header of the 4xx Auth_Challenge message indicates that the authentication mechanism is the IMS AKA, therefore the UE need not establish the security association with the P-CSCF; the UE sends a Register message carrying the authentication parameter to the P-CSCF again. 
         [0360]    Block  935 : The P-CSCF forwards the Register message of the UE to the I-CSCF. 
         [0361]    Block  936 : The I-CSCF sends a Cx-Query message to the UPSF or the HSS to determine the S-CSCF for processing the Register message, i.e., the I-CSCF queries the UPSF or the HSS about the S-CSCF which has been assigned to serve this user. The UPSF or the HSS returns the S-CSCF name which was previously selected in block  903  to the I-CSCF according to the S-CSCF indication information stored in the HSS. 
         [0362]    Block  937 : The I-CSCF forwards the Register message to the S-CSCF determined in the Block  926 . 
         [0363]    The S-CSCF compares the authentication parameter obtained from the UPSF or the HSS with the authentication parameter sent by the UE; if the authentication parameter obtained from the UPSF or the HSS is consistent with the authentication parameter sent by the UE, it means that the authentication succeeds; otherwise, it means that the authentication is failed. 
         [0364]    Block  938 : The S-CSCF sends a Cx-Put message to the UPSF or the HSS to update the S-CSCF indication information in the UPSF or the HSS and notify the HSS that it has been assigned to serve this user. 
         [0365]    Block  939 : The S-CSCF downloads the user profile from the UPSF or the HSS through a Cx-Pull message. 
         [0366]    Block  940 : if the authentication succeeds, the S-CSCF sends a 2xx Auth_OK message to the I-CSCF indicating that the registration succeeds, wherein 2xx indicates that the message is success relevant, and xx is a number within 00-99; if the authentication is failed, the S-CSCF sends a authentication failure message to the I-CSCF. 
         [0367]    Block  941 : The I-CSCF forwards the 2xx Auth_OK message or authentication failure message to the P-CSCF. 
         [0368]    Block  942 : The P-CSCF forwards the 2xx Auth_OK message or authentication failure message to the UE. 
         [0369]    In respect of the second embodiment, the method of the ninth embodiment may be modified correspondingly according to the difference between the second embodiment and the first embodiment, which will not be repeated herein. 
         [0370]    The foregoing description is only the preferred embodiments of the present invention and is not for use in limiting the protection scope thereof. All the modifications, equivalent replacements or improvements in the scope of the sprit and principles of the present invention should be included in the protection scope of the present invention.