Source: {"pile_set_name": "USPTO Backgrounds"}

The Public Land Mobile Network (PLMN) defined by the 3rd Generation Partnership Project (3GPP) can be logically divided into two parts: a Core Network (CN) and an Access Network (AN). The CN can be subdivided into a Circuit Switched (CS) domain, a Packet Switched (PS) domain, and an IMS. In different CN, a user must use a different access mode.
(i) CS Domain and User Access
The CS domain provides CS services for users, including voice, CS data, and fax. Typical entities of the CS domain include: a Mobile Switching Center (MSC), adapted to handle call signaling and complete call routing; a Wireless Media Gateway (WMG), adapted to set up media connections and convert voice codes; a Visitor Location Register (VLR), adapted to store information about the current location of a user and the service data; a Home Location Register (HLR), adapted to store subscription data of a user and the information about the current serving VLR; an Equipment Identity Register (EIR), adapted to store user equipment identities; and an Authentication Center (AuC), adapted to generate authentication data.
To ensure the services in the CS domain to be accessible to users, the 3GPP protocol defines a mechanism for a mobile CS user to access a CN. Through this mechanism, the network can obtain the user location information and implement network access security protection.
The network needs to handle access requests when a mobile CS user powers on a Mobile Equipment (ME), roams to a new MSC/VLR service area, updates the location periodically, or invokes a service.
A network operator can decide to use or not to use certain access-related processes, for example, authentication process, encryption process, process of allocating a Temporary Mobile Subscriber Identity (TMSI), in different access operations according to specific policies.
A typical access process of a 3G CS user is shown in FIG. 1. A Mobile Equipment (ME) sends a location update request to the Radio Network Controller (RNC), and sends an authentication information request to the HLR/AUC through an MSC/VLR in turn; afterward, the HLR/AUC returns an authentication request message to the MSC/VLR, RNC and ME in turn.
The process for a CS user to access a network further includes a process of starting security protection.
The identities for use in an access process of a CS user include: Mobile Subscriber ISDN Number (MSISDN), International Mobile Subscriber Identity (IMSI), and TMSI. The composition of an IMSI is shown in FIG. 2. An IMSI uniquely identifies a user in a global mobile network, and is bound to the MSISDN of the user at the time of subscription.
As shown in FIG. 2, an IMSI consists of three parts: Mobile Country Code (MCC), Mobile Network Code (MNC), and Mobile Subscriber Identification Number (MSIN). The MCC is promulgated by the ITU-T and applied globally. An MNC is allocated by the country that governs the MCC according to the actual conditions, and is expressed by two or three digits. An MSIN is allocated by an operator who holds the MCC and MNC. A National Mobile Subscriber Identity (NMSI) is expressed as “MNC+MSIN”.
As shown in FIG. 3, an MSISDN is allocated according to the ITU E.164 numbering plan and E.213 specifications, and consists of three parts: Country Code (CC), National Destination Code (NDC), and Mobile Subscriber Identification Number (MSIN). A CC is an international toll area code, and is promulgated by the ITU-T and applied globally. An NDC is defined by the country that governs the CC and allocated according to the conditions of the country. A mobile operator may have more than one NDC, for example, 135-139 held by China Mobile, and 130-134 held by China Unicom. A national number is defined by the operator holding “CC+NDC”. A national number is expressed as “NDC+SN”.
An MSISDN should be able to serve as a Global Title (GT) of the Signaling Connection Control Part (SCCP) to locate the HLR of the user. In the addressing process, the HLR that serves the user can be located according to the “CC+NDC” of the number, or optionally, plus part of the Subscriber Number (SN). The identity of the HLR related to user registration may be an HLR number compliant with the E.164 specifications, or an HLR ID. The format of an HLR number is the same as that of an MSISDN. An HLR ID consists of several parts of an IMSI, namely, the first few digits of “MCC+MNC+MSIN”.
The TMSI is a locally effective identity in the MSC/VLR service area. It is used with a Location Area Identity (LAI). Therefore, the network operator can stipulate that a TMSI should be reallocated for every access. To prevent an eavesdropper from determining the user location through a unique ID, the GSM/WCDMA network generally allocates a TMSI to the user who accesses an MSC/VLR service area initially.
The CS user who accesses the network should be authenticated. The authentication process includes: obtaining an authentication vector (AV) through the MSC/VLR (MSC is combined with VLR), and performing bidirectional authentication with the user.
The process for an MSC/VLR to obtain an AV includes: when an MSC/VLR of the CN receives a user location update request for access, if the MSC/VLR determines that the user needs authentication, the MSC/VLR requests an AV from the HLR/AUC (HLR is combined with AUC). The AUC generates several groups of AVs arranged sequentially according to the IMSI of the user. An AV includes five elements (RAND, AUTN, CK, IK, RES). The HLR returns all the generated AVs to the MSC/VLR through a response.
After obtaining an AV, the MSC/VLR performs a bidirectional authentication process with the user, including: after receiving the AV groups, the MSC/VLR selects an intact AV, removes the response (RES), and sends it to the RNC to require initiation of authentication. The RNC removes the cipher key (CK) and the integrity key (IK) of the remaining AVs, and sends an authentication request to the ME (USIM). The USIM in the ME can calculate out the CK, IK and RES in the AV group by using different algorithms shared with the network according to the key (K) which is allocated at the time of subscription and shared in the AUC of the network as well as the received random number (RAND). According to the RAND, authentication token (AUTN) and the shared key (K), the ME calculates out the MAC, and compares the value with the MAC value received from the AUTN. If the two values are the same, the ME returns the calculated RES to the MSC/VLR. The MSC/VLR compares the value with the RES stored in the AV, and, if the two values are the same, determines that the ME passes the authentication and is legal.
In a GSM system, the access process of a GSM user is similar to that of a CS user in a 3G system such as CDMA system. As shown in FIG. 4, the differences between the access process of a GSM user and that of a 3G CS user include:
The GSM system has no ME for network authentication, so the AV contains no AUTN parameter;
The GSM system has no data integrity protection, so the AV contains no IK parameter; and
A cipher key (Kc) of the GSM system contains only 64 digits while a CK used in the 3G system contains 128 digits, and the encryption algorithm applied in the 3G system is more intense.
The signed response (SRES) of a GSM system differs from the RES of a 3G system in algorithm and length.
The access process of a 3G and 2G CS user described above reveals that a security mechanism is set for the mobile CS domain to provide security assurance to some extent. The security mechanism of a 3G user is an enhancement of the GSM user security mechanism. That is, the 3G security mechanism is a smooth evolution from the 2G security mechanism.
The foregoing is an access process of the CS network and CS user. The following describes an access process of the IMS network and IMS user.
The IMS is a subsystem that is overlaid on the existing PS domain and supports IP multimedia services. It is intended to provide rich multimedia services such as audio, video, text, interactive session, or combination thereof. The IMS uses the Session Initiation Protocol (SIP), and is independent of access.
As shown in FIG. 5, the function entities in an IMS include: a Call Session Control Function (CSCF) entity that controls user registration and session, an Application Server (AS) that provides various service logic control functions, and a Home Subscriber Server (HSS) that manages subscription data altogether. A user accesses the IMS through the Proxy-CSCF (P-CSCF) of a current visited location. The Serving-CSCF (S-CSCF) in the home domain controls triggering of sessions and services and interacts with the AS about service control.
In an IMS network, each user who subscribes to the IMS service owns one or more private user identities allocated by the