IMS Authentication Algorithm Selection for Mixed Terminal Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing internet protocol multimedia subsystem (IMS) authentication methods face challenges in authenticating terminal devices that support different security algorithms, such as MD5, SHA256, and SHA512, leading to inconsistent authentication processes.
Innovation Solution
A method and apparatus that enable terminal devices to indicate their supported security algorithms, allowing the authentication process to adapt by using either the indicated algorithm or defaulting to MD5 for devices not supporting new algorithms, ensuring consistent authentication across devices with varying capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If terminal devices support multiple security algorithms (MD5, SHA256, SHA512), then authentication security is improved, but authentication process complexity increases
Solution Approach 1:
The patent changes the parameter of security algorithm selection dynamically based on device capabilities. The network element determines which algorithm (MD5, SHA256, or SHA512) to use by first assessing the terminal device's supported algorithms, then selecting an appropriate algorithm for authentication. This resolves the contradiction by adapting the security parameter to the device's capability level.
Solution Approach 2:
The patent implements a feedback mechanism where the terminal device indicates its supported security algorithms in the registration request, and the network element uses this feedback information to determine the authentication algorithm. This feedback loop ensures that the authentication process matches the device's capabilities, reducing complexity while maintaining security.
2Adaptability or versatility
If the network element supports multiple security algorithms, then adaptability to different devices is improved, but network element processing complexity increases
Solution Approach 1:
The patent applies preliminary action by having the terminal device indicate its supported security algorithms in advance during the registration request phase. The network element uses this pre-provided information to determine the authentication algorithm before the actual authentication process, avoiding the need for the network element to guess or try multiple algorithms.
Solution Approach 2:
The patent uses the registration request message as an intermediary carrier that conveys the terminal device's algorithm capability information to the network element. This intermediary mechanism simplifies the interaction by establishing the algorithm selection criteria before the authentication process begins.
3Reliability
If terminal devices use stronger security algorithms (SHA256/SHA512), then authentication security is improved, but compatibility with older devices decreases
Solution Approach 1:
The patent makes the security algorithm selection dynamic rather than fixed. The system automatically adjusts the algorithm choice based on the terminal device's capabilities, using stronger algorithms (SHA256/SHA512) when available and falling back to MD5 for older devices. This dynamic adaptation resolves the contradiction between security and compatibility.
Solution Approach 2:
The patent implements universality by designing the authentication system to support multiple security algorithms simultaneously. The network element can handle authentication using MD5, SHA256, or SHA512 depending on the terminal device's capabilities, making the system universally compatible with both old and new devices while maintaining high security when possible.
Data Source
AI summary
Authentication methods and communication apparatuses are provided. In an implementation, an authentication method includes: receiving an authentication vector request message from a serving call session control function network element, calculating a first hash value of a security parameter based on a first security algorithm, calculating a second hash value of the security parameter based on a second security algorithm, and sending an authentication vector request response to the serving call session control function network element, wherein the authentication vector request response comprises the first hash value and the second hash value.