Method and system to authenticate multiple IMS identities

Patent metadata

Field	Value
Publication number	US-9913236-B2
Application number	US-201615247065-A
Country	US
Kind code	B2
Filing date	Aug 25, 2016
Priority date	Jun 30, 2015
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

A method and UE for registering with a third network node using IMS, the method creating a tunnel; authenticating a first public identity associated with the UE to the first network node; receiving configuration information with a second private identifier and a second public user identifier, and registering with a third network node using the second private identifier and the second public user identifier. Further, a method and first network node configured for authentication between a UE and a third network node using IMS, the method establishing a tunnel; authenticating a first public identity of the UE; receiving a configuration information message from the UE including a network identifier for a network the UE is registered on; obtaining, from a second network node, a second private identifier and second public user identifier; and providing the second private identifier and second public user identifier to the UE.

First claim

The invention claimed is:

1. A method at a user equipment for registering with a third network node using an internet protocol (IP) multimedia subsystem (IMS), the method comprising:
creating a tunnel between the user equipment and a first network node;
sending a first public identity associated with the user equipment to the first network node;
receiving configuration information from the first network node with a second private user identifier and a second public user identifier, the second private user identifier and second public user identifier being associated with a second network node;
registering with a third network node using the second private user identifier and the second public user identifier;
wherein the configuration information is divided into validity areas,
wherein the validity area is defined based on a Public Land Mobile Network (PLMN) identity or a geographic bounding area the user equipment falls within, and
wherein the user equipment uses the second private user identifier and second public user identifier based on the location of the user equipment.

2. The method of claim 1 , wherein a certificate is provided in the tunnel.

3. The method of claim 2 , wherein the certificate is created based on an identifier at the user equipment.

4. The method of claim 3 , wherein the identifier is one of a device identifier or a private user identifier.

5. The method of claim 4 , wherein the identifier is stored on a universal integrated circuit card on the user equipment.

6. The method of claim 4 , wherein the identifier is stored in a mobile equipment (ME) of the user equipment.

7. The method of claim 1 , wherein the creating uses a certificate requested by the user equipment.

8. The method of claim 1 , wherein the authenticating provides from the user equipment to the first network node at least one of a device identifier or a network the UE is registered on.

9. The method of claim 1 , wherein the receiving configuration information is subsequent to providing a configuration request to the first network node, including a network identifier that the user equipment is registered on.

10. The method of claim 1 , wherein the registering includes receiving challenge vectors for the second private user identifier and second public user identifier.

11. A user equipment configured for registering with a third network node using an internet protocol (IP) multimedia subsystem (IMS), the user equipment comprising:
a processor; and
a communications subsystem,

wherein the user equipment is configured to:
create a tunnel between the user equipment and a first network node;
send a first public identity associated with the user equipment to the first network node;
receive configuration information from the first network node with a second private user identifier and a second public user identifier, the second private user identifier and second public user identifier being associated with a second network node;
register with a third network node using the second private user identifier and the second public user identifier;
wherein the configuration information is divided into validity areas,
wherein the validity area is defined based on a Public Land Mobile Network (PLMN) identity or a geographic bounding area the user equipment falls within, and

wherein the user equipment uses the second private user identifier and second public user identifier based on the location of the user equipment.

12. A method at first network node configured for authentication between a user equipment and a third network node using an internet protocol (IP) multimedia subsystem (IMS), the method comprising:
establishing a tunnel with the user equipment;
sending a first public identity of the user equipment at first network node;
receiving a configuration information message from the user equipment, the configuration information message including a network identifier for a network the user equipment is registered on;
obtaining, from a second network node, a second private user identifier and second public user identifier;
providing configuration information with the second private user identifier and second public user identifier to the user equipment;
wherein the configuration information is divided into validity areas,
wherein the validity area is defined based on a Public Land Mobile Network (PLMN) identity or a geographic bounding area the user equipment falls within, and
wherein the user equipment uses the second private user identifier and second public user identifier based on the location of the user equipment.

13. The method of claim 12 , wherein the establishing uses a certificate requested by the user equipment.

14. The method of claim 13 , wherein the certificate is created based on an identifier at the user equipment.

15. The method of claim 14 , wherein the identifier is one of a device identifier or a private user identifier from a universal integrated circuit card on the user equipment.

16. The method of claim 14 , wherein the identifier is stored in a mobile equipment (ME) of the user equipment.

17. The method of claim 12 , wherein the authenticating includes receiving from the user equipment at the first network node at least one of a device identifier or a network the UE is registered on.

18. A first network node configured for authentication between a user equipment and a third network node using an internet protocol (IP) multimedia subsystem (IMS) the first network node comprising:
a processor; and
a communications subsystem,

wherein the first network node is configured to:
establish a tunnel with the user equipment;
send a first public identity of the user equipment at first network node;
receive a configuration information message from the user equipment, the configuration information message including a network identifier for a network the user equipment is registered on;
obtain, from a second network node, a second private user identifier and second public user identifier;
provide configuration information with the second private user identifier and second public user identifier to the user equipment;
wherein the configuration information is divided into validity areas,
wherein the validity area is defined based on a Public Land Mobile Network (PLMN) identity or a geographic bounding area the user equipment falls within, and
wherein the user equipment uses the second private user identifier and second public user identifier based on the location of the user equipment.

Assignees

• Blackberry Ltd

Inventors

• Allen Andrew Michael
• Buckley Adrian
• Buckley Michael Eoin

Classifications

• H04W76/40

  for selective distribution or broadcast · CPC title

• H04W4/10

  Push-to-Talk [PTT] or Push-On-Call services · CPC title

• H04W76/12

  Setup of transport tunnels · CPC title

• H04M17/103

  using SIMs (USIMs) or calling cards · CPC title

• H04W76/10

  Connection setup · CPC title