Virtual home network arrangement for a subscriber module using IMS
View Patent ↗Systems, methods, and computer-readable media for managing end-to-end security over an IP Multimedia Subsystem (IMS)-enabled network are provided. A first subscriber module accesses an IMS network via an access gateway as a roaming network. The roaming network routes a request for a session from the first subscriber module from its P-CSCF to the I-CSCF of a third-party home network. The third party home network, in turn, routes the request to an S-CSCF implemented at the subscriber's home network, which comprises a second subscriber module. In this way, the session between the two subscriber modules is managed by the subscriber's S-CSCF rather than by a carrier's IMS network, and the subscriber may administer the security relationship without reliance on the carrier or the third party.
1. A system comprising:
a first node being a first point of entry to a first network for a service request from a subscriber device, the first node having a published Internet Protocol (IP) address, the first node appearing to other networks to belong to an IP Multimedia Subsystem (IMS) network; and
a second node external to the first network, the second node to provide routing of the service request to an application server, an identifier of the second node being included in a subscriber profile associated with a subscriber identity, the subscriber profile stored in a database that is accessible by the first node, the subscriber identity being included in a registration request of the subscriber device, the registration request configured to identify the first network as the home IMS network of the subscriber device; and
a subscriber module that comprises the second node,
wherein the subscriber device and the subscriber module both belong to a subscriber network.
2. The system as recited in claim 1 , wherein the subscriber module is comprised in a messaging server.
3. The system as recited in claim 1 , wherein the subscriber device is comprised in a wireless mobile communication device.
4. The system as recited in claim 1 , wherein the database belongs to the first network.
5. The system as recited in claim 1 , further comprising:
a third node that belongs to the first network and is a proxy Session Initiation Protocol (SIP) server that routes registration requests.
6. The system as recited in claim 1 , in which the registration request reaches the first node by way of a third node, wherein the third node is a proxy Session Initiation Protocol (SIP) server of a visited network.
7. The system as recited in claim 1 , wherein the first node is comprised in an Interrogating Call Session Control Function (I-CSCF).
8. The system as recited in claim 1 , wherein the second node is comprised in a Serving Call Session Control Function (S-CSCF).
9. The system as recited in claim 1 , wherein the database is comprised in a Home Subscriber Server (HSS).
10. The system as recited in claim 1 , wherein the subscriber module comprises the application server.
11. A method to assist in providing authenticated end-to-end communications, the method comprising:
at a first node that is a first point of entry to a first network for a service request from a subscriber device, the first node having a published Internet Protocol (IP) address, the first node appearing to other networks to belong to an IP Multimedia Subsystem (IMS) network:
receiving, from a second node, a registration request generated by the subscriber device;
querying a database for a subscriber profile that is associated with a subscriber identity included in the registration request;
resolving an identifier included in the subscriber profile, the identifier identifying a third node that is external to the first network and that provides routing of the service request to an application server; and
routing the registration request from the first node to the third node according to the resolved identifier,
wherein the second node is a proxy Session Initiation Protocol (SIP) server that routes registration requests; and
wherein the subscriber device belongs to a subscriber domain and the third node is comprised in a subscriber module that belongs to the subscriber domain.
12. The method as recited in claim 11 , wherein the subscriber module is comprised in a messaging server.
13. The method as recited in claim 11 , wherein the subscriber device is comprised in a wireless mobile communication device.
14. The method as recited in claim 11 , wherein the database belongs to the first network.
15. The method as recited in claim 11 , wherein the second node belongs to the first network.
16. The method as recited in claim 11 , wherein the second node belongs to an IMS domain to which the first node does not belong and to which the third node does not belong.
17. A method for providing authenticated end-to-end communications, the method comprising:
at a first node belonging to a first network:
receiving from a second node belonging to a second network a registration request generated by a subscriber device, the registration request including a subscriber identity; and
handling the registration request,
wherein the second node is a first point of entry to the second network for a service request from the subscriber device, and the first node provides routing of the service request to an application server; and
wherein the subscriber device belongs to a subscriber domain and the first node is comprised in a subscriber module that belongs to the subscriber domain.
18. The method as recited in claim 17 , wherein handling the registration request comprises:
handling authentication of the subscriber device based, at least in part, on the subscriber identity.
19. The method as recited in claim 17 , wherein the subscriber module is comprised in a messaging server.
20. The method as recited in claim 17 , wherein the subscriber device is comprised in a wireless mobile communication device.