IMS AKA Session Registration Message Flows

IMS AKA Registration services include:

Registration of a new IMS AKA session

A successful IMS AKA Registration is accomplished by two SIP Register request messages sent to the subscriber's S-CSCF and two SIP Register response messages to the requesting subscriber. Information neccesary to perform an authentication and set up the two IPsec channels are provided in the SIP message headers. Some of the SIP message headers are specific for IMS.

IMS AKA Initial Registration
Figure F-27: >Message flow for Initial Registration (UDP or TCP).

The following list explains simplified the procedures for Initial Registration in the figure above.

  1. The UE builds an unauthenticated SIP Register request message.

  2. The SIP Register request message is sent to the P-CSCF’s unprotected server port.

  3. The SIP Register request message is passed to the UE’s home S-CSCF where the UE’s SIP identity is validated.

  4. The S-CSCF obtains the requesting subscriber's security information from the HSS.

  5. The S-CSCF sends a SIP 401 Authentication Required response message to the P-CSCF.
    The message contains encryption keys to be used by IPsec on the P-CSCF side.
    The message also contains authentication information to the UE.

  6. A modified SIP 401 response message is built by the P-CSCF without encryption keys but with a Security-Server header with IPsec information.

  7. The P-CSCF prepares the IPsec channels to enable reception of the authenticated SIP Register message.

  8. The modified SIP 401 response message is sent to the UE’s unprotected client port.

  9. The S-CSCF is authenticated by the UE and the encryption keys for the IPsec channels are calculated.
    The UE creates the IPsec channels and configures the related Security Associations.

  10. The UE builds an authenticated SIP Register request message.

  11. The UE sends the SIP Register request message to the P-CSCF’s protected server port.

  12. The SIP Register request message is passed to the S-CSCF where the UE is authenticated.
    A session is created and the HSS is updated. A SIP 200 OK response message is returned to the UE.

  13. The SIP 200 OK response message is sent to the UE’s protected client port if the TCP protocol is used.

  14. The SIP 200 OK response message is sent to the UE’s protected server port if the UDP protocol is used.

  15. The session is created.

To top of page

Re-Registration of an IMS AKA session

IMS AKA Re-Registration
Figure F-28: Message flow for Re-Registration (UDP or TCP).

The following list explains simplified the procedures for Re-Registration in the figure above. NB. This Re-Registration does not entail allocating a new  channel pair. If new channels have to be allocated, double channel pairs will have to be kept for a time-out period, until all messages using the old channels have been handled.

  1. The UE builds a SIP Register request message with authentication header and Expire time header time.

  2. The SIP Register request message is sent to the P-CSCF’s protected server port.

  3. The Re-Register request message is sent to the subscribers home S-CSCF.
    The S-CSCF extendeds the UE’s session and a new expire time is set.
    A SIP 200 OK response message with a new Expire time is returned to the UE.

  4. The SIP 200 response message is sent to the UE’s protected client port if the TCP protocol is used.

  5. The SIP 200 response message is sent to the UE’s protected server port if the UDP protocol is used.

  6. The UE updates the session expire time.

Re-Registration may include switch to new secure channels (not shown here).

To top of page

De-Registration of an IMS AKA session.

IMS AKA De-Registration
Figure F-29: Message flow for De-Registration during an ongoing session (UDP or TCP)

The following list explains simplified the procedures for De-Registration in the figure above.

  1. The UE builds a SIP Register request message with authentication header and Expire time set to zero.

  2. The SIP Register request message is sent to the P-CSCF’s protected server port.

  3. The De-Register request message is passed to the subscribers home S-CSCF.
    The S-CSCF closes the UE’s session.
    The HSS is updated about the closed session.
    A SIP 200 OK message is returned to the UE.

  4. The message is sent to the UE’s protected client port if the TCP protocol is used.

  5. The message is sent to the UE’s protected server port if the UDP protocol is used.

  6. The P-CSCF removes the Security Associations and closes the IPsec channels.

  7. The UE closes the session.

  8. The UE removes the Security Associations and closes the IPsec channels.

To top of page