IMS (IP Multimedia Subsystem) is a set of specifications to offer multimedia services through IP protocol. This makes it possible to incorporate all kinds of services, such as voice, multimedia and data, on an accessible platform through any Internet connection (fixed or mobile).
IMS's origin
Initially defined by 4G.IP (a set of companies belonging the telecommunications sector), it was 4G (3rd Generation Partnership Project) who definitively adopted the definition of IMS as a part of the standardization 4G system in networks UMTS (Universal Mobile Telecommunications System), specified in Release 5 and 6.
Architecture
It can be divided into three layers:
Application
Where there are AS (Application Servers), the MRF (Media Resource Function) and a HSS (Home Subscriber Server). The AS used the SIP(Session Initiation Protocol) for the signaling, used in establishing multimedia sessions, such as audio and video calls over Internet. The services offered by the telephony operators are hosted and run on AS. A HSS is similar devices to the HLR of GSM technology, where the user´s credentials are stored.
Control
Formed by different subsystems among which is IMS core.
Other important devices in this layer are the CSCF (Call Session Control Function), which includes three subsystems: P-CSCF (Proxy CSCF), S-CSCF (Serving CSCF) and I-CSCF (Interrogating CSCF). These subsystems are the responsible, basically, of: processing and routing the signaling; to control the resources of the transport subsystem, to register and authenticate users; provisioning IMS services by diverting signaling application servers in question and to generate billing records.
The MRF (Media Resources Function) provides functions related to media, such as the manipulation of the media and the reproduction of tones and announcements. Each MRF divides into a MRFC (Media Resources Function Controller) and a MRFP (Media Resources Function Processor). The MRFC is a signaling plane node that interprets the information coming from an AS and S-CSCF to control the MRFP. The MRFP is a node of the plane of the media, is used to mix the source or process media streams.
Transport
Composed by the UE (User Equipment), the access network, the NASS (Network Attachment Subsystem) and the RACS (Resource Admission Control Subsystem). The transport of network is performed using either IPv6 or IPv4, allowing QoS's implementation, integrated security, autoconfiguration…
Security
Having seen a little of what is IMS and the devices that act, we enter IMS specifications relating to security.
From the point of view of the standardization, only exists a mechanism of authentication and access control, specified in the TS 33.203 of 3GPP (Access Security for IP-Based Services) and commonly called AKA (Authentication and Key Agreement). However, there are many other mechanisms for authentication and access control, defined to meet the needs of inherited terminals and to enable faster deployment. The most common are: Early IMS 3GPP for mobile access. They are those that IMS deployments in advance for your time are not entirely compatible with the specifications so that the security mechanisms are not applicable. Examples include IPv4 based implementations as 2G devices. Digest authentication of TISPAN and Packet Cable. NASS-IMS authentication inseparable TISPAN for fixed networks. It is an authentication method in which it is intended to reuse the authentication layer in IMS network. It was developed by TISPAN for fixed networks in which the user terminal does not have an ISIM (IP Multimedia Services Identity Module). The security of this mechanism is practically the same as that of the access network. Digest Authentication with Packet Cable's TLS.
The existing variety of authentication mechanisms used in networks, causes problems related with the interoperability, the existence of networks with different security levels, the most adapted method selection during the client registration, etc. In this respect, 3GPP has developed the recommendation TR 33.803 to guide in selecting the most appropriate authentication method.