Multi-domain authentication for IMS services

This article proposes a novel unified IP Multimedia Subsystem (IMS) authentication architecture that extends the scope of IMS by allowing it to offer users different IMS-based services even beyond their own domain. The architecture reduces the burden of both end users and service providers by a Single Sign-On (SSO) feature. We describe how we have implemented our proposed authentication architecture for a tentative IMS service, Movie-on-Demand (MoD), by creating SIP proxies with additional SAML and HTTP message-handling intelligence and integrating them with an open-source implementation of a full IMS environment, from client to Application Server (AS). The relation between call setup time and network latency has been mathematically modelled. The developed mathematical model is validated by deploying a simplified implementation in the public Internet and observing call setup time and delay. The proposed architecture is further extended for a generalized scenario where the identity provider (IdP) could be managed by a third-party other than the IMS core operator. The authentication architecture proposed in this paper creates opportunities for operators to build partnerships with the service providers, and thus supports the emergence of new business models.