WO2008089694A1

WO2008089694A1 - A method, a system and an equipment for obtaining the media stream protecting key in ims network

Info

Publication number: WO2008089694A1
Application number: PCT/CN2008/070138
Authority: WO
Inventors: Chengdong He; Jun Yan; Zhanjun Zhang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-01-19
Filing date: 2008-01-18
Publication date: 2008-07-31
Also published as: CN101227272A

Abstract

A method, a system and an equipment for obtaining the media stream protecting key in IMS network is provided, said method includes the following steps: a calling terminal equipment (UE) sends a session request message to a network entity, the network entity adds the key to said session request message and send the message to the called UE (101); the called UE sends the response message to the network entity, the network entity adds the key to said response message and send the message to the calling UE (102). Said method also can be that: the network entity receives the session massage, and obtains the key from the key managing function entity, then the network entity respectively sends the obtained key to the terminal equipment (UE) and the media processing function entity (MP).

Description

Method, system and device for acquiring media stream protection key in IMS network

The present invention relates to media stream encryption techniques, and more particularly to a method, system and apparatus for obtaining a media stream protection key in an IMS network. Background of the invention

The IP Multimedia Service Subsystem (IMS) is the core session control layer for fixed and mobile networks. It is one of the focuses of the development of the communications field and is already in the 3GPP, The Third Generation Partnership Project. IMS-related specifications such as network architecture, interfaces, protocols, etc. are defined in the Telecommunications and Internet Converged Services and Protocols for Advanced Networking (TISPAN).

Among them, security issues are an important aspect of 3GPP and TISPAN specifications. In order to ensure security, the IMS network is divided into an access domain and a network domain, and security specifications of the access domain and the network domain are respectively defined.

However, the current security specifications are for the control plane in the IMS network, that is, how to ensure the security of the session protocol in the IMS network, and the media stream itself is transmitted in plaintext. In this case, the user may be eavesdropped, tampered, etc. during the call, and the user's call security cannot be guaranteed. Summary of the invention

In view of this, an embodiment of the present invention provides a method for acquiring a media stream protection key in an IMS network, where a calling terminal device (UE) and a called UE can obtain a key from a network side, The media stream transmitted by the user to the user can be protected.

For the first object of the present invention, the technical solution proposed by the embodiment of the present invention is: a. The calling terminal device UE sends a session request message to the network entity, and the network entity adds the key to the session request message, and sends the message to the session request message. Called UE;

b. The called UE returns a response message to the network entity, and the network entity adds the key to the response message and sends the key to the calling UE.

The embodiment of the invention provides a system for acquiring a media stream protection key in an IMS network. The calling UE and the called UE can obtain a key from the network side, so as to protect the media stream transmitted by the user to the user.

For the second object of the present invention, the technical solution provided by the embodiment of the present invention is: a system for acquiring a media stream protection key in an IMS network, where the system includes: a terminal device UE, when used as a calling UE, Sending a session request message to the network entity, and receiving the session response message carrying the key; when receiving the session request message, receiving the session request message sent from the network entity, and returning the session response message;

a network entity, configured to: when receiving a session request message sent by the calling UE, add a key to the session request message, and send the key to the called UE; and further, receive the session response message sent by the called UE, and The key is added to the session response message and sent to the calling UE.

The embodiment of the invention further provides a network entity that obtains a media stream protection key in an IMS network, and can provide a key for the calling UE and the called UE.

For the third object of the present invention, the technical solution provided by the embodiment of the present invention is: A network entity that provides a media stream protection key to a terminal device UE in an IMS network, where the network entity includes:

a receiving unit, configured to receive a session request message sent by the calling UE, and receive a session response message sent by the called UE;

The key obtaining unit, when receiving the session request message sent by the calling UE, Adding to the session request message, and sending it to the called UE through the sending unit; when receiving the session response message sent by the called UE, adding the key to the session response message, and transmitting the key to the calling UE through the sending unit;

The sending unit sends a session request message to the called UE, and sends a session response message to the calling UE.

The embodiment of the invention further provides a user equipment for acquiring a media stream protection key in an IMS network, which can obtain a key from a network entity.

For the fourth object of the present invention, the technical solution provided by the embodiment of the present invention is as follows: A user equipment UE that obtains a media stream protection key in an IMS network, where the user equipment includes:

a transceiver unit, configured to send and receive session messages;

a parsing unit, configured to parse the key from the session message when the session message received by the transceiver unit carries the key;

The key deriving unit is configured to: when the parsing unit parses the key generated by the calling network side and the key generated by the called network side from the session message, the parsed key and the called party generated by the calling network side are parsed The key generated by the network side is derived into a new key, and the derived key is used as a media stream protection key.

The embodiment of the present invention further provides a method for protecting a key by a media stream. The UE and the media processing function entity (MP) can obtain a key from the network side, so as to protect the media stream transmitted by the user to the network.

For the fifth object of the present invention, the technical solution provided by the embodiment of the present invention is: A method for obtaining a media stream protection key in an IMS network, the method comprising the following steps:

After receiving the session message, the network entity obtains the key from the key management function entity KMF; the network entity sends the obtained key to the terminal device UE and the media processing function respectively. Body MP.

The embodiment of the present invention further provides a system for protecting a key of a media stream. The UE and the media processing function entity (MP) can obtain a key from the network side, so as to protect the media stream transmitted by the user to the network.

For the sixth object of the present invention, the technical solution provided by the embodiment of the present invention is: A system for acquiring a media stream protection key in an IMS network, the system comprising: a terminal device UE, configured to receive a key sent by a network entity ;

a media processing function MP, configured to receive a key sent by a network entity;

a network entity, configured to receive a session message, and obtain a key from a key management function KMF, and send the key to the UE and the MP;

Key management function KMF, used to generate keys.

The embodiment of the present invention further provides a network entity that provides a media stream protection key in an IMS network, and provides a key for the UE and the MP to protect the media stream transmitted by the user to the network.

For the seventh object of the present invention, the technical solution provided by the embodiment of the present invention is: A network entity that provides a media stream protection key in an IMS network, where the network entity includes:

a receiving unit, configured to receive a session message;

The key obtaining unit, when receiving the session message, obtains a key from the key management function KMF, adds the key to the session message, and transmits the key to the sending unit;

The sending unit sends the session message carrying the key to the UE and the media processing function

MP.

In summary, the present invention provides a method, system, and apparatus for acquiring a media stream protection key in an IMS network, which may generate a key by the network side, and deliver the generated key to an entity that needs to protect the media stream. , in turn, to protect the transmitted media stream. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a flow chart of Embodiment 1 of the method of the present invention;

2a is a schematic diagram of a message flow of Embodiment 2 of the method of the present invention;

2b is a schematic diagram of a message flow according to Embodiment 3 of the method of the present invention;

3 is a schematic diagram of a message flow of a fourth embodiment of the method of the present invention;

4 is a schematic diagram of a basic structure of a system for user-to-user media stream protection according to the present invention; FIG. 5a is a schematic diagram of a basic structure of a system embodiment of the present invention;

Figure 5b is a schematic diagram showing the basic structure of the second embodiment of the system of the present invention;

Figure 5c is a schematic diagram showing the basic structure of the third embodiment of the system of the present invention;

Figure 5d is a schematic diagram of the internal structure of the network entity in the case of user-to-user media stream protection; Figure 5e is a schematic diagram of the internal structure of the user equipment in the case of user-to-user media stream protection; Figure 6 is a flowchart of Embodiment 5 of the method of the present invention;

7 is a schematic diagram of message flow on a calling side of a sixth embodiment of the method according to the present invention;

8 is a schematic diagram of a message flow of a called party side according to Embodiment 6 of the method of the present invention;

9 is a schematic diagram of message flow on a calling side of Embodiment 7 of the method according to the present invention;

10 is a schematic diagram of a message flow of a called party side according to Embodiment 7 of the method of the present invention;

11 is a schematic diagram of a message flow on a calling side of an embodiment of the method according to the present invention;

12 is a schematic diagram of a message flow of a called party side according to Embodiment 8 of the method of the present invention;

13 is a schematic diagram of message flow on the calling side of the ninth embodiment of the method according to the present invention;

14 is a schematic diagram of message flow on the called side of Embodiment 9 of the method of the present invention;

15 is a schematic diagram of a basic structure of a system for protecting a user to a network media stream according to the present invention; FIG. 16 is a schematic diagram of a basic structure of a fourth embodiment of the system of the present invention;

17 is a schematic diagram showing the basic structure of Embodiment 5 of the system of the present invention;

FIG. 18 is a schematic diagram showing the internal structure of a network entity in the case of user-to-network media stream protection. Mode for carrying out the invention

The present invention will be further described in detail below with reference to the drawings and specific embodiments.

The basic idea of the present invention is that the generated key is obtained by the network side entity, and then the key is sent to an entity that needs to protect the transmitted media stream. The entity that needs to protect the transmitted media stream here may be a terminal device (UE) or a media processing function entity (MP) in the network. That is, the media stream protection key may be obtained by the calling UE and the called UE, and then the media stream transmitted between the calling UE and the called UE may be protected by using the key, that is, user-to-user protection; The media stream protection key may also be obtained by the UE and the MP on the network side. The media stream transmitted between the UE and the MP may also be protected by the key, that is, user-to-network protection.

The present invention provides a method and system for obtaining a media stream protection key for user-to-user media stream protection and user-to-network media stream protection, respectively.

For the case of protecting a media stream transmitted by a user to a user, FIG. 1 is a flowchart of Embodiment 1 of a method for obtaining a media stream protection key. As shown in FIG. 1, the method embodiment 1 may include the following steps:

Step 101: The calling terminal device UE sends a session request message to the network entity, and the network entity adds the media stream protection key to the session request message, and sends the message to the called UE.

In an actual application, the network entity includes a calling network entity and a called network entity, and the step 101 may include:

Step axl: After receiving the session request message sent by the calling UE, the calling network entity obtains the key generated by the calling network side, and sends the key generated by the calling network side to the called network entity through the session request message.

Here, the session request message is a PRACK or an UPDATE message, and the calling network entity may be a calling call session control function entity S-CSCF or a calling application server. AS, can also be AS-KMF. If the calling S-CSCF or the calling AS is the calling party, the method for the calling S-CSCF or the calling AS to obtain the key generated by the local side may be:

The calling S-CSCF or the calling AS sends a key request message to the calling KMF, and the calling KMF returns the generated key to the calling S-CSCF or the calling AS through the key response message.

If the calling network entity is AS-KMF, then the key on the calling network side is

The key generated by AS-KMF itself.

Step ax2: After receiving the session request message, the called network entity obtains the key generated by the called network side and adds the key to the session request message, and then sends the session request message to the called UE.

Correspondingly, the called network entity may be the called S-CSCF, the called AS or the called called AS-KMF. If the called network entity is called the S-CSCF or the called AS, the method of the called S-CSCF or the called AS acquiring the key generated by the called network side may be: the called S-CSCF or the called party The AS sends a key request message to the called KMF, and the called KMF returns the generated key to the called S-CSCF or the called AS through the key response message. If the called network entity is called AS-KMF, then the key generated by the called network side is the key generated by the called AS-KMF itself.

In addition, the called network entity has obtained the key generated by the calling network side and the key generated by the local side, and can directly use the key generated by the calling side and the key generated by the side as a media stream. Protecting the key; after the received UE receives the session request message, the called UE derives a new one according to the key generated by the calling network side and the key generated by the local side in the session request message. Key, and the derived key as the media stream protection key.

In a practical application, the called network entity may also derive a new key according to the key generated by the calling network side and the key generated by the local side, and use the derived key as the media stream protection key.

Step 102: The called UE returns a response message to the network entity, and the network entity sends the media stream. A protection key is added to the response message and sent to the calling UE.

Here, the session response message may be a 200 response message, and the step 102 may include:

Step bxl, after receiving the session response message returned by the called UE, the called network entity carries the key generated by the called network side in the session response message, and sends the key to the calling network entity;

Step b2: After receiving the session response message, the calling network entity adds a key generated by the calling network side to the session response message and sends the message to the calling UE.

Here, the calling network entity is called the S-CSCF, the calling AS or the calling AS-KMF, and the calling S-CSCF, the calling AS or the calling AS-KMF can directly generate the key generated by the calling network side. The key generated by the network side and the called network side are used as the media stream protection key, and after the calling UE receives the session response, the calling UE generates the key generated by the local side and the called side according to the session response message. The key derives a new key and uses the derived key as a media stream protection key.

In actual application, the calling S-CSCF, the calling AS or the calling AS-KMF may also derive a new key according to the key generated by the calling network side and the key generated by the called network side, and will be derived. The key acts as a media stream protection key.

In an actual application, before the calling UE and the called UE obtain the media stream protection key, the security capability may be negotiated. The method may be:

The calling UE sends a session establishment request message carrying the media stream security capability information provided by itself to the called UE through the network entity, where the session establishment request message is an invite (INVITE) request message; the called UE provides according to the calling UE. The media stream security capability information determines the media stream security capability information that needs to be provided, and the provided media stream security capability information is carried in the session establishment response response message, and is returned to the calling UE by the network entity, and the session establishment response message is sent. A response message of 183. In the process of the negotiation, when the calling network entity receives the INVITE request message, the method further includes: the calling network entity determines that the calling UE has subscribed to the media stream security service, and the calling UE has subscribed to the media stream security. Adding an identifier of the service to the INVITE request message, and then performing the step of sending the INVITE request message to the called network entity;

When the called network entity receives the INVITE request message, the method further includes: the called network entity checks that the requesting message has an identifier that the calling UE has subscribed to the media stream security service, and determines that the called UE is also already Signing the media stream security service, and then continuing to perform the step of sending the INVITE request message to the called UE;

When the called network entity receives the 183 response message, the method further includes: the called network entity adds an identifier of the called UE that has subscribed to the media stream security service to the 183 response message, and then continues to perform the 183 response. The step of sending a message to the calling network entity;

When the calling network entity receives the 183 response message, the method further includes: the calling network entity checks that the called UE has subscribed to the identifier of the media stream security service, and then continues to send the 183 response message to the primary message. The step of calling UE.

In order to better illustrate the scheme for obtaining a key for user-to-user media stream protection, the following describes the preferred method embodiment and system embodiment in detail. Method embodiment two

In this embodiment, the network entity that generates the key on the calling side is called the AS, and the entity that generates the key is the KMF, which is an independent entity. The network entity that generates the generated key on the called side is called. AS, the entity that generates the key is called KMF, which is a separate entity.

Independent KMFs and ASs can use a direct interface to pass keys, such as carrying keys using protocols such as Diameter or HTTP. Independent KMF can be used as an IMS The way of the application server in the network communicates with the S-CSCF through the ISC interface, so that both the KMF and the AS communicate in the form of an application server.

In this embodiment, it is assumed that both the calling UE and the called UE have subscribed to the media stream protection service. 2a is a schematic diagram of a message flow of a second embodiment of a method. As shown in FIG. 2a, the method for the calling UE and the called UE to obtain the media stream protection key in the second embodiment of the method may include the following steps: Step 201: The calling UE sends a session establishment request message to the calling CSCF, where the session The setup request message carries the media stream security capability information provided by the calling UE.

The session establishment request message described in this step is an invitation (INVITE) message in a Session Initiation Protocol (SIP), and the media stream security capability information includes a security algorithm, and may also include a media type to be protected, a security transmission protocol type, and security. One or a combination of any of the premise.

The security algorithm may be an integrity security algorithm or a confidentiality security algorithm, and the media type to be protected may be text, audio, video, etc., and the security transmission protocol type may be RTP/SAVP or RTP/SAVPF.

The security premise is used to indicate the security requirements of the media stream in the current session, and may include the strength identifier of the media stream security protection that the initiating entity desires, such as: mandatory, optional, negligible ( none ). The security premise may also include a desired security negotiation configuration result and a current configuration situation, such as: whether to complete the negotiation, the receiving direction has completed the security configuration, and the receiving and transmitting methods complete the security configuration.

In addition, the media stream security capability information of the calling UE may be used to provide the media stream security capability information of the called UE to the called UE. For example, the calling UE can support five security algorithms, but only three security algorithms can be selected for the called UE. Then, the INVITE message can carry only three security algorithms provided. Of course, the calling UE can also provide the supported 5 security algorithms to the called UE. How to determine the provided media stream security capability information needs to be determined by the actual situation. Step 202: The calling CSCF sends the session establishment request message to the calling AS. In this step, the calling CSCF may trigger a session establishment request message to the calling AS by using an initial filtering rule set in advance. As for how to trigger, it belongs to the prior art, and will not be described here.

Step 203 to step 205: The calling AS determines that the calling UE has subscribed to the media stream protection service, adds the identifier of the subscribed media stream protection service of the calling UE to the session establishment request message, and then passes the session establishment request message. The calling CSCF is sent to the called CSCF.

In an actual application, the calling AS may determine whether the calling UE has subscribed to the media stream protection service according to the information related to the subscription recorded in advance. For example: querying the information related to the subscription according to the identifier of the calling UE in the session establishment request message, and determining whether the calling UE subscribes according to the information related to the subscription. Of course, the calling AS can also check the signing situation of the calling UE by other methods, and details are not described herein again.

Step 206: After receiving the session establishment request message, the called CSCF sends the session establishment request message to the called AS.

Similar to the calling side, the called CSCF can also trigger the session establishment request message to the called AS by using the initial filtering rule set in advance.

Step 207 to step 209: The called AS checks that the session establishment request message has an identifier that the calling UE has subscribed to the media stream protection service, and determines that the called UE has also subscribed to the media stream protection service, and then the session establishment request is performed. The message is sent to the called UE through the called CSCF.

The called AS can also use the same method as the calling party to determine that the called UE has subscribed to the media stream protection service, and details are not described herein.

Steps 210 to 211: The called UE sends a session establishment response message to the called CSCF, and the called CSCF sends the received session establishment response message to the called AS. Here, the called UE may determine the media stream security capability information that needs to be provided according to the media stream security capability information provided by the calling UE in the session establishment request message, and carry the determined media stream security capability information in the session establishment response message. , is sent to the called AS through the called CSCF.

The session establishment response message is a 183 message, and the media stream security capability information that the called UE needs to provide may be all or part of information that can be supported by the calling UE. For example, the called UE determines from the received INVITE message that the calling UE can support three security algorithms. If the called UE supports only two security algorithms, it can return all two types that can be supported to the calling UE. The security algorithm may also return one of the security algorithms to the calling UE.

Step 212 ~ Step 215: The called AS adds the identifier that the called UE has subscribed to the session establishment response message, and sends the session establishment response message to the calling AS through the called CSCF and the calling CSCF.

Step 216 to step 218: The calling AS checks that the session establishment response message includes the identifier that the called UE has subscribed, and sends the session establishment response message to the calling UE through the calling CSCF.

In this embodiment, steps 201 to 218 are actually a process of negotiating security capabilities between the calling UE and the called UE, and the acquiring party can support parameters such as a security algorithm and a secure transmission protocol, thereby determining to be used for the session. Media stream security capabilities information.

In the process of negotiating between the calling UE and the called UE, on the calling side, the calling AS also needs to check whether the calling UE has subscribed, and adds the identifier that the calling UE has subscribed to the message; The called AS also needs to check whether the called UE has subscribed, and adds the identifier of the called UE that has been signed to the returned response message. In practical applications, if the calling UE and the called UE are the default users who have subscribed to the media stream protection service, or the media stream protection service is a basic service, all users do not need to perform the subscription check. In this situation In this case, the calling AS and the called AS may not check the subscription situation; or, the calling AS and the called AS may also check by one party, and the other party does not check; or the calling CSCF and the called CSCF directly check the subscription. As for whether or not to check the contract status, it is checked by one party or both parties. The CSCF inspection or the AS inspection can be determined according to the actual situation, and will not be repeated here.

Similar to the check signing, in the process of negotiating between the calling UE and the called UE, if the calling UE has already signed the contract, the calling AS also needs to add the identity that the calling UE has subscribed to the session establishment request message; The UE has already signed the contract, and the called AS also needs to add the identifier that the called UE has subscribed to the session establishment response message. In this way, the calling side and the called side can clarify the other party's signing situation, so that different strategies can be adopted according to the situation. However, in the actual application, the calling AS and the called AS may not notify the other party of the signing of the local side, and then it is not necessary to add the identifier that the local UE has subscribed to the message, so that the corresponding one of the above steps is corresponding. Contract processing can also be done.

Step 219 ~ Step 220: The calling UE sends a session request message to the calling AS through the calling CSCF.

The session request message described herein may be an acknowledgment (PRACK) message and carries media stream security capability information for the current session determined by the calling UE.

In this step, the method for determining, by the calling UE, the media stream security capability information for the current session may be: the calling UE determines the media stream security capability information for the current session according to the media security capability information provided by the called UE. That is, the calling UE may select the media stream security capability information for the current session from the media stream security capability information provided by the called UE, including: a security algorithm, and may also include a media type to be protected, and secure transmission. One or a combination of any of the types of protocols.

Step 221: The calling AS obtains the key Kl from the calling KMF.

In this step, when the calling AS needs to obtain the key K1 from the calling KMF, the primary The called AS can send a key request message to the calling KMF, the calling KMF generates a key, and then returns the generated key K1 to the calling AS. In addition, the calling KMF may also return information such as the key identifier of the key K1, the key validity period, and the like to the calling AS.

Here, when the calling AS sends a key request message to the calling KMF, information about a security algorithm in the media stream security capability information used for the current session in the session request message may be sent to the calling KMF. The KMF can generate a key based on information such as the security algorithm. In actual applications, the calling KMF may not generate a key according to information such as a security algorithm in the calling AS session request message, but directly generate a key. Either way, as long as the calling AS gets the key from the calling KMF.

Step 222 ~ Step 225: The calling AS adds the key K1 generated by the local side to the session request message, and sends it to the called AS through the calling CSCF and the called CSCF.

Step 226: The called AS obtains the key K2 from the called KMF.

Similar to step 221, the called AS can send a key request message to the called KMF, the called KMF generates a key, and returns the generated key K2 to the called AS. In addition, the called KMF can also return the key identification of the key K2, the key validity period, and the like to the called AS.

Step 227 to step 229: The called AS derives a new key according to the key K1 generated by the calling side and the key K2 generated by the calling side, and uses the derived key as a media stream protection key, and media stream The protection key is added to the session request message and sent to the called UE by the called CSCF.

Step 230 to Step 231: The called UE sends a session response message to the called AS through the called CSCF.

The session response message described herein is a 200 message, and may carry the media stream security capability information confirmed by the called UE. The media stream security capability includes a security algorithm, and may also include one or more arbitrary groups of media types, secure transmission protocol types, and security prerequisites to be protected. Hehe.

Step 232 ~ Step 235: The called AS adds the key K2 to the session response message, and sends it to the calling AS through the called CSCF and the calling CSCF.

Here, if the called KMF also returns the key identifier of the key K2, the key validity period and the like to the called AS in advance, the called AS can also identify the key for the key K2, Information such as the key validity period is also added to the session response message.

Step 236 to step 238: The calling AS derives a new key according to the key K1 generated by the local side and the key K2 generated by the called side, and uses the derived key as a media stream protection key, and the The media stream protection key is added to the session response message and then sent to the calling UE through the calling CSCF.

In this embodiment, the calling side and the called side respectively generate a key, and a new key is derived according to the key generated by the side and the key generated by the other party, and the derived key is used as a media stream to protect the secret. The keys are sent to the calling UE and the called UE, respectively. Thereafter, the calling UE and the called UE can use the key to protect the transmitted media stream. For example, when the calling UE needs to transmit the media stream to the called UE, the media stream can be protected and transmitted to the called UE by using the derived key. Conversely, if the called UE needs to transmit the media stream to the calling UE, The media stream is protected and transmitted to the calling UE by using the derived key.

In actual applications, the calling AS and the called AS may also generate the derived key and directly use the key generated by the local side and the generated key of the other party as the media stream protection key. That is, the calling UE and the called UE will simultaneously obtain the key K1 and the key K2, one of which serves as a key for protecting the media stream when sent to the other party, and the other key for receiving the protected media. flow.

In this embodiment, the key is derived by the calling AS and the called AS. In actual application, the key may be derived by the calling CSCF and the called CSCF respectively; or, by the calling UE and the called party respectively The UE derives the key. The method for deriving a key in this embodiment may be: string K1 and key K2 are connected by a string, and key K1 and key K2 may be used as input parameters of a key generation function, etc., - enumeration.

In addition, in the embodiment, the KMF is an independent entity. In an actual application, the KMF may also be a function unit in an entity such as an AS, a CSCF, or a Home Subscriber Server (HSS). However, whether it is a separate entity or a functional unit in an entity, the method and process are similar to this embodiment, and are not enumerated here. Method embodiment three

In this embodiment, the KMF is integrated with the AS as an independent functional entity AS-KMF, and the network entity that generates the key on the calling side is called the AS-KMF; the network entity that generates the key on the called side is sent. For the called AS-KMF. In the case of KMF as an independent entity, the AS needs to obtain a key from the KMF. The specific process is similar to that of the second embodiment.

2b is a schematic diagram of a message flow of a third embodiment of the method. As shown in FIG. 2b, the method for the calling UE and the called UE to obtain the media stream protection key in the third embodiment of the method may include the following steps: Step 201: The calling UE sends a session establishment request message to the calling CSCF, where The session establishment request message carries the media stream security capability information provided by the calling UE.

This step is similar to step 201 in the second embodiment of the method, and details are not described herein again.

Step 202': The calling CSCF sends the session establishment request message to the calling AS-KMF.

In this step, the calling CSCF may send a session establishment request message to the calling AS-KMF by using an initial filtering rule set in advance.

Step 203' ~ Step 205': The calling AS-KMF adds the identity of the calling AS-KMF to support the media stream security protection to the session establishment request message, and then sends the session establishment request message to the called CSCF through the calling CSCF. . In an actual application, the calling AS-KMF may carry the identifier by using a SIP message or a header field in the SDP description. For example, the attribute header field a=fmtp: <format><format specific parameters ;^ of SDP in RFC 4566 is used for carrying.

Step 206': After receiving the session establishment request message, the called CSCF sends the session establishment request message to the called AS-KMF.

Similar to the calling side, the called CSCF can also send a session establishment request message to the called AS-KMF by using an initial filtering rule set in advance.

Step 207 ′ to step 209 ′: the called AS-KMF check session establishment request message has an identifier that the calling AS-KMF supports media stream security protection, and then sends the session establishment request message to the called UE through the called CSCF. .

Step 210' ~ Step 211': The called UE sends a session establishment response message to the called CSCF, and the called CSCF sends the received session establishment response message to the called AS-KMF.

Here, the called UE may determine the media stream security capability information that needs to be provided according to the media stream security capability information provided by the calling UE in the session establishment request message, and carry the determined media stream security capability information in the session establishment response message. , sent to the called AS-KMF by the called CSCF.

The session establishment response message is a 183 message, and the media stream security capability information that the called UE needs to provide is the media stream security capability provided by the calling UE in the session establishment request supported by the called UE. For example, in the INVITE message, the calling UE provides three security algorithms. If the called UE supports only two security algorithms, it can return two supported security algorithms to the calling UE, and can also return to the calling UE. One of the security algorithms.

Step 212' ~ Step 215': The called AS-KMF adds the identifier of the called AS-KMF support media stream security protection to the session establishment response message, and sends a session establishment response message to the called CSCF and the calling CSCF. The caller is AS-KMF.

The method called AS-KMF adds support for media stream security protection identifiers. Called AS-KMF added method.

Step 216 ′ to step 218 ′: The calling AS-KMF check session establishment response message includes an identifier of the called AS-KMF supporting media stream security protection, and sends the session establishment response message to the calling UE through the calling CSCF. .

In this embodiment, the step 20 to the step 218 ′ are actually a process of negotiating the security capability between the calling UE and the called UE, and acquiring the parameters that the other party can support the security algorithm and the secure transmission protocol, thereby determining the current use for this time. Media stream security capability information for the session.

Here, the calling and called AS-KMFs notify each other by supporting the media stream security protection so that the calling and called AS-KMF can confirm that both the calling and the called network entities can support the media stream security, thus confirming the follow-up. The key can be issued in the session.

After the called AS-KMF checks the identity of the media stream security protection of the calling AS-KMF in the session establishment request message, the identifier of the called AS-KMF supporting the media stream security protection may be further added in the message and sent to the called UE. Therefore, the called UE can confirm that both the calling network and the called network support the flow stream security protection. Similarly, in the session establishment response message, after the calling AS-KMF checks that the called AS-KMF supports the identifier of the media stream security protection, the identifier of the calling party AS-KMF supporting the media stream security protection may be further added in the message, so that The calling UE can confirm that both the calling network and the called network support the flow stream security protection, so that the calling UE and the called UE confirm that the network side entity supports the media stream security protection in the subsequent session.

Step 219' to step 220': The calling UE sends a request message to the calling AS-KMF through the calling CSCF.

The request message described herein may be an acknowledgment (PRACK) or an UPDATE message, and carries the media stream security capability information determined by the calling UE.

In this step, the method for determining the media stream security capability information used by the calling UE may be: The calling UE determines the used media stream security capability information according to the media security capability information provided by the called UE. That is, the media stream security provided by the calling UE from the called UE Select the media stream security capability information actually used in this session, such as called

The UE returns two security algorithms, and the calling UE selects a security algorithm as the actual used security algorithm.

Step 22 to Step 224': The calling AS-KMF generates a key K1 and adds it to the request message, and sends it to the called AS-KMF through the calling CSCF and the called CSCF.

In addition, the message may further include information such as a key identifier corresponding to the key K1, a key validity period, and the like.

When the calling party AS-KMF generates the key key K1, the corresponding key may be generated according to the media stream security capability information in the message, for example, according to the key length required by the algorithm in the media stream security capability information. The length of the key; the validity period of the key may be set according to the key validity period in the media stream security capability information, and the like.

Step 225'~Step 227': The called AS-KMF generates a key K2, and adds it to the request message, and sends it to the called UE through the called CSCF.

The called AS-KMF uses a similar method to the calling AS-KMF to generate the corresponding key.

K2.

Step 228': The called UE derives a new key 根据 according to the key K1 and the key Κ2, and uses the derived key Κ as the media stream protection key.

Step 229' ~ Step 230': The called UE sends a response message to the called AS-KMF through the called CSCF.

The response message described here is a 200 message, which carries the media stream security capability information used by the session in the request message.

Step 231' ~ Step 234': The called AS-KMF adds the key K2 to the session response message and sends it to the calling AS-KMF through the called CSCF and the calling CSCF.

The generation of K2 is similar to the generation of K1. In addition, the message may further include information such as a key identifier corresponding to the key K2, a key validity period, and the like. Step 235' ~ Step 237': The calling AS-KMF adds the key K1 generated by the local side to the session response message, and then sends it to the calling UE through the calling CSCF.

Step 238': The calling UE derives a new key K according to the key K1 and the key K2, and uses the derived key K as a media stream protection key.

In this embodiment, the calling side and the called side AS-KMF respectively generate keys K1 and K2, and the calling UE and the called UE further derive the key K according to the key K1 and the key K2, which will be derived. The key K is used as a media stream protection key. Thereafter, the calling UE and the called UE can use the key to protect the transmitted media stream. For example, when the calling UE needs to transmit the media stream to the called UE, the media stream can be protected and transmitted to the called UE by using the derived key. Conversely, if the called UE needs to transmit the media stream to the calling UE, The media stream is protected and transmitted to the calling UE by using the derived key.

In actual application, the calling and called AS-KMF can also derive the key, and send the derived key as the key of the media stream to the calling UE and the called UE. The specific derivation and delivery mode and implementation Example 2 is similar. In practical applications, the keys can be derived by the calling CSCF and the called CSCF, respectively, in a similar manner.

The calling UE and the called UE can also directly use the key K1 and the key K2 as keys for protecting the media stream without deriving a new key K, for example, where the key K1 is sent to the called party as the calling UE. The UE media data protects the key of the media stream, and the key K2 is used by the calling UE to decrypt and receive the protected media stream sent by the called UE.

The method for deriving a key in this embodiment may be: the key K1 and the key K2 are connected by a character string; the key K1 and the key K2 may also be used as input parameters of the key generation function, for example, using a hash function. The key generation function generates a key, not here - enumerated. Method embodiment four

In this embodiment, the network entity that generates the key generated by the calling network side is called the CSCF. The calling KMF that generates the key is a functional unit in the AS. The network entity that obtains the generated key on the called side is the called CSCF, and the called KMF that generates the key is a functional unit in the called AS.

In addition, in this embodiment, it is assumed that both the calling UE and the called UE subscribe to the media stream protection service.

FIG. 3 is a schematic diagram of a message flow of this embodiment. As shown in FIG. 3, this embodiment may include the following steps:

Step 301: The calling UE sends a session establishment request message to the calling CSCF, where the session establishment request message carries the media stream security capability information provided by the calling UE.

This step is the same as step 201 of the second embodiment, and details are not described herein again.

Step 302: The calling CSCF sends the session establishment request message to the calling AS. This step is the same as step 201 of the second embodiment, and details are not described herein again.

Step 303 ~ Step 305: The calling AS determines that the calling UE has subscribed to the media stream protection service, and then sends the session establishment request message to the called CSCF through the calling CSCF.

This step is similar to the step 203 to the step 205 of the second embodiment, except that the calling AS does not add the identifier of the calling UE to the session establishment request message, and details are not described herein.

Step 306: After receiving the session establishment request message, the called CSCF sends the session establishment request message to the called AS.

This step is the same as step 206 of the second embodiment, and details are not described herein again.

Step 307 ~ Step 309: The called AS determines that the called UE has also subscribed to the media stream protection service, and then sends the session establishment request message to the called UE through the called CSCF.

This step is similar to the steps 207 to 209 of the second embodiment, except that the called AS does not add the identifier that the called UE has subscribed to the session establishment request message, and details are not described herein again.

Steps 310 to 312: The called UE sends a session establishment response message to the called CSCF, and the called CSCF sends the session establishment response message to the calling UE through the calling CSCF. Here, the called UE may determine the media stream security capability information that needs to be provided according to the media stream security capability information provided by the calling UE in the session establishment request message, and carry the determined media stream security capability information in the session establishment response message. , is sent to the calling UE through the called CSCF and the calling CSCF.

The session establishment response message described herein is a 183 message, and the media stream security capability information to be provided by the called UE may be all or part of information that can be supported by the calling UE.

In this embodiment, the steps 301 to 312 are the process of negotiating the security capability between the calling UE and the called UE, and the acquiring party can support the security algorithm, the security transmission protocol, and the like, thereby determining the media used for the session. Flow security capability information.

Similar to the second embodiment, in the actual application, during the negotiation process, the calling AS and the called AS may not check the subscription situation; or the calling AS and the called AS may check by one party, and the other party does not check; or directly The contract is checked by the calling CSCF and the called CSCF. As for whether the contract is checked, whether it is checked by one party or both parties, the CSCF inspection or the AS inspection can be determined according to the actual situation, and will not be repeated here.

In addition, similar to the second embodiment, the calling AS can also add the identifier of the subscribed media stream protection service of the calling UE to the session establishment request message, and the called AS can sign the media stream protection service of the called UE. The identity is added to the session establishment response message.

Step 313: The calling UE sends a session request message to the calling CSCF.

Step 314: The calling CSCF obtains the key K1 from the calling KMF.

This step is similar to step 221 in the second embodiment. The difference is that: in this embodiment, the calling CSCF obtains the key K1 directly from the calling KMF, and can also obtain the key identifier for the key K1, the key validity period, and the like. Information, no more details here.

Step 315 ~ Step 316: The calling CSCF adds the key K1 generated by the local side to the session request message, and sends a session request message carrying the key K1 to the called CSCF.

Step 317: The called CSCF obtains the key K2 from the called KMF. This step is similar to step 314 and will not be described here.

Step 318 ~ Step 319: The called CSCF derives a new key according to the key K1 generated by the calling side and the key K2 generated by the calling side, and uses the derived key as a media stream protection key, and media stream A protection key is added to the session request message and sent to the called UE.

Step 320: The called UE returns a session response message to the called CSCF.

Similar to the method embodiment 2, the session response message described herein may also be a 200 message, and may carry the media stream security capability information confirmed by the called UE. The media stream security capabilities include security algorithms, and may also include any one or combination of media types, secure transport protocol types, and security premise to be protected.

Step 321 ~ Step 322: The called CSCF adds the key K2 to the session response message, and sends a session response message carrying the key K2 to the calling CSCF.

If the called KMF also returns the key identification and key validity period of the key K2 to the called CSCF in advance, the called CSCF can also identify the key and the key for the key K2. Information such as the validity period is also added to the session response message.

Step 323 to step 324: The calling CSCF derives a new key according to the key K1 generated by the local side and the key K2 generated by the called side, and uses the derived key as a media stream protection key, and the The media stream protection key is added to the session response message and then sent to the calling UE.

Similar to the second embodiment of the method, in this embodiment, the calling CSCF and the called CSCF may also generate the derived key, and directly use the key generated by the local side and the generated key of the other party as the media stream protection key; The calling UE and the called UE generate a derived key.

At this time, both the calling UE and the called UE acquire the media stream protection key, and the key can be used to protect the transmitted media stream. In addition, in an actual application, the INVITE message sent by the calling UE to the called UE may include the media stream security capability information provided by the calling UE, and may also increase the media stream. The security mode may be a user-to-user mode or a user-to-network mode. In this case, the calling UE first sends the INVITE message to the calling AS through the calling P-CSCF and the calling S-CSCF; when the calling AS receives the INVITE message, it checks that the calling UE has signed the contract. After the media stream protects the service, the media stream security mode may also be checked. If the media stream security mode has more than one option, the unique media stream security mode is determined, and the mode in the message is modified to ensure the determined media stream security. The mode is further executed, that is, the INVITE message is sent to the called S-CSCF; the called S-CSCF sends the INVITE message to the called UE through the called AS and the called P-CSCF; The called P-CSCF sends a 183 message carrying the security capability information of the media stream provided by itself, and the called P-CSCF sends it to the called S-CSCF, and is sent by the called S-CSCF to the called AS; After the determined media stream security mode is added, the 183 message is sent to the called S-CSCF; the called S-CSCF is sent to the calling S-CSCF; and the calling S-CSCF receives the 183 message and sends the message. To the calling AS, the calling AS checks the media stream security determined by the called network from the 183 message. After the 183 message is sent to the calling S-CSCF; the calling S-CSCF is then sent to the calling P-CSCF; the calling P-CSCF confirms the media stream security mode, and continues to send to the calling UE, thereby completing the main The media stream security mode negotiation between the UE and the called UE is called. For the method for the UE to obtain the media protection key in the case of the above-mentioned user-to-user media stream protection, the present invention also provides a corresponding system for acquiring the media stream protection key.

Figure 4 is a schematic diagram of the basic structure of the system. As shown in FIG. 4, the system includes at least: a terminal device UE401, configured to send a session request message to the network entity 402, and receive a session response message carrying a key, when acting as a calling UE; And receiving a session request message sent from a network entity, and returning a session response message. The network entity 402 is configured to: when receiving the session request message sent by the calling UE, add the key to the session request message, and send the key to the called UE; and further, receive the session response message sent by the called UE, The key is added to the session response message and sent to the calling UE.

In a practical application, the network entity 402, when acting as a calling network entity, is configured to receive a session request message sent by the calling UE, obtain a key generated by the calling network, and pass the key generated by the calling network side. The session request message is sent to the called network entity. The session response message returned by the called network entity is received, and the key generated by the calling network side is added to the session response message and sent to the calling UE.

Correspondingly, when the network entity 402 is used as the called network entity, it is configured to receive a session request message from the calling network entity, obtain a key generated by the called network side, and add the key to the session request message, and then The session request message is sent to the called UE; the session response message returned by the called UE is received, and the key generated by the called network side is carried in the session response message and sent to the calling network entity.

In actual application, the UE 401 may be further configured to derive a new key generated by the received key generated by the calling network side and the generated key of the called network side, and use the derived key as a media stream to protect the confidentiality. key.

In a practical application, the network entity 402, when acting as a calling network entity, is configured to receive a session request message sent by the calling UE, obtain a key generated by the calling network, and pass the key generated by the calling network side. The session request message is sent to the called network entity; the session response message returned by the called network entity is received, and the key generated by the calling network side and the key generated by the called network side are derived from the new key, and carried The session response message is sent to the calling UE.

Correspondingly, when the network entity 402 is used as the called network entity, it is configured to receive a session request message from the calling network entity, and obtain a key generated by the called network side, according to the calling party. The key generated by the network side and the key generated by the called network side derive a new key, and the derived key is carried as a media stream protection key in the session request message and sent to the called party.

The UE receives the session response message returned by the called UE, and carries the key generated by the called network side in the session response message, and sends the key to the calling network entity.

In practical applications, if the network entity 402 is an S-CSCF or an AS, the system can further include:

The key management function entity KMF is configured to receive a key request message of the S-CSCF or the AS, generate a key, and return it to the S-CSCF or the AS through the key response message. That is to say, in this case, when the network entity 402 needs to acquire a key, it can request KMF, and the key is provided by KMF.

If the network entity is an AS-KMF, and the key obtained by the network entity is a key generated by the AS-KMF itself, the system may further include:

The S-CSCF is used to forward a session message between the UE and the AS-KMF. That is, when the S-CSCF forwards the session message from the UE to the AS-KMF, the AS-KMF can generate the key by itself without having to acquire it from other entities. In order to better illustrate the above system for obtaining a media stream protection key in the case of user-to-user media stream protection, a detailed description will be made below using a preferred system embodiment. System embodiment one

FIG. 5a is a schematic diagram of the basic structure of the first embodiment of the system. As shown in FIG. 5a, the system embodiment includes: UE401, AS-KMF402x, S-CSCF403, P-CSCF404. When the UE 401, the S-CSCF 403, the AS-KMF 402x, and the P-CSCF 404 are the entities in the calling network side, the functions corresponding to the calling side in the foregoing method may be completed; the UE 401, the S-CSCF 403, the AS-KMF 402x, and the P-CS CF 404 are When the entity in the network side is called, the function corresponding to the called side in the above method can be completed. In this embodiment, AS-KMF402x is equivalent to the network in FIG. Entity entity 402.

The UE 401 is configured to send a session message to the P-CSCF 404 and receive a session message carrying the key.

The P-CSCF 404 is configured to forward a message between the UE 401 and the S-CSCF 403.

The S-CSCF 402x is configured to receive a session message from the P-CSCF 404 or from another network S-CSCF, and send the message to the AS-KMF 402x. It is also used to send the session message sent by the AS-KMF 402x to the P-CSCF 404 or other Network S-CSCF403;

AS-KMF402, used to generate a key, add the key to the message, and send it to the S-CSCF 403.

When the media stream protection key needs to be obtained, the UE401 passes the P-CSCF404 to

The S-CSCF 403 sends a session message, and the S-CSCF 403 sends the message to the AS-KMF 402x. After the AS-KMF 402 adds the key to the message, it is sent to the UE 40L through the called S-CSCF 403.

Of course, there is no distinction between the calling UE and the called UE, the calling P-CSCF and the called P-CSCF, the calling S-CSCF and the called S-CSCF, the calling AS-KMF, and the called AS-KMF. In practice, the same P-CSCF 404 can act as both the calling P-CSCF and the called P-CSCF. The same S-CSCF 403 can act as both the calling S-CSCF and the called S-CSCF, the same AS-KMF402x. Can act as both the calling AS-KMF and the called AS-KMF ₀

In addition, both the P-CSCF 404 and the S-CSCF here only forward the session message and have no substantial effect. Of course, in the actual network, other entities may be forwarded between the UE 401 and the AS-KMF 402x, and details are not described herein.

System embodiment two

FIG. 5b is a schematic diagram of the basic structure of the second embodiment of the system. As shown in FIG. 5b, the system embodiment includes: a calling UE 401b, a network entity 402b, a called UE 403b, and a calling KMF 404b. The called KMF405b, the calling P-CSCF406b, and the called P-CSCF407b.

The network entity 402b includes a calling network entity and a called network entity, the calling network entity is a calling S-CSCF4021b, and the called network entity is a called S-CSCF4022b.

The calling UE 401b is configured to send a session request message to the calling S-CSCF 4021b through the calling P-CSCF 406b, and receive a session response message carrying a media stream protection key; the calling S-CSCF4021b is configured to receive From the calling P-CSCF 406b session request message, the key is obtained from the calling KMF 405b and sent to the called S-CSCF 4022b; and is also used to receive the receiving session response message from the called S-CSCF 4022b, and the obtained key is carried in The response message is sent to the calling UE 401b;

The called S-CSCF4022b is configured to receive a session request message from the calling S-CSCF 4021b, obtain a key from the called KMF 405b, and carry the obtained key in the session request message and send it to the called P-CSCF 407b. The called UE 403b is further configured to receive a session response message from the called UE 403b, and forward it to the calling S-CSCF 4021b;

The called UE 403b is configured to receive a session request message and return a session response message; the calling KMF 404b is configured to generate a key, and is returned to the calling S-CSCF 4021b; the called KMF 405b is used to generate a key, and is returned to the called Called S-CSCF4022b; the calling P-CSCF 406b is used to forward the message between the calling UE 401b and the calling S-CSCF 4021b;

The called P-CSCF407b is used to forward the message between the called UE 403b and the called S-CSCF 4022b.

When the media stream protection key needs to be obtained, the calling UE 401b sends a session request message to the calling S-CSCF 4021b through the calling P-CSCF 4021b, the calling S-CSCF 4021b obtains the key from the calling KMF 404b, and sends the called S-CSCF4022b. The called S-CSCF4022b obtains the key from the called KMF405b and then passes the called The P-CSCF 407b is sent to the called UE 403b; the called UE 403b returns a session response message to the called S-CSCF 4022b via the called P-CSCF 407b, and the called S-CSCF 4022b carries the acquired key in the session response message and sends it to the calling S. -CSCF4021b; The calling S-CSCF 4021b then returns the session response message carrying the key to the calling UE 401b through the calling P-CSCF 406b.

In practical applications, the system may further include a calling AS and a called AS, and the calling S-CSCF4021b obtains a key from the calling KMF 404b through the calling AS, and the called S-CSCF4022b obtains from the called KMF 405b through the called AS. Key.

After the key is obtained, the called AS can be further used to derive the key generated by the calling side and the key generated by the local side. Alternatively, the called S-CSCF can be further used to generate the secret generated by the calling side. The key is derived from the key generated by the local side. Alternatively, the called UE may be further used to derive the key generated by the calling side and the key generated by the side.

Correspondingly, after the key is obtained, the calling AS can further be used to derive the key generated by the called side and the key generated by the local side; or the calling S-CSCF can be further used for the called side. The generated key is derived from the key generated by the local side. Alternatively, the calling UE may further be used to derive the key generated by the called side and the key generated by the side.

In the actual application, the calling AS and the called AS can also be used to check whether the calling UE and the called UE have subscribed to the media protection service respectively. For how to determine whether to sign the contract, refer to the above specific method. Narration. System embodiment three

Figure 5c is a schematic diagram of the basic structure of the third embodiment of the system. As shown in FIG. 5c, the system embodiment includes: a calling UE 401c, a network entity 402c, a called UE 403c, a calling KMF 404c, a called KMF 405c, a calling P-CSCF 406c, and a called P-CSCF 407c.

Wherein the network entity 402c includes a calling network entity and a called network entity, the primary The called network entity is called AS 5021c, and the called network entity is called AS 5022c. The function and structure of each entity in the embodiment of the system are similar to the system embodiment 2. The difference is that the function of the calling AS in the embodiment of the system is equivalent to the calling party in the second embodiment of the system.

S-CSCF, the function of the called AS is equivalent to the called S-CSCF in the second embodiment of the system.

In this embodiment of the system, the calling party S-CSCF408C and the called party can also be included at the same time.

S-CSCF409C, but no longer has the ability to obtain a key from KMF, it is only used to forward messages.

Of course, after the key is obtained, the called AS can be further used to derive the key generated by the calling side and the key generated by the local side. Alternatively, the called S-CSCF can further It is used to derive the key generated by the calling side and the key generated by the local side. Alternatively, the called UE may further be used to derive the key generated by the calling side and the key generated by the side.

The calling AS and the called AS can also be used to check whether the calling UE and the called UE have subscribed to the media protection service. For details on how to determine whether to sign the contract, refer to the above specific method, and details are not described herein.

Regardless of whether the network entity 402 is an S-CSCF, an AS or an AS-KMF, its internal structure diagram can be as shown in Figure 5d.

Referring to Figure 5d, network entity 402 includes:

The receiving unit 402m is configured to receive a session request message sent by the calling UE, and receive a session response message sent by the called UE.

The key obtaining unit 402n, when receiving the session request message sent by the calling UE, The key is added to the session request message, and is sent to the called UE by the sending unit. When receiving the session response message sent by the called UE, the key is added to the session response message, and sent to the calling party through the sending unit. UE.

The sending unit 402s sends a session request message to the called UE, and sends a session response message to the calling UE.

In actual application, if the network entity 402 is an S-CSCF or an AS, the key acquired by the network entity is the key provided by the KMF; if the network entity is AS-KMF, the key is the secret generated by the AS-KMF itself. key.

Wherein, if the network entity is AS-KMF, the key obtaining unit 402n may include: a key generating unit 402n1 for generating a key and providing it to the key adding unit 402n2. The key adding unit 402n2 is configured to add a key to the session request message when receiving the session request message sent by the calling UE, and send the message to the called UE by using the sending unit 402s; When the session responds to the message, the key is added to the session response message and sent to the calling UE through the sending unit 402s.

In an actual application, if the network entity only adds the key generated by the key generation unit 402n1 to the session message, it may be directly added by the key adding unit 402n2. If the network entity further needs to derive the key generated by the key generation unit 402n1 and the key generated by the network side of the other party, the key generated by the two parties may be derivatized first, and then the key addition unit 402n2 is used to derive the key. The key is added to the session message.

FIG. 5e is a schematic diagram of an internal structure of a UE in an embodiment of the present invention. As shown in FIG. 5e, the UE may include:

a transceiver unit 401x, configured to send and receive session messages;

The parsing unit 401y is configured to parse the key from the session message when the session message received by the transceiver unit 401x carries the key.

In practical applications, if the UE does not need to derivate the key, then the parsing unit of the UE The 401y can directly encrypt or decrypt the media stream by obtaining the key from the session message. If the session message received by the UE includes the key generated by the network side and the other party network side, the key derivation unit 401z may also be included.

The key deriving unit 401z is configured to: when the parsing unit 401y parses the key generated by the calling network side and the key generated by the called network side from the session message, the parsed key generated by the calling network side The key generated by the called network side is derived into a new key, and the derived key is used as a media stream protection key.

Of course, in practical applications, the UE also needs to include a storage unit, which can be used to store a key, such as a key parsed from a session response message, or a key derived from a key derivation unit. In this way, the UE can protect the media stream by using the key in the storage unit.

Applying the solutions of the foregoing method embodiments and system embodiments, a key may be generated by the network side and sent to the calling UE and the called UE respectively, and the calling UE and the called UE may use the acquired key pair to transmit the media. Stream protection. In addition, since the key is generated by the network side, it can meet the actual needs of the third party for legitimate interception. The foregoing method embodiments and system embodiments are all examples of user-to-user media stream protection, that is, after the calling UE and the called UE acquire the key, the media stream transmitted between the two UEs can be protected at all times. However, in practical applications, the media stream transmitted between two users may not be protected at all, but only one segment is protected, that is, the user can be protected to the network, and the network to the network portion is transmitted in plain text, or through The security mechanism of the network domain is protected and will not be described here.

FIG. 6 is a flowchart of an embodiment of a method for obtaining a media protection key, that is, a flowchart of Embodiment 4 of the method of the present invention.

As shown in FIG. 6, the method embodiment 5 may include the following steps:

Step 601: After the network entity receives the session message, from the key management function entity KMF Get the key.

Step 602: The network entity sends the acquired key to the terminal device UE and the media processing function entity (MP), respectively.

The network entity described here may be an S-CSCF or an AS. Take the network entity as the S-CSCF as an example:

If on the calling side, the network entity described herein may be the primary S-CSCF, the UE is the calling UE, the MP is the calling MP, and the KMF is the calling KMF. Correspondingly, if on the called side, the network entity described herein may be the called S-CSCF, the UE is the called UE, the MP is the called MP, and the KMF is the called KMF. That is to say, after receiving the session message, the calling S-CSCF obtains the key from the calling KMF, and then sends the obtained key to the calling UE and the calling MP respectively. After receiving the session message, the called S-CSCF obtains the key from the called KMF, and then sends the obtained key to the called UE and the called MP respectively.

Of course, how the master/called S-CSCF sends the key to the calling/called UE and the master/called MP is related to the specific call flow.

T匕: 3⁄4 port:

When the session message received by the calling S-CSCF is 200, the calling S-CSCF carries the key in a 200 message and sends it to the calling P-CSCF, and the calling P-CSCF will carry The 200 message of the key is sent to the calling UE, and the key is sent to the calling MP. Or,

When the session message received by the calling S-CSCF is a PRACK message or an UPDATE message, the calling S-CSCF carries the key in a PRACK message or an UPDATE message and sends it to the calling AS, and then the calling AS The key is sent to the calling MP. At the same time, when the calling S-CSCF receives the returned 200 message, the key is carried in the 200 message and sent to the calling UE. Or,

When the called S-CSCF receives a PRACK message or an UPDATE message, it will obtain The key is carried in the PRACK message or the UPDATE message and sent to the called P-CSCF. The called P-CSCF sends the PRACK message or the UPDATE message carrying the key to the called UE. or,

When the session message received by the called S-CSCF is a PRACK message or an UPDATE message, the called S-CSCF carries the acquired key in a PRACK message or an UPDATE message and sends it to the called UE. Meanwhile, at the called S- When the CSCF receives the returned 200 message, the key is carried in the 200 message and sent to the called AS, and then the called AS sends the key to the called MP.

If the network entity is AS, for example:

On the calling side, the network entity is the calling AS, the UE is the calling UE, the MP is the calling MP, and the KMF is the calling KMF; correspondingly, on the called side, the network entity For the called AS, the UE is the called UE, the MP is the called MP, and the KMF is the called KMF. That is to say, when the calling AS receives the session message, it will obtain the key from the calling KMF, and then send the obtained key to the calling UE and the calling MP respectively. After receiving the session message, the called AS obtains the key from the called KMF, and then sends the obtained key to the called UE and the called MP respectively.

For example, when the calling AS receives the 200 message, the obtained key is carried in the 200 message and sent to the calling P-CSCF through the calling S-CSCF, and then the calling P-CSCF carries the key. Sending a message to the calling UE, and sending the key to the calling MP; or

When the session message received by the calling AS is 200, the calling AS sends the obtained key directly to the calling MP. At the same time, the calling AS carries the key in the 200 message and passes the called S. - The CSCF and the called P-CSCF are sent to the calling UE. or, When the session message received by the called AS is a PRACK message or an UPDATE message, the called AS carries the key in a PRACK message or an UPDATE message, and sends it to the called P-CSCF through the called S-CSCF, and then The called P-CSCF sends the key to the called UE in the PRACK message or the UPDATE message, and sends the key to the called MP. or,

When the session message received by the called AS is a PRACK message or an UPDATE message, the called AS sends the obtained key directly to the called MP, and the called AS carries the key to the PRACK message or the UPDATE message. The called UE is sent to the called UE through the called S-CSCF and the called P-CSCF.

In an actual application, before the UE and the MP obtain the key, the security capability can be negotiated between the UE and the network entity. which is:

The calling UE sends an INVITE session establishment request message to the calling AS or the calling P-CSCF, where the INVITE request message carries the media stream security capability information provided by the calling UE, and the calling AS or the calling P-CSCF is further directed to the primary The UE is called to return a 183 response message carrying the media stream security capability information supported by the calling MP provided by the side. as well as,

After the called AS or the called P-CSCF receives the INVITE session establishment request message, the INVITE session establishment request message carrying the media stream security capability information supported by the called MP provided by the side is sent to the called UE, and the called party is called. The UE then returns a 183 session response message carrying the media stream security capability information provided by itself to the called AS or the called P-CSCF.

In addition, the MP may be a single functional entity, or may be a functional unit of a functional entity such as a GPRS gateway support node GGSN or a border gateway function entity BGF; the MP may also be a media resource function entity MRF, and the MRF may be a media resource. The control function entity MRFC and the media resource processing function entity MRFP are composed.

The KMF here can be a single device or a functional module in an AS, S-CSCF or HSS. The key sends a request message, which carries the key to be delivered, or includes the validity period of the key, and the MP returns a response message, where the request and response messages can be carried by using the Diameter protocol or the H.248 protocol.

In addition, the media stream security protection of the calling network side and the called side network may be independent or non-independent, that is, the calling network side entity adds in the request message sent to the called side network entity. The called side network is required to provide the identifier of the media stream security service, and the called side network entity checks the identifier to provide the called UE with the user-to-network media stream security protection service, so that the called UE and the calling network entity are called together. User-to-network media stream security protection can be performed between the UE and the called network entity.

In order to better illustrate the scheme for obtaining a key for user-to-network media stream protection, a detailed description will be made below with several preferred embodiments and system embodiments. Method Embodiment 6

In this embodiment, the network entity that generates the key on the calling side is called the AS, and the entity that generates the key is the KMF, which is an independent entity. The network entity that generates the generated key on the called side is called. AS, and the entity that generates the key is called KMF, which is also a separate entity.

FIG. 7 is a schematic diagram of a message flow of a method for obtaining a media stream protection key by a calling side in this embodiment. As shown in FIG. 7, the method may include the following steps:

Step 701: The calling UE sends a session establishment request message to the calling P-CSCF, where the session establishment request message carries the media stream security capability information provided by the calling UE.

Step 702: The calling P-CSCF continues to send a session establishment request message to the calling S-CSCF. The calling P-CSCF may send the provided media stream security capability information carrying re-session establishment request message supported by the calling MP to the calling S-CSCF; the calling P-CSCF may also send the media stream in the session establishment request message. After the security capability information is deleted, it is sent to the calling party. S-CSCF.

The session establishment request message described in this step is an INVITE message, and the media stream security capability information includes a security algorithm, and may also include one or more of a media type to be protected, a security transmission protocol type, and a security premise. The combination.

The security premise is used to indicate the security requirements of the media stream in the current session, and may include the strength identifier of the media stream security protection expected by the first entity, such as mandatory (mandatory), optional (optional), and negligible. ( none ). The security premise may also include a desired security negotiation configuration result and a current configuration situation, such as: whether to complete the negotiation, the receiving direction has completed the security configuration, and the receiving and transmitting methods complete the security configuration.

In addition, the media stream security capability information of the calling UE may be used by the calling UE to provide the media stream security capability information of the called UE. For example, the calling UE can support five security algorithms, but only three security algorithms can be selected for the called UE. Then, the INVITE message can carry only three security algorithms provided. Of course, the calling UE can also provide the supported 5 security algorithms to the called UE. How to determine the provided media stream security capability information needs to be determined by the actual situation.

Step 703: The calling S-CSCF sends the session establishment request message to the calling AS. In this step, the calling S-CSCF may use an initial filtering rule set in advance, and the session establishment request message is triggered to the calling AS. As for how to trigger, it belongs to the prior art, and will not be described here.

Step 704 ~ Step 706: The calling AS determines that the calling UE has subscribed to the media stream protection service, and then sends the session establishment request message to the called network through the calling S-CSCF.

In practical applications, the calling AS may be based on pre-recorded information related to the subscription. Determine whether the calling UE has subscribed to the media stream protection service. For example: querying the information related to the subscription according to the identifier of the calling UE in the session establishment request message, and determining, according to the information related to the subscription, whether the calling UE subscribes. Of course, the calling AS can also check the signing situation of the calling UE by other methods, and details are not described herein again.

In addition, when the calling AS determines that the calling UE has subscribed to the media stream protection service, the calling UE may also add the identifier of the subscribed media stream protection service to the session establishment request message. Of course, since the present embodiment is proposed for the media stream transmitted by the protection end to the network, the identifier of the media stream protection service that the calling UE has subscribed to may not be added. Here, the S-CSCF can check the contracted business by itself, instead of going to the AS for contract checking, or not signing the contract.

Here, the calling AS can delete the media stream security capability set in the INVITE message, or delete the INVITE message carrying the security capability set of the calling side media stream directly to the called S-CSCF, called S. The CSCF or the called AS can refer to the media stream security capability information for media stream security capability negotiation.

Step 707 ~ Step 710: After receiving the session establishment response message returned from the called network, the calling S-CSCF forwards the session establishment response message to the calling AS, and after receiving the session establishment response message returned from the calling AS , and then sent to the calling P-CSCF.

The session establishment response message described here is a 183 message.

Step 711: The calling P-CSCF carries the provided media stream security capability information supported by the calling MP in the session establishment response message, and returns the message to the calling UE.

The media stream security capability information supported by the calling MP provided by the calling P-CSCF is all or part of information that can be supported by the calling UE. The P-CSCF can obtain the media stream security capability information supported by the MP through the configuration method or the method of querying the calling MP. Other methods obtained are not described here.

In this embodiment, the steps 701 to 711 are actually the calling UE and the calling P-CSCF. The process of negotiating the security capability between the MP and the MP can obtain parameters such as a security algorithm and a secure transmission protocol, so as to determine the media stream security capability information used for the session.

Step 712 to step 717: The calling UE sends a session message to the calling S-CSCF through the calling P-CSCF, and the calling S-CSCF sends the session message to the calling AS again, and the calling AS deletes the provided by the calling UE. The media stream security capability information returns a session message to the calling S-CSCF, and the calling S-CSCF sends the returned session message to the called network.

Of course, the calling AS may not delete the media stream security capability information negotiated by the calling UE and the P-CSCF; here, the calling P-CSCF may also delete the media stream security capability set in the request message, so that the calling AS cannot The media stream security capability set is obtained, and the subsequent AS request key process does not need to refer to the media stream security capability set to apply.

The session message described here is a PRACK message. In actual application, when the calling UE receives the session establishment response message, the media stream security capability information for the current session is determined according to the media stream security capability information supported by the calling MP provided by the P-CSCF, and is used for The media stream security capability information of the current session is carried in the session request message.

Step 718 to step 719: The calling S-CSCF receives the session response message returned by the called network and forwards it to the calling AS.

The session response message described here is a 200 message.

Step 720 ~ Step 721: The calling AS obtains the key from the calling KMF, and carries the obtained key in the session response message and sends it to the calling S-CSCF.

In actual application, the calling AS can send a key request message to the calling KMF. The calling KMF generates a key and returns it to the calling AS. The calling AS then carries the obtained key in the session response message, that is, in the 200 message. Sent to the calling S-CSCF. The message between the calling AS and the calling party KMF can use the Diameter protocol or the SIP protocol.

In actual application, the calling KMF can also send information such as the key validity period and key identification of the key to the calling AS. In an actual application, if the calling UE determines the media stream security capability information for the current session and carries the session request message in step 717, the calling AS receives the media stream security capability for the current session. When the information is obtained, the key can be obtained from the calling KMF according to the media stream security capability information for the current session in the session request message. Of course, in an actual application, the calling AS may obtain the key directly from the calling KMF without acquiring the key from the calling KMF according to the session request message.

Step 722 to step 724: The calling S-CSCF sends the session response message to the calling P-CSCF, and the calling P-CSCF continues to send the session response message to the calling UE, and the session response message is sent. The key carried in the key is sent to the calling MP.

In an actual application, the calling P-CSCF may first send the session response message to the calling UE, and then send the key in the session response message to the calling MP. The key in the message is sent to the calling MP, and the session response message is sent to the calling UE. In addition, the calling P-CSCF may also save the information such as the key to be sent to the MP, and then send it to the MP after receiving the UPDATE message sent by the calling UE or the 200 message sent by the called UE.

At this point, both the calling UE and the calling MP have obtained a key, which can be used to protect the media stream. Of course, in the actual application, the calling UE also needs to perform a subsequent call procedure. For example, the calling UE sends an UPDATE message to the called network through the calling P-CSCF and the calling S-CSCF, and receives the returned 200 message. For details on the subsequent call process, refer to the prior art, and details are not described herein again. Here, the UPDATE message and the returned 200 message can also be used instead of the PRACK message and the 200 message used in the above, and the specific content is similar, and will not be described here.

In this embodiment, FIG. 7 is a schematic diagram of a message flow in which a calling UE and a calling MP acquire a media stream protection key. In an actual application, the called side may not allocate a media stream protection key for the called UE and the called MP, but perform an existing normal call procedure; the called side may also be the called UE. And the called MP assigns a key. That is to say, the process of assigning keys on the calling side and the called side is independent of each other, and only one side can assign a key, and the other side can be executed according to the existing ordinary call flow, or the keys can be allocated on both sides.

For the case where the called side assigns a key to the called UE and the called MP, a method similar to the calling side can be utilized. FIG. 8 is a schematic diagram of a message flow of a method for acquiring a media stream protection key on a called side. As shown in FIG. 8, the method may include the following steps:

Step 801 ~ Step 802: The called S-CSCF receives the session establishment request message from the calling network and forwards it to the called AS.

The session establishment request message described herein may be an INVITE message.

Similar to step 702, the called S-CSCF may trigger a session establishment request message to the called AS by using an initial filtering rule set in advance. As for how to trigger, it belongs to the prior art, and will not be described here.

Step 803 ~ Step 805: The called AS determines that the called UE has subscribed, and then sends the session establishment request message to the called P-CSCF through the called S-CSCF.

The called AS may also not perform the process of determining that the called UE has subscribed.

Step 806: The called P-CSCF adds the provided media stream security capability information supported by the called MP to the session establishment message, and then sends the message to the called UE.

Step 807: The called UE returns a session establishment response message to the called P-CSCF, where the session establishment response message carries the media stream security capability information provided by the called UE.

The session establishment response message here is 183 message. When the called UE receives the session establishment request message, the media stream security capability information supported by the called MP and the media stream security capability information that can be supported by the called P-CSCF in the message may be determined according to the media stream to be provided. Security capability information. Here, the called P-CSCF also determines the media stream security capability information used in the session, and adds the confirmed media stream security capability information to the 183 response message. Step 808 ~ Step 809: The called P-CSCF sends a session establishment response message to the called S-CSCF, and the called S-CSCF forwards the session establishment response message to the called AS.

Here, when the called P-CSCF receives the session establishment response message, the media stream security capability information for the current session may be determined from the media stream security capability information carried in the session establishment response message, and carried in the session establishment response. In the message. Of course, the called P-CSCF can also delete the media stream security capability set in the response message, so that the called AS cannot obtain the media stream security capability set, and the subsequent AS request key process does not need to refer to the media stream security. Ability set to apply.

Step 810 to step 812: The called AS deletes the media stream security capability information in the session establishment response message, and then sends the session establishment response message to the calling network through the called S-CSCF.

Of course, the called AS here may also not delete the media stream security capability information.

Step 813 to step 814: The called S-CSCF receives the session message from the calling network, and forwards the session message to the called AS.

The session message described here is a PRACK message.

Step 815 ~ Step 816: The called AS obtains the key from the called KMF, adds the obtained key to the session message, and sends it to the called S-CSCF.

Similar to steps 720 to 721 of FIG. 7 in this embodiment, when the key needs to be obtained from the called KMF, the called AS can also send a key request message to the called KMF, and the called KMF generates a key and returns it to The called AS, the called AS carries the acquired key in the session request message, that is, the PRACK message is sent to the called S-CSCF. The message exchanged between the called AS and the called KMF can use the Diameter protocol or the SIP protocol.

Similarly, the called KMF can also send information such as the key validity period and key identification of the key to the called AS.

Steps 817 to 819: The called S-CSCF sends a session message to the called P-CSCF, and the called P-CSCF sends the session message to the called UE, and the session message is The key is sent to the called MP.

Of course, if the session message also carries information such as the key validity period and the key identifier of the key, the called P-CSCF also needs to send the key validity period, the key identifier, and the like to the called party. MP. Of course, the called P-CSCF can also send the media stream security capability information in the session message, such as the media type and the secure transmission mode, to the called MP.

In addition, the called P-CSCF may also save the information such as the key to be sent to the called MP, and then send the UPDATE message sent by the called S-CSCF or the 200 message of the called UE to the MP.

At this time, the media stream protection key obtained by both the called UE and the called MP can use the key to protect the transmitted media stream. In the actual application, after the step 819, a subsequent call flow is also required, for example, the called UE sends a 200 message to the calling network through the called S-CSCF and the called P-CSCF, and receives the message from the calling network. UPDATE messages, etc., will not be described here. Method Embodiment 7

In this embodiment, the network entity that obtains the key generated by the calling side is called the S-CSCF, and the key that generates the key is the calling KMF; and the network entity that obtains the generated key of the called side is the called S-CSCF, and The generated key is called KMF.

FIG. 9 is a schematic diagram of a message flow of a method for acquiring a media stream protection key by a calling side in this embodiment. As shown in FIG. 9, the method may include the following steps:

Step 901 to step 902: The calling UE sends a session establishment request message to the calling S-CSCF through the calling P-CSCF, where the session establishment request message carries the media stream security capability information provided by the calling UE.

The session establishment request message is an INVITE message, and the steps 901 to the step are performed. 902 is the same as step 701 to step 702 in the fifth embodiment, and details are not described herein again.

Step 903: The calling S-CSCF sends the session establishment request message to the calling AS. The step 903 is the same as the step 703 in the fifth embodiment, and details are not described herein again. Step 904 ~ Step 906: The calling AS determines that the calling UE has subscribed to the media stream protection service, and then sends the session establishment request message to the called network through the calling S-CSCF.

The steps 904 to 906 are the same as the steps 704 to 706 in the fifth embodiment, and are not described herein again.

Step 907 ~ Step 908: The calling S-CSCF receives the session establishment response message returned from the called network and directly sends it to the calling P-CSCF.

Here, the session establishment response message is 183 message, and the flow thereof and the steps of the fifth embodiment

707 ~ Step 710 is similar, but can no longer pass the calling AS.

Step 909: The calling P-CSCF carries the provided media stream security capability information supported by the calling MP in the session establishment response message, and returns the message to the calling UE.

This step is the same as step 711 in the fifth embodiment, and details are not described herein again.

Step 910 to step 913: The calling UE sends a session message to the calling S-CSCF through the calling P-CSCF, and the calling S-CSCF deletes the media stream security capability information provided by the calling UE in the session message, and then the session is The message is sent to the called network. The calling S-CSCF here may also not delete the media stream security capability information in the session message.

The session message described here is a PRACK message. In actual application, when the calling UE receives the session establishment response message, the media stream security capability information for the current session may be determined according to the media stream security capability information supported by the calling MP provided by the calling P-CSCF, and The media stream security capability information for the current session is carried in the session request message.

Step 914: The calling S-CSCF receives the session response message returned by the called network.

The session response message described here is a 200 message.

Step 915 to step 916: The calling S-CSCF obtains a key from the calling KMF, and will obtain The key is carried in the session response message and sent to the calling P-CSCF.

Similar to the fourth embodiment, here, the calling S-CSCF can send a key request message to the calling KMF, the calling KMF generates a key and returns it to the calling S-CSCF; the calling S-CSCF will then acquire the key. It is carried in the session response message, that is, the 200 message is sent to the calling P-CSCF. The message between the calling S-CSCF and the calling KMF can be either Diameter or SIP.

In actual application, the calling KMF can also send information such as the key validity period and key identification of the key to the calling S-CSCF.

Step 917 to step 918: The calling P-CSCF sends the session response message to the calling UE, and sends the key in the session response message to the calling MP.

At this time, both the calling UE and the calling MP obtain a key, and the key can be used to protect the transmitted media stream.

As in the fifth embodiment, the calling UE needs to perform a subsequent call flow in this embodiment, and details are not described herein again.

In addition, the calling P-CSCF may also save the information such as the key that needs to be sent to the calling MP, and then send it to the MP after receiving the UPDATE message sent by the calling UE or the 200 message of the called UE.

In this embodiment, FIG. 9 is a schematic diagram of a message flow in which a calling UE and a calling MP acquire a media stream protection key. For the case where the called side assigns a key to the called UE and the called MP, a method similar to the calling side can be utilized.

FIG. 10 is a schematic diagram of a message flow of a method for acquiring a media stream protection key on the called side in this embodiment. As shown in FIG. 10, the method may include the steps of:

Step 1001 ~ Step 1002: The called S-CSCF receives the session establishment request message from the calling network and forwards it to the called AS.

The session establishment request message described herein may be an INVITE message, the steps The steps 1001 to 1002 are the same as the steps 801 to 802 in the fifth embodiment, and are not described here.

Step 1003 to step 1005: The called AS determines that the called UE has subscribed, and then sends a call setup request message to the called P-CSCF through the called S-CSCF.

The called AS or S-CSCF may also not perform the process of determining that the called UE has subscribed. The steps 1003 to 1005 are the same as the steps 803 to 805 in the fifth embodiment of the method, and are not described here.

Step 1006: The called P-CSCF adds the provided media stream security capability information supported by the called MP to the session establishment message, and then sends the message to the called UE.

This step is the same as step 806 in the fifth embodiment, and details are not described herein again.

Step 1007: The called UE returns a session establishment response message to the called P-CSCF, where the session establishment response message carries the media stream security capability information provided by the called UE.

This step is the same as the step 807 of the method implementation, and the session establishment response message is a 183 message, which is not described here.

Steps 1008 to 1010: The called P-CSCF sends the session establishment response message to the called S-CSCF, and the called S-CSCF deletes the media stream security capability information in the session establishment response message, and then sends the message to the host. Call the network.

The called S-CSCF may also not delete the media stream security capability information in the session establishment response message.

Step 1011 ~ Step 1013: The called S-CSCF receives the session message from the calling network, acquires the key from the called KMF, adds the obtained key to the session message, and sends it to the called P-CSCF.

The session message described here is a PRACK message.

Step 1014 to step 1015: The called P-CSCF sends the session message to the called UE, and sends the key in the session message to the called MP. At this time, the media stream protection key obtained by both the called UE and the called MP can use the key to protect the transmitted media stream. Certainly, after step 1015, a subsequent call flow is actually needed, for example, the called UE sends a 200 message to the calling network through the called S-CSCF, the called P-CSCF, and receives an UPDATE message from the calling network. I will not repeat them here.

In addition, the called P-CSCF may also save the information such as the key to be sent to the called MP, and then send the UPDATE message sent by the called S-CSCF or the 200 message of the called UE to the MP. Method Embodiment 8

In this embodiment, the network entity that generates the key generated by the calling side is the calling AS, the entity that generates the key is the calling KMF, and the MP is the calling MP; Called AS, and the key generated is called KMF.

In addition, in this embodiment, the calling MP is a calling MRF, and the called MP is a called MRF. Here, the MRF can re-initiate a session message when receiving the session message. For example: When receiving an INVITE message, the MRF can regenerate another INVITE and continue to transmit the regenerated INVITE to the next entity. As for how to regenerate the session message, it belongs to the prior art, and will not be described here.

In this embodiment, only the case where the AS is used as the back-to-back user agent B2BUA is taken as an example; in an actual implementation, the AS may also only modify the media stream security-related information in the incoming call on the calling side without re-initiating a new one. In addition, the AS can also negotiate with the calling party after negotiating with the called party. The specific process is similar to that of the calling party.

FIG. 11 is a schematic diagram of a message flow for acquiring a media stream protection key by a calling side in this embodiment. As shown in FIG. 11, the method includes the following steps: Step 1101: The calling UE sends a session establishment request message to the calling S-CSCF, where the session establishment request message carries the media stream security capability information provided by the calling UE.

This step is the same as the step 701 to the step 702 in the fifth embodiment. The calling UE also needs to send a session establishment request message through the calling P-CSCF, but in this embodiment, the calling P-CSCF is only used for the message. Forwarding does not issue a key, so the description of the P-CSCF is ignored.

The session establishment request message described in this step is an INVITE message, but in order to distinguish from the subsequent INVITE message, the INVITE message described here is INVITE[1].

Step 1102: The calling S-CSCF sends the session establishment request message to the calling AS. This step is the same as step 703 of the fifth embodiment, and details are not described herein again.

Step 1103 to Step 1105: The calling AS determines that the calling UE has signed the contract, and then sends the session establishment request message regenerated by itself to the called network through the calling S-CSCF.

Here, the calling AS or the calling S-CSCF may not perform the contract checking.

The steps 1103 to 1105 are similar to the steps 704 to 706 in the fifth embodiment, except that the calling AS regenerates a session establishment request message, and the regenerated session establishment request message can be recorded as INVITE[2]. .

Step 1106 to step 1107: After receiving the session establishment response message returned from the called network, the calling S-CSCF forwards the session establishment response message to the calling AS.

The session establishment response message described here is a 183 message, which is a response message for INVITE[2], which can be recorded as a 183 [2] message.

Step 1108 to step 1109: The calling AS regenerates a session establishment response message, where the regenerated session establishment response message carries the media stream security capability information provided by the calling MRF, and sends the regenerated session establishment response message. The calling S-CSCF is sent by the calling S-CSCF to the calling UE.

Here, the session establishment response message regenerated by the calling AS is for the INVITE[1] The message should be recorded as a 183[1] message.

The media stream security capability information provided by the MRF may be all or part of information that can be supported by the calling UE.

Step 1110 to Step 1111: The calling UE sends a session message to the calling S-CSCF, and the calling S-CSCF sends the session message to the calling AS.

The session message is a PRACK message, which can be recorded as PRACK[1] in order to distinguish it from the PRACK message generated by the subsequent calling AS.

Step 1112 to Step 1113: The calling AS regenerates the session message, and sends the regenerated session message to the calling S-CSCF, and then the calling S-CSCF sends the session message to the called network.

Here, the PRACK regenerated by the calling AS may be recorded as a PRACK[2] message. Step 1114 to step 1115: The calling S-CSCF receives the session response message from the called network, and sends the session response message to the calling AS.

Here, the session response message is a 200 message, and since the message is for PRACK[2], it can be recorded as a 200[2] message.

Step 1116 to step 1119: The calling AS obtains the key from the calling KMF, and the obtained key is sent to the calling MRF, and the session response message is regenerated, and the obtained key is carried in the regenerated session response message. It is sent to the calling UE through the calling S-CSCF.

Here, the session response message regenerated by the calling AS is 200, and since the message is for PRACK[1], it can be recorded as 200[1].

At this point, both the calling UE and the calling MRF obtain a key, which can be used to protect the transmitted media stream.

In this embodiment, FIG. 11 is a schematic diagram of a message flow in which a calling UE and a calling MRF obtain a media stream protection key. In practical applications, if the called side wants to assign a key to the called UE and the called MRF, a similar method on the calling side can be utilized. FIG. 12 is a schematic diagram of a message flow for acquiring a media stream protection key on the called side in this embodiment. As shown in FIG. 12, the method may include the following steps Step:

Step 1201 ~ Step 1202: The called S-CSCF receives the session establishment request message from the calling network and forwards it to the called AS.

In order to correspond to the calling side, the session establishment request message received by the called S-CSCF is INVITE[2].

Steps 1203 to 1205: The called AS determines that the called UE has subscribed, re-generates the session establishment request message, and carries the media stream security capability information provided by the called MRF in the regenerated session establishment request message. It is sent to the called UE through the called S-CSCF.

The called AS or the called S-CSCF may also not perform the check that the called UE has signed the contract.

Here, in order to distinguish the above-mentioned calling AS re-generation session establishment request message, the session establishment request message regenerated by the called AS may be recorded as INVITE[3].

Step 1206: The called UE returns a session establishment response message to the called S-CSCF, where the session establishment response message carries the media stream security capability information provided by the called UE.

The session establishment response message described here is a 183 message, and since it is a response response message for INVITE[3], it can be recorded as a 183[3] message.

Step 1207 to step 1209: The called S-CSCF sends the received session establishment response message to the called AS, and the called AS regenerates the session establishment response message, and sends the regenerated session establishment response message to the called S. -CSCF, which is then sent by the called S-CSCF to the calling network.

Here, the session establishment response message regenerated by the called AS is for the previous INVITE[2] message, which can be recorded as 183 [2].

Step 1210 ~ Step 1211: The called S-CSCF receives the session message from the calling network and forwards the session message to the called AS. The session message here is a session request message, that is, a PRACK[2] message sent by the calling network.

Steps 1212 to 1215: The called AS obtains a key from the called KMF, and the obtained key is sent to the called MRF, and the session message is regenerated, and the acquired key is carried in the regenerated session message. It is sent to the called UE through the called S-CSCF.

Here, the session message regenerated by the called AS is a PRACK[3] message.

At this time, the key obtained by both the called UE and the called MRF can use the key to protect the transmitted media stream.

Certainly, after step 1215, the called UE also needs to perform a subsequent call procedure, for example, the called UE sends a 200 message to the calling network through the called S-CSCF and the called AS, and then receives an UPDATE message. In the subsequent call process, the called AS can still regenerate the session message sent from the called S-CSCF, and details are not described here. The PRACK message and the corresponding 200 response message can be replaced by the UPDATE message and the corresponding 200 response message. The specific process is similar and will not be described here. Method embodiment nine

In this embodiment, the network entity that obtains the key generated by the calling side is called the S-CSCF, and the entity that generates the key is called the KMF; the network entity that generates the key generated by the calling side is the called S-CSCF, and generates The entity of the key is KMF.

In addition, in this embodiment, the calling MP is the calling MRF, and the called MP is the called MRF.

In this embodiment, only the case where the AS is used as the back-to-back user agent B2BUA is taken as an example; in an actual implementation, the AS may also only modify the media stream security-related information in the incoming call on the calling side without re-initiating a new one. The session process; in addition, the AS can also negotiate with the called party before negotiating with the called party. The specific process is similar here. Narration.

FIG. 13 is a schematic diagram of message flow of a method for acquiring a media stream protection key by a calling side according to this embodiment. As shown in FIG. 13, the method may include the following steps:

Step 1301: The calling UE sends a session establishment request message to the calling S-CSCF, where the session establishment request message carries the media stream security capability information provided by the calling UE.

This step is the same as step 1101 in the seventh embodiment. The session establishment request message described here is INVITE[1], and details are not described herein again.

Step 1302: The calling S-CSCF sends the session establishment request message to the calling AS. This step is the same as step 1102 of the seventh embodiment, and details are not described herein again.

Step 1303 ~ Step 1305: The calling AS determines that the calling UE has signed the contract, and then sends the session establishment request message regenerated by itself to the called network through the calling S-CSCF.

The steps 1303 to 1305 are the same as the steps 1103 to 1105 of the seventh embodiment, and the regenerated session establishment request message may be recorded as INVITE[2], which is not described here.

Step 1306 ~ Step 1307: After receiving the session establishment response message returned from the called network, the calling S-CSCF forwards the session establishment response message to the calling AS.

The steps 1306 to 1307 are the same as the steps 1106 to 1107 in the seventh embodiment. The session establishment response message is 183 [2] message, and details are not described herein again.

Step 1308 to step 1309: The calling AS regenerates a session establishment response message, where the regenerated session establishment response message carries the media stream security capability information provided by the calling MRF, and sends the regenerated session establishment response message. The calling S-CSCF is sent by the calling S-CSCF to the calling UE.

The steps 1308 to 1309 are the same as the steps 1108 to 1109 of the seventh embodiment, and the session establishment response message regenerated by the calling AS is a 183[1] message.

Step 1310 to step 1312: The calling UE sends a session message to the calling S-CSCF, the main The S-CSCF is called to obtain a key from the calling KMF, and the obtained key is carried in the session message and sent to the calling AS.

The session message described here is a session request message, that is, a PRACK message. In order to distinguish it from the PRACK message regenerated by the subsequent calling AS, it can be recorded as a PRACK[1] message.

Step 1313 ~ Step 1315: The calling AS sends the key in the session message sent by the calling S-CSCF to the calling MRF, regenerates the session message, and sends the regenerated session message to the calling party S. -CSCF, then sent by the calling S-CSCF to the called network.

The regenerated session message described herein can be written as PRACK[2].

Step 1316 to step 1319: The calling S-CSCF receives the session response message from the called network, sends the session response message to the calling AS, and receives the session response message regenerated by the calling AS, and then acquires the session in advance. The key is carried in the session response message regenerated by the calling AS and sent to the calling UE.

The session response message described here is a session response message for PRACK[2], i.e., a 200[2] message. The session response message regenerated by the calling AS is a session response message for PRACK[1], that is, 200[1].

At this point, the calling UE and the calling MRF have obtained a key, which can be used to protect the transmitted media stream. Of course, after step 1319, the subsequent call process needs to be performed, and details are not described herein again. In this embodiment, FIG. 13 is a schematic diagram of a message flow in which a calling UE and a calling MRF obtain a media stream protection key. In practical applications, if the called side wants to assign a key to the called UE and the called MRF, a similar method on the calling side can be utilized.

FIG. 14 is a schematic diagram of a message flow for acquiring a media stream protection key on the called side in this embodiment. As shown in FIG. 14, the method may include the following steps:

Step 1401 ~ Step 1402: The called S-CSCF receives the session establishment from the calling network. Request a message and forward it to the called AS.

The steps 1401 to 1402 are the same as the steps 1201 to 1202 in the seventh embodiment, and the session establishment request message is INVITE[2], and details are not described herein again.

Steps 1403 to 1405: The called AS determines that the called UE has subscribed, re-generates the session establishment request message, and carries the media stream security capability information provided by the called MRF in the regenerated session establishment request message. It is sent to the called UE through the called S-CSCF.

The steps 1403 to 1405 are the same as the steps 1203 to 1205 in the seventh embodiment. The session establishment request message regenerated by the called AS is INVITE[3], and is not described here.

Step 1406: The called UE returns a session establishment response message to the called S-CSCF, where the session establishment response message carries the media stream security capability information provided by the called UE.

This step is the same as step 1206 of the seventh embodiment, and the session establishment response message is a 183 [3] message.

Step 1407 ~ Step 1409: The called S-CSCF sends the received session establishment response message to the called AS, and the called AS regenerates the session establishment response message, and sends the regenerated session establishment response message to the called S. -CSCF, which is then sent by the called S-CSCF to the calling network.

The steps 1407 to 1409 are the same as the steps 1207 to 1209 in the seventh embodiment, and the session establishment response message regenerated by the called AS is 183 [2], and details are not described herein again.

Step 1410 ~ Step 1411: The called S-CSCF receives the session message from the calling network, and forwards the session message to the called AS.

The session message here is a session request message, that is, a PRACK[2] message sent by the calling network. Step 1412: The called AS regenerates the session message, and sends the regenerated session message to the called S-CSCF.

In order to distinguish from the received PRACK[2] message, the session message regenerated by the called AS can be recorded as PRACK[3].

Step 1413 ~ Step 1414: The called S-CSCF obtains the key from the called KMF, and carries the obtained key in the regenerated session message and sends it to the called UE.

Step 1415: The called UE sends a session response message to the called S-CSCF.

The session response message here is a session response message for PRACK[3], ie 200[3] message.

Step 1416 to step 1419: The called S-CSCF carries the previously acquired key in the session response message and sends it to the called AS. The called AS sends the key in the session response message to the called MRF, and The session response message is regenerated, and the regenerated session response message is sent to the calling network through the called S-CSCF.

At this time, both the called UE and the called MFR obtain a key, which can be used to protect the transmitted media stream. The present invention also provides a system for acquiring a media stream protection key in an IMS network, in response to the above method for securing a user to a media stream transmitted by a network.

Figure 15 is a schematic diagram of the basic structure of the system. As shown in Figure 15, the system includes:

a UE1501, configured to receive a key sent by a network entity;

a network entity 1502, configured to receive a session message, obtain a key from the KMF1503, and send the key to the UE1501 and the MP1504;

KMF1503, used to generate a key;

MP1504, used to receive the key sent by the network entity.

In an actual application, the network entity 1502 may be an S-CSCF or an AS. The system can implement a system for acquiring a media stream protection key on the calling side, or a system for obtaining a protection key for the called side. If the calling party is the calling party, the UE 1501 is the calling UE, the network entity 1502 is the calling S-CSCF or the calling AS, the KMF 1503 is the calling KMF, and the MP 1504 is the calling MP.

Of course, if the network entity is an S-CSCF, the system may further include an AS, and may further include a P-CSCF; if the network entity is an AS, the system may further include an S-CSCF, and may further include a P-CSCF. The KMF of the present invention may be a separate entity or a functional unit in a CSCF, AS or HSS. In order to better illustrate the above system for obtaining a media stream protection key in the case of user-to-user media stream protection, a detailed description will be made below using a preferred system embodiment. System Embodiment 4

Figure 16 is a schematic diagram showing the basic structure of the fourth embodiment of the system. As shown in FIG. 16, the system embodiment includes: a calling UE 1501, a calling S-CSCF 1502A, a calling KMF 1503, and a calling party.

MP1504, the calling party P-CSCF1505. The calling P-CSCF is used to forward the message exchanged between the calling UE 1501 and the calling S-CSCF 1502A, and is also used for future autonomous calling.

The key in the S-CSCF session message is sent to the calling party MP1504. The functions and structures of the other entities are the same as those of the corresponding entity in FIG.

When the media stream protection key needs to be obtained, the calling UE 1501 sends a session message to the calling S-CSCF 1502A through the calling P-CSCF 1505, and the calling S-CSCF 1502A obtains the key from the calling KMF1503, and passes the obtained key. The session response message is sent to the caller

The P-CSCF 1505, the calling P-CSCF 1505, then sends the key to the calling UE 1501 and the calling MP.

Of course, the entities described in this embodiment are also used for other functions related to the execution of the call flow. The functions or processes implemented by the embodiments may be referred to the foregoing method embodiments of the present invention. No longer.

Of course, in the actual application, the system may further include a calling AS, which is used to check whether the calling UE is subscribed. For how to check, refer to the foregoing method embodiment, and details are not described herein.

In addition, the calling MP1504 in the embodiment of the present system receives the issued key from the calling P-CSCF 1505, and in actual application, the calling MP1504 can also directly from the calling S-CSCF and the calling AS. Obtain the delivered key. System implementation five

Figure 17 is a schematic diagram showing the basic structure of an embodiment of the present system. As shown in FIG. 17, the system embodiment includes: a calling UE 1501, a calling AS 1502B, a calling KMF 1503, and a calling MP 1504.

The system may also include a calling P-CSCF and a calling S-CSCF, but different from the system embodiment 4, the calling S-CSCF described herein is no longer obtained from the calling KMF, and may only be used as a forwarding message. The entities and other entities have the same functions and structures as the corresponding entities described in FIG. 15, and are not described herein again.

When the media stream protection key needs to be obtained, the calling UE 1501 sends a session message to the calling AS 1502B through the calling P-CSCF and the calling S-CSCF, and the calling AS 1502B obtains the key from the calling KMF 1503, and acquires the key. The key is directly sent to the calling party MP1504, and the message is carried in the session response message, and sent to the calling UE 1501 by the calling S-CSCF and the P-CSCF.

Similar to the third embodiment of the system, in the actual application, the calling party AS1502B can also be used as an entity for checking the subscription of the calling UE 1501, and details are not described herein again.

Similarly, the calling AS in the embodiment of the system may also send the key to the calling MP through the calling S-CSCF or the calling P-CSCF.

The third embodiment of the system and the fourth embodiment of the system are all based on the calling side. In the actual application, if the called side needs to allocate a key for the called UE and the called MP, the structure of the system is similar to that of the calling side, and details are not described herein again.

In addition, regardless of whether the network entity in FIG. 15 is a calling network entity or a called network entity, its internal structure may be as shown in FIG. 18, including:

The receiving unit 1801 is configured to receive a session message.

The key obtaining unit 1802, upon receiving the session message, acquires a key from the key management function KMF, adds the key to the session message, and transmits the key to the transmitting unit 1803.

The sending unit 1803 sends the session message carrying the key to the UE and the media processing function MP.

In the present invention, whether it is a method for acquiring a key for protecting a media stream transmitted by a user to a user, or a method for acquiring a key for protecting a media stream transmitted by a user to a network, in the INVITE message, The media stream security capability information may include one or a combination of any one of a media type, a secure transmission protocol type, and a security premise to be protected, in addition to the security algorithm. The media stream security capability information may also include one or a combination of any one of a media type, a secure transmission protocol type, and a security premise, and whether the key and the security are included in the message that the user or the user interacts with the network. The algorithm is related to the specific implementation.

The key generated by the network side may be carried in the media stream security capability information and sent to the other party. At this time, the media stream security capability information may further include parameters such as a key validity period. If there are multiple media streams to be protected, a different key may be generated for each different media stream. The media stream security capability information may further include a key identifier to distinguish the corresponding media stream.

The security algorithm may be carried as a crypto-suite parameter in the a =crypto header field in the Media Stream Security Description Protocol (SDES) defined in rfc 4568; the generated key, key identifier, key validity period, etc. may be Inline in the SDES protocol a =crypto header field (inline) The key-params parameter of the subheader field is carried.

If the Multimedia Internet Key Agreement (MIKEY) management protocol is adopted, the security algorithm, including the key length, key generation rate, and the like, may be carried in the Security Policy payload field in the RFC 3830 MIKEY protocol. Among the defined parameters. The generated key, the key validity period, and the like may be carried in a key transfer payload (KEMAC, Key data transport payload) field. The entire MIKEY message can be carried in the a =key-mgmt SDP attribute field specified in RFC4567.

The security algorithm may also be extended by a security algorithm header field in a Session Initiation Protocol (SIP); likewise, the generated key, key identifier, key validity period, etc. may also be extended in the SIP protocol. Head domain to carry.

Applying the solution of the embodiment of the present invention, the key can be generated by the network side, and the generated key is sent to the entity that needs to protect the media stream, so as to protect the transmitted media stream. In addition, since the key is generated by the network side entity or functional unit, that is, KMF, the actual requirement of the third party legal interception can be met.

In conclusion, the above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A method for obtaining a media stream protection key in an IMS network, characterized in that the method comprises the following steps:

a, the calling terminal device UE sends a session request message to the network entity, the network entity adds the key to the session request message, and sends the message to the called UE;

The method according to claim 1, wherein the step a is specifically: axl, after receiving the session request message sent by the calling UE, the calling network entity acquires a key generated by the calling network side, And sending, by the session request message, the key generated by the calling network side to the called network entity;

After receiving the session request message, the called network entity obtains the key generated by the called network side and adds the key to the session request message, and then sends the session request message to the called UE.

The method according to claim 2, wherein, after the sending the session request message to the called UE, the method further includes:

The called UE derives a new key according to the key generated by the calling network side in the message and the key generated by the called network side, and uses the derived key as the media stream protection key.

The method according to claim 1, wherein the step a is specifically: ayl, after receiving the message sent by the calling UE, the calling network entity acquires a key generated by the calling network side, and The key generated by the calling network side is sent to the called network entity by using the session request message;

Ay2, after receiving the session request message, the called network entity obtains a key generated by the called network side, and derives a new key according to the key generated by the calling network side and the key generated by the called network side. The key is sent to the called UE as a media stream protection key in the session request message.

The method according to any one of claims 2 to 4, wherein the session request message sent to the called UE is a PRACK or an UPDATE message.

The method according to any one of claims 2 to 4, wherein the calling network entity is a calling call session control function entity S-CSCF or a calling application server AS, and the called network entity Is called S-CSCF or called AS;

The method for the calling S-CSCF or the calling AS to obtain the key generated by the calling network side is: the calling S-CSCF or the calling AS sends a key request message to the calling key management function entity KMF, the calling party KMF returns the generated key to the calling S-CSCF or the calling AS through the key response message;

The method for the called S-CSCF or the called AS to obtain the key generated by the called network side is: the called S-CSCF or the called AS sends a key request message to the called KMF, and the called KMF will generate the key. The key is returned to the called S-CSCF or the called AS through a key response message.

The method according to any one of claims 2 to 4, wherein the calling network entity is called AS-KMF, and the called network entity is called AS-KMF;

The method for the calling AS-KMF to obtain the key generated by the calling network side is: the calling AS-KMF generates a key, and the generated key is used as a key generated by the calling network side;

The method for the called AS-KMF to acquire the key generated by the called network side is as follows: The called AS-KMF generates a key, and the generated key is used as a key generated by the called network side.

The method according to claim 1, wherein the step b is specifically: bxl, the called network entity receives the session response message returned by the called UE, and carries the key generated by the called network side. In the session response message, and sent to the calling network entity; bx2, after receiving the session response message, the calling network entity adds the key generated by the calling network side to the session response message and sends it to the main Called UE.

The method according to claim 8, wherein, after the sending the session response message to the calling UE, the method further includes:

The calling UE derives a new key according to the key generated by the calling network side in the message and the key generated by the called network side, and uses the derived key as the media stream protection key.

The method according to claim 1, wherein the step b is specifically: byl, the called network entity receives the session response message returned by the called UE, and carries the key generated by the called network side. In the session response message, and sent to the calling network entity; by2, after receiving the session response message, the calling network entity derives according to the key generated by the calling network side and the key generated by the called network side. A new key is generated, and the derived key is carried as a media stream protection key in the session response message and sent to the calling UE.

The method according to any one of claims 8 to 10, wherein the session response message is a 200 response message.

The method according to any one of claims 8 to 10, wherein the calling network entity is a calling S-CSCF, a calling AS or a calling AS-KMF, and the called network entity is The called S-CSCF, the called AS or the called AS-KMF.

The method according to claim 1, wherein the method further comprises: before the calling UE sends the session request message, the method further comprises:

The calling UE sends a session establishment request message carrying the media stream security capability information provided by itself to the called UE through the network entity, where the session establishment request message is an invitation INVITE request message; and the called UE according to the media provided by the calling UE The flow security capability information determines the media flow security capability information that is to be provided, and the provided media flow security capability information is carried in the session establishment response response message, and is returned to the calling UE by the network entity, where the session establishment response message is 183. Response message.

The method according to claim 13, wherein the network entity comprises a calling network entity and a called network entity, and when the calling network entity receives the INVITE, please When the message is obtained, the method further includes: the calling network entity determines that the calling UE has subscribed to the media stream security service, and adds the identifier of the subscribed media stream security service of the calling UE to the INVITE request message, and then continues to execute The step of sending an INVITE request message to the called network entity;

The method according to claim 13, wherein the network entity comprises a calling network entity and a called network entity, and when the calling network entity receives the INVITE request message, the method further comprises: The calling network entity adds an identifier of the media network side entity to support the media stream security protection to the INVITE request message, and then proceeds to perform the step of sending the INVITE request message to the called network entity.

When the called network entity receives the INVITE request message, the method further includes: the called network entity checks that the INVITE request message carries the identifier of the media network entity supporting the media stream security protection, and then continues to execute the INVITE The step of sending a request message to the called UE;

When the called network entity receives the 183 response message, the method further includes: The called network entity adds an identifier of the called network side entity to support the media stream security protection to the 183 response message, and then performs the step of sending the 183 response message to the calling network entity.

When the calling network entity receives the 183 response message, the method further includes: the calling network entity checks the identifier of the 183 response message that the called network side entity supports the media stream security protection, and then continues to execute the 183 response message. The step of sending to the calling UE.

The method according to claim 15, wherein, after the called network entity checks that the INVITE request message carries a flag that the calling network side entity supports media stream security protection, the method further includes: The called network entity adds the identifier of the called network side entity to support the media stream security protection to the INVITE request message, and then proceeds to perform the step of sending the INVITE request message to the called UE.

After the calling network entity checks that the 183 response message has the identifier of the network-side entity supporting the media stream security protection, the method further includes: the calling network entity adds the identifier of the media stream security protection of the calling network side entity, In the 183 response message, the step of transmitting the 183 response message to the calling UE is further performed.

The method according to claim 13, wherein the media stream security capability information comprises a media stream security algorithm, or further comprises one or more of a media type to be protected and a type of secure transmission protocol. combination.

18. A system for obtaining a media stream protection key in an IMS network, the system comprising:

The terminal device UE is configured to send a session request message to the network entity and receive the session response message carrying the key when the UE is the calling UE, and receive the session request sent from the network entity when the UE is the called UE. Message, and return a session response message;

The network entity is configured to add a key to the session request message and send the message to the called UE when receiving the session request message sent by the calling UE, and is further configured to receive the sent by the called UE. The session response message adds the key to the session response message and sends it to the calling UE.

The system according to claim 18, wherein the network entity, when acting as a calling network entity, is configured to receive a session request message sent by the calling UE, obtain a key generated by the calling network side, and Sending a key generated by the calling network side to the called network entity by using the session request message; receiving a session response message returned by the called network entity, and adding a key generated by the calling network side to the session response message. Give the calling UE;

When the network entity is used as the called network entity, it is configured to receive a session request message from the calling network entity, obtain a key generated by the called network side, add the key to the session request message, and then send the session request. The message is sent to the called UE; the session response message returned by the called UE is received, and the key generated by the called network side is carried in the session response message and sent to the calling network entity.

The system according to claim 19, the UE is further configured to derive a new key generated by the received key generated by the calling network side and the generated key of the called network side, and the derived key The key acts as a media stream protection key.

The system according to claim 18, wherein the network entity, when acting as a calling network entity, is configured to receive a session request message sent by the calling UE, obtain a key generated by the calling network side, and Sending the key generated by the calling network side to the called network entity by using the session request message; receiving the session response message returned by the called network entity, and generating the key generated by the calling network side and the secret generated by the called network side The key derives a new key and carries the session response message to the calling UE;

When the network entity is the called network entity, it is configured to receive a session request message from the calling network entity, obtain a key generated by the called network side, and generate the key generated by the calling network side and the called network side. The key is derived from the new key, and the derived key is carried as the media stream protection key in the session request message and sent to the called UE; receiving the session response message returned by the called UE, will be called The key generated by the network side is carried in the session ringing Should be in the message, and sent to the calling network entity.

The system according to any one of claims 19 to 21, wherein the network entity is a call session control function entity S-CSCF or an application server AS, the system further comprising:

The key management function entity KMF is configured to receive a key request message of the S-CSCF or the AS, generate a key, and return it to the S-CSCF or the AS through the key response message.

The system according to any one of claims 19 to 21, wherein the network entity is an AS-KMF, and the key obtained by the network entity is a key generated by the AS-KMF itself, the system further comprising:

The S-CSCF is used to forward a session message between the UE and the AS-KMF.

A network entity that provides a media stream protection key to a terminal device UE in an IMS network, wherein the network entity includes:

The key obtaining unit, when receiving the session request message sent by the calling UE, adds the key to the session request message, and sends the key to the called UE through the sending unit; when receiving the session response message sent by the called UE Adding a key to the session response message and sending it to the calling UE through the sending unit;

The network entity according to claim 24, wherein the network entity is an S-CSCF or an AS, and the key is a key provided by the KMF; or

The network entity is an AS-KMF, and the key is a key generated by the AS-KMF itself.

The network entity according to claim 25, wherein, if the network entity is an AS-KMF, the key obtaining unit comprises: a key generating unit, configured to generate a key, and provide the key adding unit;

a key adding unit, configured to: when receiving the session request message sent by the calling UE, add the key to the session request message, and send the message to the called UE by using the sending unit; and receive the session response sent by the called UE In the case of a message, the key is added to the session response message and sent to the calling UE through the sending unit.

The network entity according to claim 24, wherein the network entity is a calling network entity, and the key added to the session response is a derived key; the network entity is further used for And receiving a session response message sent by the called UE, deriving the key generated by the calling network side and the key generated by the called network side, and deriving a new key; or

The network entity is a called network entity, and the key added to the session request message is a derived key; the network entity is further configured to: when receiving the session request message sent by the calling UE, The key generated by the calling network side and the key generated by the called network side are derived, and a new key is derived.

28. A user equipment UE that obtains a media stream protection key in an IMS network, wherein the user equipment includes:

a transceiver unit, configured to send and receive session messages;

The UE according to claim 28, wherein the UE further comprises: a storage unit, configured to save a key derived by the key derivation unit.

30. A method for obtaining a media stream protection key in an IMS network, the method comprising the steps of:

After receiving the session message, the network entity obtains the key from the key management function entity KMF; the network entity sends the acquired key to the terminal device UE and the media processing function entity MP, respectively.

The method according to claim 30, wherein the network entity is a calling AS, the UE is a calling UE, the MP is a calling MP, and the KMF is a calling KMF; or

The network entity is a called AS, the UE is a called UE, the MP is a called MP, and the KMF is a called KMF.

The method according to claim 31, wherein, if the network entity is the calling AS, the UE is the calling UE, and the session message received by the calling AS is 200, the main The method for the AS to send the acquired key to the calling UE is:

The calling AS carries the key in the 200 message and sends it to the calling P-CSCF through the calling S-CSCF, and the calling P-CSCF sends the 200 message carrying the key to the calling UE.

The method according to claim 31, wherein, if the network entity is the calling AS, the MP is the calling MP, and the session message received by the calling AS is 200, the main The method for the AS to send the obtained key to the calling MP is:

The calling AS carries the key in the 200 message and sends it to the calling P-CSCF through the calling S-CSCF, and the calling P-CSCF sends the key to the calling MP.

The method according to claim 31, wherein, if the network entity is a called AS, the UE is a called UE, and the session message received by the called AS is a PRACK message or an UPDATE message. The method for the called AS to send the acquired key to the called UE is: The called AS carries the key in a PRACK message or an UPDATE message, and sends it to the called P-CSCF through the called S-CSCF, and the called P-CSCF will carry the PRACK message of the key or UPDATE. The message is sent to the called UE.

The method according to claim 31, wherein, if the network entity is a called AS, the MP is a called MP, and the session message received by the called AS is a PRACK message or an UPDATE message. The method for the called AS to send the obtained key to the called MP is:

The called AS carries the key in a PRACK message or an UPDATE message, and sends it to the called P-CSCF through the called S-CSCF, and the called P-CSCF sends the key to the called MP. .

36. The method according to claim 31, wherein, if the network entity is a calling AS, the UE is a calling UE, the MP is a calling MP, and the calling AS receives a session. The message is 200, and the method in which the calling AS sends the obtained key to the calling MP is: the calling AS sends the obtained key directly to the calling MP;

The method in which the calling AS sends the obtained key to the calling UE is: the calling AS carries the key in the 200 message, and sends the key to the calling UE through the calling S-CSCF and the calling P-CSCF.

The method according to claim 31, wherein, if the network entity is a called AS, the UE is a called UE, and the MP is a called MP, the called AS receives a session. The message is a PRACK message, and the method for the called AS to send the acquired key to the called MP is: the called AS sends the obtained key directly to the called MP;

The method for the called AS to send the acquired key to the called UE is: the called AS carries the key in the PRACK message, and sends it to the called UE through the called S-CSCF and the called P-CSCF.

38. The method according to claim 30, wherein the UE is called a UE, the network entity is a calling network entity, and the MP is a calling MP; the method before the step A further includes:

The calling UE sends an INVITE session establishment request message to the calling network entity, where the INVITE request message carries the media stream security capability information provided by the calling UE, and the calling network entity returns to the calling UE to carry the provided side. The 183 response message of the media stream security capability information supported by the MP.

The method according to claim 30, wherein the UE is a called UE, the network entity is a called network entity, and the MP is a called MP; :

After receiving the INVITE session establishment request message, the called network entity sends an INVITE session establishment request message carrying the media stream security capability information supported by the called MP provided by the side to the called UE, and the called UE calls the called party again. The network entity returns a 183 session response message carrying the media stream security capability information provided by itself.

40. A system for obtaining a media stream protection key in an IMS network, the system comprising:

a terminal device UE, configured to receive a key sent by a network entity;

Key management function KMF, used to generate keys.

The system according to claim 40, wherein the network entity is a calling CSCF or a calling AS, the UE is a calling UE, the MP is a calling MP, and the KMF is a calling party. KMF; or,

The network entity is a called CSCF or a called AS, the UE is a called UE, the MP is a called MP, and the KMF is a called KMF.

42. The system of claim 41, wherein the KMF is a functional module in an AS or S-CSCF.

43. A network entity for providing a media stream protection key in an IMS network, the network entity comprising:

a receiving unit, configured to receive a session message;

MP.

The network entity according to claim 43, wherein the network entity is a CSCF or an AS.