WO2017197968A1 - 一种数据传输方法及装置 - Google Patents

一种数据传输方法及装置 Download PDF

Info

Publication number
WO2017197968A1
WO2017197968A1 PCT/CN2017/076487 CN2017076487W WO2017197968A1 WO 2017197968 A1 WO2017197968 A1 WO 2017197968A1 CN 2017076487 W CN2017076487 W CN 2017076487W WO 2017197968 A1 WO2017197968 A1 WO 2017197968A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
terminal user
public key
user public
data
Prior art date
Application number
PCT/CN2017/076487
Other languages
English (en)
French (fr)
Inventor
丛文
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017197968A1 publication Critical patent/WO2017197968A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1016—IP multimedia subsystem [IMS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Definitions

  • the present invention relates to the technical field of communication applications, and in particular to a data transmission method and apparatus.
  • IMS IP Multimedia Subsystem
  • LTE Long Term Evolution
  • IP Multimedia Subsystem IP Multimedia Subsystem
  • SIP Session Initiation Protocol
  • the inherent flaws and security vulnerabilities of the IP protocol make IMS vulnerable to attacks.
  • the introduction of IMS also introduces IP networks. Security issue.
  • IMS Internet Protocol Security
  • HSS Home Subscriber Server
  • An object of the embodiments of the present invention is to provide a data transmission method and apparatus for solving the problem of low security of IMS data during transmission.
  • an embodiment of the present invention provides a data transmission method, which is applied to a first terminal, and includes:
  • the step of encrypting the IP multimedia subsystem IMS media data according to the second terminal user public key and the pre-generated first terminal user private key that matches the first terminal user public key includes: :
  • the step of transmitting the pre-generated first terminal user public key to the second terminal includes:
  • the method further includes: before the step of sending the pre-generated first terminal user public key to the second terminal, the method further includes:
  • the first terminal user public key and the first terminal user private key matching the first terminal user public key are generated.
  • the step of generating a first terminal user public key and a first terminal user private key matching the first terminal user public key after the first terminal user detects the encrypted call request initiated by the first terminal include:
  • the first terminal attribute information related to the first terminal is obtained, where the first terminal attribute information includes: the network of the first terminal Signal strength, a signal to noise ratio of the first terminal, and/or a battery level of the first terminal;
  • An embodiment of the present invention further provides a data transmission apparatus, which is applied to a first terminal, and includes:
  • a sending module configured to send the pre-generated first terminal user public key to the second terminal
  • a first acquiring module configured to acquire a second terminal user public key generated after the second terminal receives the first terminal user public key
  • the first processing module is configured to encrypt the IP multimedia subsystem IMS media data according to the second terminal user public key and the pre-generated first terminal user private key that matches the first terminal user public key And transmitting the encrypted IMS media data to the second terminal.
  • An embodiment of the present invention further provides a data transmission method, which is applied to a second terminal, and includes:
  • the IMS media data is obtained by the first terminal encrypting the IMS media data according to the first terminal user private key and the second terminal user public key that are matched with the first terminal user public key. of.
  • the step of decrypting the encrypted IMS media data transmitted by the first terminal according to the second terminal user private key and the first terminal user public key, and the step of obtaining the IMS media data includes: :
  • the step of acquiring the first terminal user public key sent by the first terminal includes:
  • the step of sending the second terminal user public key to the first terminal includes:
  • An embodiment of the present invention further provides a data transmission apparatus, which is applied to a second terminal, and includes:
  • a second acquiring module configured to acquire a first terminal user public key sent by the first terminal
  • a first generation module configured to generate a second terminal user public key and a second terminal user private key that matches the second terminal user public key, and send the second terminal user public key to the first terminal ;
  • a second processing module configured to decrypt, according to the second terminal user private key and the first terminal user public key, the encrypted IMS media data transmitted by the first terminal
  • the IMS media data is obtained, where the IMS media data that is encrypted and processed is the first terminal user private key and the second terminal user that are matched by the first terminal according to the first terminal user public key. Key obtained by encrypting the IMS media data.
  • a computer storage medium is further provided, and the computer storage medium may store an execution instruction for executing the implementation of the data transmission method in the foregoing embodiment.
  • the foregoing technical solution of the embodiment of the present invention sends a pre-generated first terminal user public key to the second terminal, and obtains a second terminal user that is generated after the second terminal receives the first terminal user public key.
  • the subsequent IMS media data is transmitted to the second terminal, which greatly enhances the security of the IMS data during transmission.
  • FIG. 1 is a first working flowchart of a data transmission method according to an embodiment of the present invention
  • FIG. 2 is a second working flowchart of a data transmission method according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a format of an RTP data packet according to an embodiment of the present invention.
  • FIG. 4 is a first structural block diagram of a data transmission apparatus according to an embodiment of the present invention.
  • FIG. 5 is a third working flowchart of a data transmission method according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of interaction between a first terminal and a second terminal according to an embodiment of the present invention.
  • FIG. 7 is a block diagram showing a second structure of a data transmission apparatus according to an embodiment of the present invention.
  • the secure communication security of the data transmission method in the embodiment of the present invention is ensured by a public key algorithm, such as a digital signature DSA algorithm, an elliptic curve algorithm, or an RSA algorithm, etc., in order to facilitate a person skilled in the art to better understand the present embodiment.
  • a public key algorithm such as a digital signature DSA algorithm, an elliptic curve algorithm, or an RSA algorithm, etc.
  • the data transmission method the following explains the principle of the public key system:
  • the principle of the public key system is that user A has a key pair, which is divided into a public key and a private key, which are unique to the key pair and are obtained by factoring a huge number.
  • Information encrypted with the public key can only be decrypted using the private key paired with it; vice versa, the information encrypted by the private key can only be decrypted with the public key.
  • the private key is saved, and the public key is disclosed.
  • A wants to communicate with user A and wants to ensure data security
  • A can use A public key to encrypt the information. Then pass the ciphertext to A, and only the private key in A can decrypt the ciphertext, thus ensuring the security of the information.
  • Encryption is just one of the uses of public key systems. It also has a purpose to sign data and prevent it from being modified by third parties. For example, user A uses his own private key to sign (encrypt) the sent data, and then verify the information through user A's public key. The data is sent by user A because only user A's private key is used. The data obtained by the signature can be decrypted using User A's public key.
  • the public key mechanism uses both encryption and digital signatures, the efficiency is lower than that of single-key packet encryption algorithms such as DES/AES, but with the rapid development of mobile terminal CPU performance and data traffic for voice or video calls. It is not too big, so the above efficiency problem is no longer the bottleneck of its application.
  • an embodiment of the present invention provides a data transmission method and apparatus, which solves the problem of low security of IMS data during transmission.
  • the data transmission method of the embodiment of the present invention is applied to a first terminal, where the first terminal may be specifically a smart phone, a tablet computer, a PAD, a personal computer, etc., and the data transmission method includes:
  • Step 11 Send the pre-generated first terminal user public key to the second terminal.
  • the first terminal user public key may be generated by the first terminal after detecting that the user initiates an encrypted call request by using the first terminal.
  • the random number may be specifically generated by the software as an input of the cryptographic module, and the random number is used.
  • a new public-private key pair (a first end-user public key and a first end-user private key matching the first end-user public key) is generated by the public key generation algorithm.
  • the input random number can be generated by acquiring parameters such as the current signal strength, signal-to-noise ratio, electric quantity, and internal interrupt signal of the first mobile terminal.
  • the above method generates a true random number, and the security is stronger than that generated by a random function such as a random function. The number further improves the security of data transmission.
  • Step 12 Acquire a second terminal user public key generated after the second terminal receives the first terminal user public key.
  • the second terminal After receiving the first terminal user public key, the second terminal acquires current signal strength, signal to noise ratio, power amount, internal interrupt signal and other parameters of the second mobile terminal to generate a random number, and according to the generated random number sum
  • the public key generation algorithm generates a second terminal user public key and a second terminal user private key that matches the second terminal user public key and transmits the second terminal user private key to the first terminal.
  • Step 13 Encrypt the IP multimedia subsystem IMS media data according to the second terminal user public key and the pre-generated first terminal user private key that matches the first terminal user public key, and encrypt and process the data.
  • the IMS media data is transmitted to the second terminal.
  • the IMS media data is first-stage encrypted according to the first terminal user private key to obtain first-level encrypted data, and the first-level encrypted data is second-level encrypted according to the second terminal user public key. Processing, obtaining IMS media data after encryption processing.
  • the IMS data is subjected to two-level encryption processing, which effectively improves the secure transmission performance of the IMS data.
  • the first terminal user public key generated in advance is sent to the second terminal, and the second terminal user generated after the second terminal receives the public key of the first terminal user Key: encrypting and processing the IP multimedia subsystem IMS media data according to the second terminal user public key and the pre-generated first terminal user private key matching the first terminal user public key, and encrypting
  • the subsequent IMS media data is transmitted to the second terminal, which greatly enhances the security of the IMS data during transmission.
  • the data transmission method of the embodiment of the present invention is applied to a first terminal, where the first terminal may be specifically a smart phone, a tablet computer, a PAD, a personal computer, etc., and the data transmission method includes:
  • Step 21 After establishing a communication connection with the second terminal, add a first terminal user public key in the real-time transport protocol RTP data packet, and send an RTP data packet that adds the first terminal user public key to the second terminal.
  • the second terminal After detecting the encrypted call request initiated by the first terminal by the first terminal user, generating a first terminal user public key and a first terminal user private key matching the first terminal user public key;
  • the second terminal establishes a communication connection, adds a first terminal user public key in the real-time transport protocol RTP data packet, and sends an RTP data packet that adds the first terminal user public key to the second terminal.
  • the step of generating a first terminal user public key and a first terminal user private key matching the first terminal user public key may be performed.
  • the method includes: after detecting, by the first terminal user, the first terminal attribute information related to the first terminal, the first terminal attribute information includes: the first a network signal strength of the terminal, a signal to noise ratio of the first terminal, and/or a battery power of the first terminal; constructing a random number according to the first terminal attribute information; generating according to the random number and the key
  • the algorithm generates the first terminal user public key and the first terminal user private key.
  • RTP data packet in the embodiment of the present invention is composed of two parts: a packet header and a payload.
  • RTP header format as shown in Figure 3, where:
  • V indicates the version number of the RTP protocol, which is 2 digits, and the current protocol version number is 2.
  • CC denotes a CSRC counter, which is 4 bits, indicating the number of CSRC identifiers.
  • M indicates a tag, which occupies 1 bit.
  • Different payloads have different meanings. For video, mark the end of a frame; for audio, mark the beginning of a session.
  • PT indicates the payload type, which is 7 bits, and is used to describe the type of payload in the RTP packet, such as audio, image, and so on.
  • the sequence number indicates the serial number, which is 16 bits, and is used to identify the serial number of the RTP packet sent by the sender. The serial number is incremented by one for each RTP packet sent.
  • Timestamp is a timestamp, which is 32 bits. This field reflects the sampling time of the first octet of the RTP packet.
  • the synchronization source (SSRC) identifier is a synchronization source identifier, which is 32 bits and is used to identify the synchronization source.
  • Contributing source (CSRC) identifiers are special source identifiers. Each CSRC identifier is 32 bits and can have 0 to 15.
  • the encrypted communication described in the embodiment of the present invention needs to use the above-mentioned "PT (Payload Type)" field, and the payload type PT in the RTP packet has a length of 7 bits, so the RTP can support 128 different payload types.
  • the types of PT payload types 20, 21, 22, 23, 24, 27, 29, 30, 35-71, and 77-95 are currently in an unassigned state, and one of them can be used as a transport key.
  • the identity of the RTP packet, and the native public key that needs to be sent to the other party's user is populated in the payload of the RTP packet.
  • a certain number of bits of the specific identifier can also be added for the second confirmation. Since the length of the public key generated by the two parties is certain, the identifier can be placed before, after, or in the public key. Bit bit.
  • Step 22 Acquire a second terminal user public key generated after the second terminal receives the first terminal user public key.
  • the second terminal After receiving the RTP data packet sent by the first terminal, the second terminal detects the specific bit position and length of the load data, and if it carries the valid first terminal user public key, starts its own public key generation algorithm, and generates the first Transmitting a second terminal user public key and a second terminal user private key, and adding the second terminal user public key to the real-time transport protocol RTP data packet, and sending the RTP data packet of the second terminal user public key to the The first terminal is described.
  • Step 23 Encrypt the IP multimedia subsystem IMS media data according to the second terminal user public key and the pre-generated first terminal user private key that matches the first terminal user public key, and encrypt and process the data.
  • the IMS media data is transmitted to the second terminal.
  • the IMS media data is first-stage encrypted according to the first terminal user private key to obtain first-level encrypted data, and the first-level encrypted data is second-level encrypted according to the second terminal user public key. Processing, obtaining IMS media data after encryption processing.
  • the IMS data is subjected to two-level encryption processing, which effectively improves the secure transmission performance of the IMS data.
  • the foregoing technical solution of the embodiment of the present invention performs key negotiation in a specific field of the RTP data packet, and performs two-stage encryption processing on the IMS data by using the first terminal user private key and the second terminal user public key to ensure IMS data transmission. Security in the process.
  • an embodiment of the present invention further provides a data transmission apparatus, which is applied to a first terminal, where the data transmission apparatus includes:
  • the sending module 41 is configured to send the pre-generated first terminal user public key to the second terminal;
  • the first obtaining module 42 is configured to acquire a second terminal user public key generated after the second terminal receives the first terminal user public key;
  • the first processing module 43 is configured to encrypt the IP multimedia subsystem IMS media data according to the second terminal user public key and the pre-generated first terminal user private key that matches the first terminal user public key. Processing, and transmitting the encrypted IMS media data to the second terminal.
  • the first processing module 43 includes:
  • the first encryption sub-module 431 is configured to perform first-level encryption processing on the IMS media data according to the first terminal user private key to obtain first-level encrypted data.
  • the second encryption sub-module 432 is configured to perform second-level encryption processing on the first-level encrypted data according to the second terminal user public key to obtain cryptographically processed IMS media data.
  • the sending module 41 is configured to add the first terminal to the real-time transport protocol RTP data packet after establishing a communication connection with the second terminal. And a public key, and sending an RTP data packet that adds the first terminal user public key to the second terminal.
  • the second generating module 44 is configured to: after detecting the encrypted call request initiated by the first terminal by the first terminal, generate a first terminal user public key and a first terminal user that matches the first terminal user public key Private key.
  • the second generation module 44 includes:
  • the first obtaining sub-module 441 is configured to: after detecting the encrypted call request initiated by the first terminal by the first terminal, acquire first terminal attribute information related to the first terminal, where the first terminal attribute information is The network signal strength of the first terminal, the signal to noise ratio of the first terminal, and/or the battery power of the first terminal;
  • the constructing submodule 442 is configured to construct a random number according to the first terminal attribute information
  • the first generation submodule 443 is configured to generate the first terminal user public key and the first terminal user private key according to the random number and the key generation algorithm.
  • the device is a device corresponding to the foregoing method embodiment, and all implementations in the foregoing method embodiments are applicable to the embodiment of the device, and the same technical effects can be achieved.
  • the data transmission device of the embodiment of the present invention sends the pre-generated first terminal user public key to the second terminal, and obtains the second terminal user that is generated after the second terminal receives the first terminal user public key.
  • Key encrypting and processing the IP multimedia subsystem IMS media data according to the second terminal user public key and the pre-generated first terminal user private key matching the first terminal user public key, and encrypting
  • the subsequent IMS media data is transmitted to the second terminal, which greatly enhances the security of the IMS data during transmission.
  • the data transmission method of the embodiment of the present invention is applied to a second terminal, which may be specifically a smart phone, a tablet computer, a PAD, a personal computer, etc., and the data transmission method includes:
  • Step 51 Acquire a first terminal user public key sent by the first terminal.
  • the first terminal user public key is obtained from the RTP data packet transmitted by the first terminal.
  • Step 52 Generate a second terminal user public key and a second terminal user private key that matches the second terminal user public key, and send the second terminal user public key to the first terminal.
  • the second terminal may specifically generate the second terminal user public key and the second terminal user private key by using the following manner.
  • Obtaining second terminal attribute information related to the second terminal where the second terminal attribute information includes: a network signal strength of the second terminal, a signal to noise ratio of the second terminal, and/or the second terminal Generating a random number according to the second terminal attribute information; generating the second terminal user public key and the second terminal user private key according to the random number and the key generation algorithm, and transmitting in real time
  • the second terminal user public key is added to the protocol RTP data packet, and the RTP data packet that adds the second terminal user public key is sent to the first terminal.
  • Step 53 Perform decryption processing on the encrypted IMS media data transmitted by the first terminal according to the second terminal user private key and the first terminal user public key, to obtain IMS media data, where the encrypted IMS media data is obtained. And obtaining, by the first terminal, the IMS media data according to the first terminal user private key and the second terminal user public key that are matched with the first terminal user public key.
  • the IMS media data after the encryption process is decrypted according to the second terminal user private key, to obtain first-level encrypted data, where the first-level encrypted data is the first terminal according to the first terminal user private key to the IMS media data.
  • the first terminal performs two encryption processes on the IMS data transmitted to the second terminal, and the second terminal transmits the IMS to the first terminal according to the second terminal user private key and the first terminal user public key.
  • the data is decrypted twice, which ensures the security of the IMS data transmission process, and the above solution of the embodiment of the present invention does not need to be implemented by a third party, and can be completed only by the mobile terminal.
  • the foregoing interaction process includes:
  • Step 61 The calling user (referred to as user A) selects to initiate a secret call request on the dial-up interface of the first terminal's IMS-based voice service (Voice over LTE, VoLTE).
  • IMS-based voice service Voice over LTE, VoLTE
  • the VoLTE dialing interface can set a separate paging button for the confidential call, and the user initiates the secret call by using the paging button.
  • Step 62 After receiving the confidential call request of the user A, the first terminal acquires information such as the signal strength, the signal to noise ratio, and the terminal battery power of the network at the current terminal to construct a random number as an input of the public key generation algorithm.
  • Step 63 The first terminal generates a first terminal user public key and a first terminal user private key according to a public key generation algorithm.
  • Step 64 After the first terminal establishes an unencrypted VoLTE call according to the normal VoLTE call procedure, the first terminal user public key is sent to the second terminal by using the RTP data packet.
  • the specific RTP data packet in the embodiment of the present invention is generated, and the PT field in the RTP data packet header is filled with the identifier indicating that the encrypted call needs to be performed. And filling the first terminal user public key into the load field of the RTP data packet and sending it to the called user, referred to as user B.
  • user B the RTP data packet is based on an unreliable user datagram protocol (User Datagram Protocol, UDP) to transmit, you can send multiple identical RTP packets in succession.
  • UDP User Datagram Protocol
  • Step 65 After receiving the RTP data packet, the second terminal determines whether the second terminal supports the confidential call.
  • the second terminal may identify the PT field of the RTP packet and obtain the first terminal user public key from the load of the RTP packet after the user B supports the secure communication; If the second terminal does not support the above secure communication, the second terminal will not recognize the The PT field of the RTP packet.
  • whether the second terminal supports the secure communication is determined whether the second terminal supports the secret communication by the second terminal receiving the second terminal user public key in the predetermined time period when the second terminal receives the RTP data packet, if the second terminal is in the second terminal When the second terminal user public key is fed back within a predetermined time, it is determined that the second terminal supports the secure communication, otherwise, it is determined that the second terminal does not support the secure communication.
  • Step 661 If the second terminal does not support the above-mentioned confidential call, the RTP data packet sent by the first terminal is ignored, and the response is responded to by the normal incoming call.
  • Step 662 User A does not receive the second terminal public key fed back by the user B within a predetermined time, and prompts the user A that the called party does not support the confidential call, and continues to communicate using the normal VoLTE language.
  • the first terminal may prompt the called user to not support the VoLTE secure communication on the display interface and the voice, and the user may choose to hang up the phone or use non-encrypted ordinary VoLTE voice communication. At this time, the process ends.
  • Step 671 If the second terminal supports the foregoing confidential call, detecting a specific bit position and length of the load data of the RTP data packet, and if carrying the valid first terminal user public key, generating the second terminal user public key and the second End user private key.
  • the second terminal After receiving the specific RTP data packet sent by the first terminal, and acquiring the first terminal user public key from the load field of the RTP data packet, the second terminal starts its own key generation process, and generates a second terminal user public
  • the key and the second terminal user private key are generated in the same manner as the first terminal user public key and the first terminal user private key in the above step 62.
  • Step 672 The second terminal sends the second terminal user public key to the first terminal by using the RTP data packet.
  • Step 673 Both the calling party and the called party start confidential communication.
  • the secret communication may specifically transmit voice or video data of VoLTE through the RTP data packet; user A uses the first terminal user private key to encrypt the original voice or video data for the first time, that is, digital signature, and then generates the generated ciphertext. Use the second end user public key for the second encryption, and then The second encrypted ciphertext is filled into the payload field of the voice or video RTP and sent to the user B. After receiving the RTP data packet, the user B obtains the ciphertext, and first uses the second terminal user private key to perform the first The second decryption uses the first terminal user public key to perform the second decryption to verify the digital signature of the user A.
  • the above process is a processing flow for the voice data sent by the user A to the user B, and is sent to the user B. User A's voice data is also processed in the same process.
  • Step 674 After the secure communication is completed, the first terminal and the second terminal delete the respective public and private key pairs.
  • User A and User B destroy their respective public-private key pairs, and each communication uses the newly generated public-private key, using a one-time communication method, that is, each time the secure communication is initiated, each regenerates.
  • the new public-private key pair improves the security of data transmission.
  • the secure communication method of the foregoing solution of the embodiment of the present invention can greatly improve the security of VoLTE, and does not require any third party or KMC/AuC/HSS support, and the user does not need to worry about being leaked or monitored in these links;
  • the dense way makes the probability of being attacked or cracked almost zero.
  • an embodiment of the present invention further provides a data transmission apparatus, which is applied to a second terminal, where the data transmission apparatus includes:
  • the second obtaining module 71 is configured to acquire a first terminal user public key sent by the first terminal;
  • the first generating module 72 is configured to generate a second terminal user public key and a second terminal user private key that matches the second terminal user public key, and send the second terminal user public key to the first terminal;
  • the second processing module 73 is configured to decrypt the encrypted IMS media data transmitted by the first terminal according to the second terminal user private key and the first terminal user public key, to obtain an IMS medium.
  • Data, wherein the cryptographically processed IMS media data is that the first terminal according to the first terminal user private key and the second terminal user public key that match the first terminal user public key,
  • the IMS media data is obtained after encryption processing.
  • the second processing module 73 includes:
  • the first decryption sub-module 731 is configured to perform decryption processing on the encrypted IMS media data according to the second terminal user private key to obtain first-level encrypted data, where the first-level encrypted data is based on the first terminal. Obtaining, after the first terminal user private key performs one-level encryption processing on the IMS media data;
  • the second decryption sub-module 732 is configured to decrypt the first-level encrypted data according to the first terminal user public key to obtain the IMS media data.
  • the second obtaining module 71 is configured to acquire the first terminal user public key from the RTP data packet transmitted by the first terminal.
  • the first generation module 72 includes:
  • the sending sub-module 721 is configured to add the second terminal user public key in the real-time transport protocol RTP data packet, and send the RTP data packet that adds the second terminal user public key to the first terminal.
  • the device is a device corresponding to the foregoing method embodiment, and all implementations in the foregoing method embodiments are applicable to the embodiment of the device, and the same technical effects can be achieved.
  • the first terminal performs two encryption processes on the IMS data transmitted to the second terminal, and the second terminal transmits the IMS data according to the second terminal user private key and the first terminal user public key to the first terminal.
  • the IMS data is decrypted twice, which ensures the security of the IMS data transmission process, and the above solution of the embodiment of the present invention can be completed by only the mobile terminal without using a third party.
  • the foregoing technical solution of the embodiment of the present invention may be applied to a data transmission process, where a pre-generated first terminal user public key is sent to the second terminal; and acquiring the second terminal receives the After the first terminal user public key, the generated second terminal user public key; according to the second terminal user public key and the pre-generated first terminal user private key matching the first terminal user public key,
  • the IP multimedia subsystem IMS media data is encrypted, and the encrypted IMS media data is transmitted to the second terminal, which greatly enhances the security of the IMS data during transmission.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明提供了一种数据传输方法及装置，涉及通信技术领域，本发明解决了IMS数据在传输过程中安全性低的问题。本发明的数据传输方法包括：将预先生成的第一终端用户公钥发送给第二终端；获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端，大大增强了IMS数据在传输过程中的安全性。

Description

一种数据传输方法及装置 技术领域
本发明涉及通信应用的技术领域，特别是指一种数据传输方法及装置。
背景技术
随着网络的发展，传统的无线通信电路域交换电话网络逐渐向基于长期演进(Long Term Evolution，LTE)的IP多媒体子系统(IP Multimedia Subsystem，IMS)网络演变。但IMS的基础仍旧是IP网络，具有基于会话初始协议(Session Initiation Protocol，SIP)的全IP架构，IP协议固有的缺陷和安全漏洞使IMS很容易遭受攻击，引入IMS的同时也引入了IP网络的安全性问题。而随着各种信息服务的开展，各种机密性、敏感性、隐私性的传输也会大大增加，这对网络的安全性提出了更高的要求。
作为相对独立的安全体系，IMS要求所有的用户在使用IMS服务之前都必须进行鉴权(认证和授权)，协商建立安全的接入通道。用户和网络实体之间以及网络实体之间的通信必须时刻处于安全保护之中。IMS安全体系的整体思想是使用因特网协议安全(Internet Protocol Security，IPSec)的特性为IMS系统提供安全保护。但是IPSec的安全主要还是由归属签约用户服务器(Home Subscriber Server，HSS)来保证，如果HSS受到攻击或者出现泄密，对用户的通信来说仍旧存在不安全的隐患。
目前现有的其它传统方法是对SIP及实时传输协议(Real-time Transport Protocol，RTP)数据包采用对称加密技术，如数据加密标准(Data Encryption Standard，DES)、高级加密标准(Advanced Encryption Standard，AES)、国际数据加密算法(International Data Encryption Algorithm，IDEA)等，即通信双方都拥有一个预共享密钥，一方用该密钥对SIP数据加密，另一方用该密钥对加密后的数据解密。但这种方法存在严重的缺陷，首先 是预共享密钥在协商过程中很容易被第三方窃取，其次当会话对象增多时，密钥的管理仅通过终端无法完成，必须通过密钥管理中心(Key Manager Center，KMC)或鉴权中心(Authentication Center，AuC)来对会话密钥进行管理。但KMC/AuC也存在泄露用户隐私的风险，降低了IMS数据在传输过程中的安全性。
发明内容
本发明实施例的目的在于提供一种数据传输方法及装置，用以解决IMS数据在传输过程中安全性低的问题。
为了实现上述目的，本发明实施例提供了一种数据传输方法，应用于第一终端，包括：
将预先生成的第一终端用户公钥发送给第二终端；
获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；
根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端。
其中，所述根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理的步骤包括：
根据所述第一终端用户私钥对所述IMS媒体数据进行一级加密处理，得到一级加密数据；
根据所述第二终端用户公钥对所述一级加密数据进行二级加密处理，得到加密处理后的IMS媒体数据。
其中，所述将预先生成的第一终端用户公钥发送给第二终端的步骤包括：
与所述第二终端建立通信连接后，在实时传输协议RTP数据包中增加所述第一终端用户公钥，并将增加所述第一终端用户公钥的RTP数据包发送给所述第二终端。
其中，在所述将预先生成的第一终端用户公钥发送给第二终端的步骤之前，所述方法还包括：
检测到第一终端用户通过所述第一终端发起的加密通话请求后，生成第一终端用户公钥及与所述第一终端用户公钥匹配的第一终端用户私钥。
其中，所述检测到第一终端用户通过所述第一终端发起的加密通话请求后，生成第一终端用户公钥和与所述第一终端用户公钥匹配的第一终端用户私钥的步骤包括：
检测到第一终端用户通过所述第一终端发起的加密通话请求后，获取与所述第一终端相关的第一终端属性信息，所述第一终端属性信息包括：所述第一终端的网络信号强度、所述第一终端的信噪比和/或所述第一终端的电池电量；
根据所述第一终端属性信息，构造一随机数；
根据所述随机数及密钥生成算法，生成所述第一终端用户公钥和第一终端用户私钥。
本发明的实施例还提供了一种数据传输装置，应用于第一终端，包括：
发送模块，设置为将预先生成的第一终端用户公钥发送给第二终端；
第一获取模块，设置为获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；
第一处理模块，设置为根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端。
本发明的实施例还提供了一种数据传输方法，应用于第二终端，包括：
获取第一终端发送的第一终端用户公钥；
生成第二终端用户公钥及与所述第二终端用户公钥匹配的第二终端用户私钥，并将所述第二终端用户公钥发送给所述第一终端；
根据所述第二终端用户私钥和所述第一终端用户公钥，对所述第一终端传输的、加密处理后的IMS媒体数据进行解密处理，得到IMS媒体数据，其中，所述加密处理后的IMS媒体数据为所述第一终端根据与所述第一终端用户公钥匹配的第一终端用户私钥和所述第二终端用户公钥，对所述IMS媒体数据进行加密处理后得到的。
其中，所述根据所述第二终端用户私钥和所述第一终端用户公钥，对所述第一终端传输的、加密处理后的IMS媒体数据进行解密处理，得到IMS媒体数据的步骤包括：
根据所述第二终端用户私钥，对加密处理后的IMS媒体数据进行解密处理，得到一级加密数据，所述一级加密数据为所述第一终端根据第一终端用户私钥对所述IMS媒体数据进行一级加密处理后得到的；
根据第一终端用户公钥，对所述一级加密数据进行解密处理，得到所述IMS媒体数据。
其中，所述获取第一终端发送的第一终端用户公钥的步骤包括：
从所述第一终端传输的RTP数据包中获取所述第一终端用户公钥。
其中，所述将所述第二终端用户公钥发送给所述第一终端的步骤包括：
在实时传输协议RTP数据包中增加所述第二终端用户公钥，并将增加所述第二终端用户公钥的RTP数据包发送给所述第一终端。
本发明的实施例还提供了一种数据传输装置，应用于第二终端，包括：
第二获取模块，设置为获取第一终端发送的第一终端用户公钥；
第一生成模块，设置为生成第二终端用户公钥及与所述第二终端用户公钥匹配的第二终端用户私钥，并将所述第二终端用户公钥发送给所述第一终端；
第二处理模块，设置为根据所述第二终端用户私钥和所述第一终端用户公钥，对所述第一终端传输的、加密处理后的IMS媒体数据进行解密处 理，得到IMS媒体数据，其中，所述加密处理后的IMS媒体数据为所述第一终端根据与所述第一终端用户公钥匹配的第一终端用户私钥和所述第二终端用户公钥，对所述IMS媒体数据进行加密处理后得到的。
在本发明实施例中，还提供了一种计算机存储介质，该计算机存储介质可以存储有执行指令，该执行指令用于执行上述实施例中的数据传输方法的实现。
本发明实施例具有以下有益效果：
本发明实施例的上述技术方案，将预先生成的第一终端用户公钥发送给第二终端；获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端，大大增强了IMS数据在传输过程中的安全性。
附图说明
图1为本发明实施例的数据传输方法的第一工作流程图；
图2为本发明实施例的数据传输方法的第二工作流程图；
图3为本发明实施例中RTP数据包的格式示意图；
图4为本发明实施例的数据传输装置的第一结构框图；
图5为本发明实施例的数据传输方法的第三工作流程图；
图6为本发明实施例中第一终端与第二终端的交互流程图；
图7为本发明实施例的数据传输装置的第二结构框图。
具体实施方式
为使本发明要解决的技术问题、技术方案和优点更加清楚，下面将结合具体实施例及附图进行详细描述。
本发明实施例的数据传输方法的保密通信安全性由公钥算法来保证，如数字签名DSA算法、椭圆曲线算法或RSA算法等，为了便于本领域的技术人员能够更好的理解本实施例中的数据传输方法，下面对公钥体系的原理进行解释说明：
公钥体系的原理为：用户A有一密钥对，分为公钥和私钥，这对密钥对是唯一的，是通过对一个巨大的数字进行因数分解所得。用公钥加密过的信息，只能使用与它配对的私钥来解密；反之亦然，由私钥加密后的信息也只能用公钥来解密。这样，用户A生成密钥对后，把私钥保存好，把公钥公开出去，当一个用户B要与用户A通信，并且希望确保数据安全时，就可以使用A的公钥来加密信息，再把密文传给A，而只有A手中的私钥才能对这个密文进行解密，这样就确保了信息的安全。
加密只是公钥体系的用途之一，它还有一个用途就是对数据进行签名，防止数据被第三方修改。举例：用户A使用自已的私钥对发出去的数据进行签名(加密)，然后通过用户A的公钥对信息验证便可得知，数据是由用户A发送，因为只有使用用户A的私钥签名得到的数据，才能使用用户A的公钥解密。
公钥机制如果同时使用加密和数字签名，则效率要比DES/AES等单密钥分组加密算法低一些，但是随着目前移动终端CPU性能的飞速发展，且对于语音或视频通话来说数据流量并不算很大，因此，上述效率问题已经不再成为其应用的瓶颈。
因此，本发明的实施例提供了一种数据传输方法及装置，解决了IMS数据在传输过程中安全性低的问题。
第一实施例：
如图1所示，本发明实施例的数据传输方法，应用于第一终端，该第一终端可具体为智能手机、平板电脑/PAD、个人计算机等设备，该数据传输方法包括：
步骤11：将预先生成的第一终端用户公钥发送给第二终端。
该第一终端用户公钥可具体为第一终端检测到用户通过第一终端发起加密通话请求后生成的，本发明实施例中可具体通过软件生成随机数作为密码模块的输入，由该随机数通过公钥生成算法生成新的公私钥对(第一终端用户公钥及与该第一终端用户公钥匹配的第一终端用户私钥)。输入随机数可以通过获取第一移动终端当前的信号强度、信噪比、电量、内部中断信号等参数来生成，上述方式生成的为真随机数，安全性要强于类似random函数等生成的伪随机数，进一步提高了数据传输的安全性。
步骤12：获取第二终端接收到上述第一终端用户公钥后，生成的第二终端用户公钥。
这里，第二终端接收到上述第一终端用户公钥后，获取第二移动终端当前的信号强度、信噪比、电量、内部中断信号等参数来生成一随机数，并根据生成的随机数和公钥生成算法生成第二终端用户公钥及与该第二终端用户公钥匹配的第二终端用户私钥并传输给上述第一终端。
步骤13：根据上述第二终端用户公钥和预先生成的、与上述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给上述第二终端。
具体的，根据所述第一终端用户私钥对所述IMS媒体数据进行一级加密处理，得到一级加密数据；根据所述第二终端用户公钥对所述一级加密数据进行二级加密处理，得到加密处理后的IMS媒体数据。本发明实施例中对IMS数据进行两级加密处理，有效提升了IMS数据的安全传输性能。
本发明实施例的数据传输方法，将预先生成的第一终端用户公钥发送给第二终端；获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端，大大增强了IMS数据在传输过程中的安全性。
第二实施例：
如图2所示，本发明实施例的数据传输方法，应用于第一终端，该第一终端可具体为智能手机、平板电脑/PAD、个人计算机等设备，该数据传输方法包括：
步骤21：与第二终端建立通信连接后，在实时传输协议RTP数据包中增加第一终端用户公钥，并将增加第一终端用户公钥的RTP数据包发送给所述第二终端。
本步骤中，检测到第一终端用户所述第一终端发起的加密通话请求后，生成第一终端用户公钥及与所述第一终端用户公钥匹配的第一终端用户私钥；然后与第二终端建立通信连接，在实时传输协议RTP数据包中增加第一终端用户公钥，并将增加第一终端用户公钥的RTP数据包发送给所述第二终端。
优选地，上述检测到第一终端用户所述第一终端发起的加密通话请求后，生成第一终端用户公钥及与所述第一终端用户公钥匹配的第一终端用户私钥的步骤可具体包括：检测到第一终端用户通过所述第一终端发起的加密通话请求后，获取与所述第一终端相关的第一终端属性信息，所述第一终端属性信息包括：所述第一终端的网络信号强度、所述第一终端的信噪比和/或所述第一终端的电池电量；根据所述第一终端属性信息，构造一随机数；根据所述随机数及密钥生成算法，生成所述第一终端用户公钥和第一终端用户私钥。
另外，本发明实施例中的RTP数据包由两部分组成：包头和有效载荷。RTP包头格式，如图3所示，其中：
V表示RTP协议的版本号，占2位，当前协议版本号为2。
P表示填充标志，占1位，如果P＝1，则在该数据包的尾部填充一个或多个额外的八位组，它们不是有效载荷的一部分。
X表示扩展标志，占1位，如果X＝1，则在RTP报头后跟有一个扩展报头。
CC表示CSRC计数器，占4位，指示CSRC标识符的个数。
M表示标记，占1位，不同的有效载荷有不同的含义，对于视频，标记一帧的结束；对于音频，标记会话的开始。
PT表示有效载荷类型，占7位，用于说明RTP数据包中有效载荷的类型，如音频、图像等。
Sequence number表示序列号，占16位，用于标识发送者所发送的RTP数据包的序列号，每发送一个RTP数据包，序列号会增加1。
Timestamp为时间戳，占32位，该字段反映了该RTP数据包的第一个八位组的采样时刻。
synchronization source(SSRC)identifier为同步信源标识符，占32位，用于标识同步信源。
Contributing source(CSRC)identifiers为特约信源标识符，每个CSRC标识符占32位，可以有0～15个。
本发明实施例中所述的加密通信需利用上述的“PT(Payload Type)”字段，RTP封包中的有效负载类型PT的长度为7bit，因此RTP可以支持128种不同的有效负载类型。在RTP协议中，目前PT负载类型20、21、22、23、24、27、29、30、35-71、77-95这些类型处于未分配状态，可以利用其中的某一种作为传输密钥的RTP包的标识，并且将需要发送给对方用户的本机公钥填充在该RTP包的负载中。在负载中也可以增加若干bit的特定标识来做第二次的确认，由于双方生成的公钥的长度是一定的，该标识可以放在公钥之前、之后、或在公钥当中增加特定的bit位。
步骤22：获取第二终端接收到上述第一终端用户公钥后，生成的第二终端用户公钥。
第二终端接收到第一终端发送的上述RTP数据包后，检测其中负载数据的特定bit位及长度，若其中携带有效的第一终端用户公钥，则启动自身的公钥生成算法，生成第二终端用户公钥和第二终端用户私钥，并在实时传输协议RTP数据包中增加所述第二终端用户公钥，并将增加所述第二终端用户公钥的RTP数据包发送给所述第一终端。
步骤23：根据上述第二终端用户公钥和预先生成的、与上述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给上述第二终端。
具体的，根据所述第一终端用户私钥对所述IMS媒体数据进行一级加密处理，得到一级加密数据；根据所述第二终端用户公钥对所述一级加密数据进行二级加密处理，得到加密处理后的IMS媒体数据。本发明实施例中对IMS数据进行两级加密处理，有效提升了IMS数据的安全传输性能。
本发明实施例的上述技术方案，在RTP数据包的特定字段进行密钥协商，并通过第一终端用户私钥和第二终端用户公钥对IMS数据进行两级加密处理，保证了IMS数据传输过程中的安全性。
第三实施例：
如图4所示，本发明的实施例还提供了一种数据传输装置，应用于第一终端，该数据传输装置包括：
发送模块41，设置为将预先生成的第一终端用户公钥发送给第二终端；
第一获取模块42，设置为获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；
第一处理模块43，设置为根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端。
本发明实施例的数据传输装置，所述第一处理模块43包括：
第一加密子模块431，设置为根据所述第一终端用户私钥对所述IMS媒体数据进行一级加密处理，得到一级加密数据；
第二加密子模块432，设置为根据所述第二终端用户公钥对所述一级加密数据进行二级加密处理，得到加密处理后的IMS媒体数据。
本发明实施例的数据传输装置，所述发送模块41设置为与所述第二终端建立通信连接后，在实时传输协议RTP数据包中增加所述第一终端用 户公钥，并将增加所述第一终端用户公钥的RTP数据包发送给所述第二终端。
本发明实施例的数据传输装置，还包括：
第二生成模块44，设置为检测到第一终端用户通过所述第一终端发起的加密通话请求后，生成第一终端用户公钥及与所述第一终端用户公钥匹配的第一终端用户私钥。
本发明实施例的数据传输装置，所述第二生成模块44包括：
第一获取子模块441，设置为检测到第一终端用户通过所述第一终端发起的加密通话请求后，获取与所述第一终端相关的第一终端属性信息，所述第一终端属性信息包括：所述第一终端的网络信号强度、所述第一终端的信噪比和/或所述第一终端的电池电量；
构造子模块442，设置为根据所述第一终端属性信息，构造一随机数；
第一生成子模块443，设置为根据所述随机数及密钥生成算法，生成所述第一终端用户公钥和第一终端用户私钥。
需要说明的是，该装置是与上述方法实施例对应的装置，上述方法实施例中所有实现方式均适用于该装置的实施例中，也能达到相同的技术效果。
本发明实施例的数据传输装置，将预先生成的第一终端用户公钥发送给第二终端；获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端，大大增强了IMS数据在传输过程中的安全性。
第四实施例：
如图5所示，本发明实施例的数据传输方法，应用于第二终端，该第二终端可具体为智能手机、平板电脑/PAD、个人计算机等设备，该数据传输方法包括：
步骤51：获取第一终端发送的第一终端用户公钥。
具体的，从所述第一终端传输的RTP数据包中获取所述第一终端用户公钥。
步骤52：生成第二终端用户公钥及与第二终端用户公钥匹配的第二终端用户私钥，并将第二终端用户公钥发送给上述第一终端。
第二终端可具体通过如下方式生成上述第二终端用户公钥和第二终端用户私钥。首先获取与所述第二终端相关的第二终端属性信息，所述第二终端属性信息包括：第二终端的网络信号强度、所述第二终端的信噪比和/或所述第二终端的电池电量；根据所述第二终端属性信息，构造一随机数；根据所述随机数及密钥生成算法，生成所述第二终端用户公钥和第二终端用户私钥，并在实时传输协议RTP数据包中增加所述第二终端用户公钥，并将增加所述第二终端用户公钥的RTP数据包发送给所述第一终端。
步骤53：根据第二终端用户私钥和第一终端用户公钥，对第一终端传输的、加密处理后的IMS媒体数据进行解密处理，得到IMS媒体数据，其中，加密处理后的IMS媒体数据为所述第一终端根据与所述第一终端用户公钥匹配的第一终端用户私钥和所述第二终端用户公钥，对所述IMS媒体数据进行加密处理后得到的。
具体的，根据上述第二终端用户私钥，对加密处理后的IMS媒体数据进行解密处理，得到一级加密数据，该一级加密数据为第一终端根据第一终端用户私钥对IMS媒体数据进行一级加密处理后得到的；根据第一终端用户公钥，对一级加密数据进行解密处理，得到IMS媒体数据。
本发明实施例的上述方案，第一终端对传输给第二终端的IMS数据进行两次加密处理，第二终端根据第二终端用户私钥和第一终端用户公钥对第一终端传输的IMS数据进行两次解密处理，有效保证了IMS数据传输过程中的安全性，且本发明实施例的上述方案无需通过第三方实现，仅靠移动终端便可完成。
第五实施例：
下面结合图6说明本发明实施例中第一终端与第二终端的交互流程。
如图6所示，上述交互流程包括：
步骤61：主叫用户(简称用户A)在第一终端的基于IMS的语音业务(Voice over LTE，VoLTE)的拨号界面上选择发起保密通话请求。
具体的，该VoLTE的拨号界面上可以为保密通话设置一个单独的寻呼按键，用户通过寻呼按键发起上述保密通话。
步骤62：第一终端收到用户A的保密通话请求后，获取第一终端此时的网络的信号强度、信噪比、终端电池电量等信息来构造一个随机数作为公钥生成算法的输入。
由于上述信息本身带有真随机数的特性，因此通过上述信息构造一随机数作为公钥生成算法的输入更有利于增强IMS数据传输过程中的安全性。
步骤63：第一终端根据公钥生成算法生成第一终端用户公钥和第一终端用户私钥。
步骤64：第一终端按照正常的VoLTE呼叫流程建立起非加密的VoLTE通话后，通过RTP数据包将第一终端用户公钥发送给第二终端。
具体的，第一终端按照正常的VoLTE呼叫流程建立起非加密的VoLTE通话后，生成本发明实施例中特定的RTP数据包，在该RTP数据包包头的PT字段填充代表需要进行加密通话的标识，并将第一终端用户公钥填入该RTP数据包的负载字段后发送给被叫用户，简称用户B，另外，考虑到RTP数据包是基于不可靠的用户数据报协议(User Datagram Protocol，UDP)来传输，可以连续发出多个相同的RTP数据包。
步骤65：第二终端收到上述RTP数据包后，判断第二终端是否支持保密通话。
具体的，第二终端在收到上述特定RTP包后，如果用户B支持保密通信，则可以识别该RTP包的PT字段并从该RTP包的负载中获取到第一终端用户公钥；反之如果第二终端不支持上述保密通信，则不会识别该 RTP包的PT字段。
本发明实施例中，可具体通过该第二终端收到上述RTP数据包的预定时间内是否向第一终端反馈第二终端用户公钥来判断第二终端是否支持保密通信，若第二终端在预定时间内反馈上述第二终端用户公钥，则判断出第二终端支持上述保密通信，否则，判断出第二终端不支持上述保密通信。
步骤661：若第二终端不支持上述保密通话，则忽略第一终端发送的RTP数据包，并按普通来电进行响应。
步骤662：用户A在预定时间内未收到用户B反馈的第二终端公钥，则提示用户A被叫方不支持保密通话，并继续使用普通VoLTE语言进行通信。
具体的，第一终端可在显示界面上以及语音同时提示被叫用户不支持上述VoLTE保密通信，用户可选择挂断电话或者使用非加密的普通VoLTE语音通信，此时，流程结束。
步骤671：若第二终端支持上述保密通话，则检测RTP数据包的负载数据的特定bit位及长度，若其中携带有效的第一终端用户公钥，则生成第二终端用户公钥及第二终端用户私钥。
在收到第一终端发来的特定RTP数据包后，并从RTP数据包的负载字段中获取到第一终端用户公钥，第二终端启动自身的密钥生成流程，生成第二终端用户公钥和第二终端用户私钥，且该生成方法与上述步骤62中第一终端用户公钥和第一终端用户私钥的生成方法相同。
步骤672：第二终端将第二终端用户公钥通过RTP数据包发送给第一终端。
步骤673：主被叫双方开始进行保密通信。
该保密通信可具体为VoLTE的语音或视频数据通过RTP数据包传输；用户A使用第一终端用户私钥对原始语音或视频数据做第一次加密，即数字签名，然后再对生成的密文使用第二终端用户公钥进行第二次加密，再 将第二次加密后的密文填充到语音或视频RTP的负载字段中发送给用户B；用户B在收到该RTP数据包后获取到密文，先使用第二终端用户私钥进行第一次解密，将得到的数据再使用第一终端用户公钥做第二次解密，验证用户A的数字签名；上述过程是对于用户A发送给用户B的语音数据的处理流程，对于用户B发送给用户A的语音数据也按照同样的流程处理。
步骤674：保密通信完成后第一终端和第二终端删除各自的公私钥对。
在保密通信完成之后，用户A和用户B销毁各自的公私钥对，并且每次通信都使用新生成的公私钥，使用一次一密的通信方式，即在每次保密通信发起时，各自重新生成新的公私钥对，提升了数据传输的安全性能。
本发明实施例的上述方案的保密通信方式，可以极大地提升VoLTE的安全性，且无需任何第三方或KMC/AuC/HSS的支持，用户无需担心在这些环节被泄密或受到监控；使用一次一密的方式更使得被攻击或破解的概率几乎为零。
第六实施例：
如图7所示，本发明的实施例还提供了一种数据传输装置，应用于第二终端，该数据传输装置包括：
第二获取模块71，设置为获取第一终端发送的第一终端用户公钥；
第一生成模块72，设置为生成第二终端用户公钥及与所述第二终端用户公钥匹配的第二终端用户私钥，并将所述第二终端用户公钥发送给所述第一终端；
第二处理模块73，设置为根据所述第二终端用户私钥和所述第一终端用户公钥，对所述第一终端传输的、加密处理后的IMS媒体数据进行解密处理，得到IMS媒体数据，其中，所述加密处理后的IMS媒体数据为所述第一终端根据与所述第一终端用户公钥匹配的第一终端用户私钥和所述第二终端用户公钥，对所述IMS媒体数据进行加密处理后得到的。
本发明实施例的数据传输装置，所述第二处理模块73包括：
第一解密子模块731，设置为根据所述第二终端用户私钥，对加密处理后的IMS媒体数据进行解密处理，得到一级加密数据，所述一级加密数据为所述第一终端根据第一终端用户私钥对所述IMS媒体数据进行一级加密处理后得到的；
第二解密子模块732，设置为根据第一终端用户公钥，对所述一级加密数据进行解密处理，得到所述IMS媒体数据。
本发明实施例的数据传输装置，所述第二获取模块71设置为从所述第一终端传输的RTP数据包中获取所述第一终端用户公钥。
本发明实施例的数据传输装置，所述第一生成模块72包括：
发送子模块721，设置为在实时传输协议RTP数据包中增加所述第二终端用户公钥，并将增加所述第二终端用户公钥的RTP数据包发送给所述第一终端。
需要说明的是，该装置是与上述方法实施例对应的装置，上述方法实施例中所有实现方式均适用于该装置的实施例中，也能达到相同的技术效果。
本发明实施例的上述技术方案，第一终端对传输给第二终端的IMS数据进行两次加密处理，第二终端根据第二终端用户私钥和第一终端用户公钥对第一终端传输的IMS数据进行两次解密处理，有效保证了IMS数据传输过程中的安全性，且本发明实施例的上述方案无需通过第三方实现，仅靠移动终端便可完成。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
本发明实施例的上述技术方案，可以应用于数据传输过程中，将预先生成的第一终端用户公钥发送给第二终端；获取所述第二终端接收到所述 第一终端用户公钥后，生成的第二终端用户公钥；根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端，大大增强了IMS数据在传输过程中的安全性。

Claims (11)

  1. 一种数据传输方法，应用于第一终端，包括：
    将预先生成的第一终端用户公钥发送给第二终端；
    获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；
    根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端。
  2. 根据权利要求1所述的数据传输方法，其中，所述根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理的步骤包括：
    根据所述第一终端用户私钥对所述IMS媒体数据进行一级加密处理，得到一级加密数据；
    根据所述第二终端用户公钥对所述一级加密数据进行二级加密处理，得到加密处理后的IMS媒体数据。
  3. 根据权利要求1所述的数据传输方法，其中，所述将预先生成的第一终端用户公钥发送给第二终端的步骤包括：
    与所述第二终端建立通信连接后，在实时传输协议RTP数据包中增加所述第一终端用户公钥，并将增加所述第一终端用户公钥的RTP数据包发送给所述第二终端。
  4. 根据权利要求1所述的数据传输方法，其中，在所述将预先生成的第一终端用户公钥发送给第二终端的步骤之前，所述方法还包括：
    检测到第一终端用户通过所述第一终端发起的加密通话请求后，生成第一终端用户公钥及与所述第一终端用户公钥匹配的第一终端用户私钥。
  5. 根据权利要求4所述的数据传输方法，其中，所述检测到第一终端用户通过所述第一终端发起的加密通话请求后，生成第一终端用户公钥和与所述第一终端用户公钥匹配的第一终端用户私钥的步骤包括：
    检测到第一终端用户通过所述第一终端发起的加密通话请求后，获取 与所述第一终端相关的第一终端属性信息，所述第一终端属性信息包括：所述第一终端的网络信号强度、所述第一终端的信噪比和/或所述第一终端的电池电量；
    根据所述第一终端属性信息，构造一随机数；
    根据所述随机数及密钥生成算法，生成所述第一终端用户公钥和第一终端用户私钥。
  6. 一种数据传输装置，应用于第一终端，包括：
    发送模块，设置为将预先生成的第一终端用户公钥发送给第二终端；
    第一获取模块，设置为获取所述第二终端接收到所述第一终端用户公钥后，生成的第二终端用户公钥；
    第一处理模块，设置为根据所述第二终端用户公钥和预先生成的、与所述第一终端用户公钥匹配的第一终端用户私钥，对IP多媒体子系统IMS媒体数据进行加密处理，并将加密处理后的IMS媒体数据传输给所述第二终端。
  7. 一种数据传输方法，应用于第二终端，包括：
    获取第一终端发送的第一终端用户公钥；
    生成第二终端用户公钥及与所述第二终端用户公钥匹配的第二终端用户私钥，并将所述第二终端用户公钥发送给所述第一终端；
    根据所述第二终端用户私钥和所述第一终端用户公钥，对所述第一终端传输的、加密处理后的IMS媒体数据进行解密处理，得到IMS媒体数据，其中，所述加密处理后的IMS媒体数据为所述第一终端根据与所述第一终端用户公钥匹配的第一终端用户私钥和所述第二终端用户公钥，对所述IMS媒体数据进行加密处理后得到的。
  8. 根据权利要求7所述的数据传输方法，其中，所述根据所述第二终端用户私钥和所述第一终端用户公钥，对所述第一终端传输的、加密处理后的IMS媒体数据进行解密处理，得到IMS媒体数据的步骤包括：
    根据所述第二终端用户私钥，对加密处理后的IMS媒体数据进行解密 处理，得到一级加密数据，所述一级加密数据为所述第一终端根据第一终端用户私钥对所述IMS媒体数据进行一级加密处理后得到的；
    根据第一终端用户公钥，对所述一级加密数据进行解密处理，得到所述IMS媒体数据。
  9. 根据权利要求7所述的数据传输方法，其中，所述获取第一终端发送的第一终端用户公钥的步骤包括：
    从所述第一终端传输的RTP数据包中获取所述第一终端用户公钥。
  10. 根据权利要求7所述的数据传输方法，其中，所述将所述第二终端用户公钥发送给所述第一终端的步骤包括：
    在实时传输协议RTP数据包中增加所述第二终端用户公钥，并将增加所述第二终端用户公钥的RTP数据包发送给所述第一终端。
  11. 一种数据传输装置，应用于第二终端，包括：
    第二获取模块，设置为获取第一终端发送的第一终端用户公钥；
    第一生成模块，设置为生成第二终端用户公钥及与所述第二终端用户公钥匹配的第二终端用户私钥，并将所述第二终端用户公钥发送给所述第一终端；
    第二处理模块，设置为根据所述第二终端用户私钥和所述第一终端用户公钥，对所述第一终端传输的、加密处理后的IMS媒体数据进行解密处理，得到IMS媒体数据，其中，所述加密处理后的IMS媒体数据为所述第一终端根据与所述第一终端用户公钥匹配的第一终端用户私钥和所述第二终端用户公钥，对所述IMS媒体数据进行加密处理后得到的。
PCT/CN2017/076487 2016-05-17 2017-03-13 一种数据传输方法及装置 WO2017197968A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610326085.1A CN107395552A (zh) 2016-05-17 2016-05-17 一种数据传输方法及装置
CN201610326085.1 2016-05-17

Publications (1)

Publication Number Publication Date
WO2017197968A1 true WO2017197968A1 (zh) 2017-11-23

Family

ID=60324768

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/076487 WO2017197968A1 (zh) 2016-05-17 2017-03-13 一种数据传输方法及装置

Country Status (2)

Country Link
CN (1) CN107395552A (zh)
WO (1) WO2017197968A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111526378B (zh) * 2019-02-02 2022-01-14 华为技术有限公司 一种签名信息的传输方法及装置
DE102019206302A1 (de) * 2019-05-02 2020-11-05 Continental Automotive Gmbh Verfahren und Vorrichtung zum Übertragen eines Boot-Codes mit verbesserter Datensicherheit
CN116596542A (zh) * 2023-05-24 2023-08-15 广东科谊网络技术有限公司 移动安全支付方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895877A (zh) * 2009-05-21 2010-11-24 华为技术有限公司 密钥协商方法、设备及系统
WO2013045750A1 (en) * 2011-09-30 2013-04-04 Nokia Corporation Method and apparatus for improving digital signatures
CN105379175A (zh) * 2013-06-24 2016-03-02 黑莓有限公司 用于合法拦截的安全方法
CN105530100A (zh) * 2016-01-12 2016-04-27 东南大学 一种VoLTE安全通信方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7240366B2 (en) * 2002-05-17 2007-07-03 Microsoft Corporation End-to-end authentication of session initiation protocol messages using certificates
US8085937B1 (en) * 2005-02-14 2011-12-27 Raytheon Company System and method for securing calls between endpoints
CN101626294A (zh) * 2008-07-07 2010-01-13 华为技术有限公司 基于身份的认证方法、保密通信方法、设备和系统
CN104539433A (zh) * 2014-10-30 2015-04-22 马洁韵 一种语音通话加密系统和加密方法
CN106856606A (zh) * 2015-12-08 2017-06-16 中兴通讯股份有限公司 通信方法、通信系统及移动终端
CN105357226A (zh) * 2015-12-16 2016-02-24 深圳市九鼎安华科技有限公司 一种基于voip通信的加密通信方法
CN105429753A (zh) * 2015-12-30 2016-03-23 宇龙计算机通信科技(深圳)有限公司 提高VoLTE通信安全性的语音数据方法、系统及移动终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895877A (zh) * 2009-05-21 2010-11-24 华为技术有限公司 密钥协商方法、设备及系统
WO2013045750A1 (en) * 2011-09-30 2013-04-04 Nokia Corporation Method and apparatus for improving digital signatures
CN105379175A (zh) * 2013-06-24 2016-03-02 黑莓有限公司 用于合法拦截的安全方法
CN105530100A (zh) * 2016-01-12 2016-04-27 东南大学 一种VoLTE安全通信方法

Also Published As

Publication number Publication date
CN107395552A (zh) 2017-11-24

Similar Documents

Publication Publication Date Title
US9537837B2 (en) Method for ensuring media stream security in IP multimedia sub-system
US7382881B2 (en) Lawful interception of end-to-end encrypted data traffic
US20150089220A1 (en) Technique For Bypassing an IP PBX
US8705743B2 (en) Communication security
WO2015180654A1 (zh) 一种保密通信实现方法及装置
US9674163B1 (en) Method for payload encryption of digital voice or data communications
Westerlund et al. Options for securing RTP sessions
Wang et al. A dependable privacy protection for end-to-end VoIP via Elliptic-Curve Diffie-Hellman and dynamic key changes
CN104683291B (zh) 基于ims系统的会话密钥协商方法
CN111756726A (zh) 一种支持国密算法的sip安全认证方法
WO2017197968A1 (zh) 一种数据传输方法及装置
WO2017215443A1 (zh) 报文传输方法、装置及系统
CN114630290A (zh) 语音加密通话的密钥协商方法、装置、设备及存储介质
Palmieri et al. Providing true end-to-end security in converged voice over IP infrastructures
US8924722B2 (en) Apparatus, method, system and program for secure communication
KR101210938B1 (ko) 암호 통신 방법 및 이를 이용한 암호 통신 시스템
CN104753869A (zh) 基于sip协议的通话加密方法
WO2010069102A1 (zh) 移动终端及其密钥传输、解密方法、保密通信的实现方法
Floroiu et al. A comparative analysis of the security aspects of the multimedia key exchange protocols
Southern et al. Solutions to security issues with legacy integration of GSM into UMTS
CN110890968B (zh) 一种即时通信方法、装置、设备及计算机可读存储介质
US20240097903A1 (en) Ipcon mcdata session establishment method
Naveed Asghar et al. Key management protocols for secure wireless multimedia services: A review
Bassil et al. Critical analysis and new perspective for securing Voice Networks
CN110933673B (zh) 一种ims网络的接入认证方法

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17798533

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17798533

Country of ref document: EP

Kind code of ref document: A1