CN101222612A - Method and system for safely transmitting media stream - Google Patents
Method and system for safely transmitting media stream Download PDFInfo
- Publication number
- CN101222612A CN101222612A CN 200710000851 CN200710000851A CN101222612A CN 101222612 A CN101222612 A CN 101222612A CN 200710000851 CN200710000851 CN 200710000851 CN 200710000851 A CN200710000851 A CN 200710000851A CN 101222612 A CN101222612 A CN 101222612A
- Authority
- CN
- China
- Prior art keywords
- key
- terminal
- media stream
- calling
- cscf
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0457—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention provides a method of safely transporting media stream and a system, wherein, the method includes the following steps: presetting a key generating unit which acquires encryption capability information of a terminal during a call flow, and generating keys of media stream according to the encryption capability information; transmitting the generated keys to the terminal and media stream carrying equipment respectively; transmitting the media stream through the terminal and the media stream carrying equipment by using the acquired keys. In the proposal of the invention, the keys are not generated by a call terminal self or a called terminal self, but is generated by the key generating unit without clock synchronization or supporting of a PKI system, thereby greatly reducing complexity of a terminal-to-terminal media stream key agreement, facilitating popularization of media stream encryption service, and meeting practical requirements of legal monitoring.
Description
Technical field
The present invention relates to the media stream privacy technology, particularly relate to a kind of method and system of safely transmitting media stream.
Background technology
Media Stream generally transmits based on RTP (RTP, Real-time Transport Protocol), and the described Media Stream here is audio medium stream, video media stream etc.But, potential safety hazard such as Media Stream is existed divulge a secret, quilt is attacked in transmission course because Real-time Transport Protocol itself do not relate to safety problem.
In order to strengthen the fail safe of Media Stream in transmission course, the method for multiple generation and distributing key has been proposed, i.e. cryptographic key negotiation method at present.Afterwards, terminal can utilize the key of distribution to realize the transmission of Media Stream, reaches the purpose of safely transmitting media stream.
In the prior art, two kinds of typical methods are arranged in the cryptographic key negotiation method: a kind of is multimedia internet key (MIKEY) PKI pattern, and another kind is a MIKEY DH pattern.
Wherein, the basic thought of MIKEY PKI pattern is: generate key and envelope key by calling terminal, described key is encrypted with the envelope key, the envelope key utilizes the PKI of terminal called certificate to encrypt again, key after will encrypting then sends to terminal called by the MIKEY agreement, terminal called deciphering back obtains key, finishes cipher key agreement process.
In MIKEY PKI pattern, for ensure cipher key agreement process safe, successfully carry out, require to carry out clock synchronization between calling terminal and the terminal called, and possess the support of Public Key Infrastructure(PKI) system.And in the practical application, realize that clock synchronization and PKI system support more complicated to be unfavorable for the realization of key agreement.Such as: in videoconference, there are a plurality of terminals that need media stream.If to the media stream privacy of a plurality of terminals, then need a plurality of terminals are carried out clock synchronization, this has increased the difficulty of key agreement greatly.Again such as: calling terminal and terminal called are common portable terminal, and because portable terminal quantity is big, will be difficult to finish in the PKI system work such as certificate management, can't carry out key agreement smoothly.
The basic thought of MIKEY DH pattern is: generate the DH value respectively at calling terminal and terminal called, utilize MIKEY agreement exchange DH value each other again, the DH value according to both sides produces key then.
MIKEY DH pattern also needs to carry out clock synchronization, and realizes that MIKEY DH pattern is very complicated, and amount of calculation is big, and terminal capabilities is required height, is unfavorable for the realization of key agreement.
In addition, in the practical application, operator satisfies the requirement of Lawful Interception for release mechanism, needs to obtain the key in the Media Stream.And in the prior art, have only the mutual terminal of participation just can obtain key, the mutual terminal of participation described here may also may be a plurality of terminals for caller and called two terminals, third party outside any participation is mutual can't obtain key, promptly can't satisfy the requirement of Lawful Interception.
Summary of the invention
The invention provides a kind of method and system of safely transmitting media stream, can under the condition that guarantees link safety, avoid processes such as clock synchronization, PKI support, certificate management, reduce the complexity that generates key, be convenient to the popularization of media stream privacy business.
In order to achieve the above object, the technical scheme of the present invention's proposition is:
A kind of method of safely transmitting media stream sets in advance the key generation unit, and this method may further comprise the steps:
A, key generation unit obtain the cryptographic capabilities information of terminal in call flow, and generate the key that is used for Media Stream according to described cryptographic capabilities information;
B, again the key that generates is sent to terminal respectively and is used for media stream bearing equipment;
The cipher key delivery Media Stream that C, terminal and media stream bearing equipment utilization are obtained.
In the such scheme, described key generation unit is the functional unit of Calling Side call conversation control function entity CSCF, and described terminal is a calling terminal, and then the described key generation unit of the steps A method of obtaining cryptographic capabilities information is specially:
Calling terminal makes a call, and the call request message that carries the self-encryption ability information is sent to Calling Side CSCF, and Calling Side CSCF obtains the cryptographic capabilities information of calling terminal from call request message.
In the such scheme, the cryptographic capabilities information-bearing of described calling terminal is in the Session Description Protocol SDP of call request message; The session initiation protocol SIP caller attributes that perhaps is carried on call request message receives to be consulted in the Accept-contact header field; Perhaps be carried in the call request message in the SIP extension negotiation territory, described SIP extension negotiation territory is for supporting the supported territory; Perhaps be carried in the call request message in the defined field of exposure draft RFC 4568 standards.
In the such scheme, the described method that key is sent to calling terminal of step B is:
When Calling Side CSCF receives call message from terminal called, the key that generates in advance is carried on described call message sends to calling terminal.
In the such scheme, described media stream bearing equipment is Calling Side Media proxy MP, and the described method that key is sent to Calling Side MP of step B is:
The message that Calling Side CSCF will carry key sends to Calling Side resource and access control subsystem RACS, and Calling Side RACS sends to key Calling Side MP again.
In the such scheme, described step C is specially:
When Media Stream when calling terminal is transferred to terminal called, the key that the calling terminal utilization is obtained is encrypted Media Stream, give Calling Side MP with the encrypted media flow transmission, Calling Side MP utilizes the key that obtains that Media Stream is decrypted again, and the media flow transmission after will deciphering is then gone out; And/or
When Media Stream when terminal called is transferred to calling terminal, Calling Side MP utilizes the key that obtains to encrypt from the Media Stream of terminal called, gives calling terminal with the encrypted media flow transmission, calling terminal utilizes the key that obtains that Media Stream is decrypted again.
In the such scheme, described key generation unit is the functional unit among the callee side CSCF, and described terminal is a terminal called, and then the described method of obtaining cryptographic capabilities information of steps A is specially:
Terminal called receives call request message from calling terminal by callee side CSCF, the call message that carries terminal called self-encryption ability information is returned to callee side CSCF, and callee side CSCF obtains the cryptographic capabilities information of terminal called from call message.
In the such scheme, the described method that key is sent to terminal called of step B is:
When callee side CSCF receives from calling terminal when calling out relevant message, the key that generates in advance is carried on the described message relevant with calling sends to terminal called.
In the such scheme, described media stream bearing equipment is callee side MP, and the described method that key is sent to callee side MP of step B is:
The message that callee side CSCF will carry key sends to callee side RACS, and callee side RACS sends to key callee side MP again.
In the such scheme, described step C is specially:
When Media Stream when calling terminal is transferred to terminal called, callee side MP utilizes the key that obtains to encrypt from the Media Stream of caller terminal, gives terminal called with the encrypted media flow transmission, terminal called utilizes the key that obtains that Media Stream is decrypted again; And/or
When Media Stream when terminal called is transferred to calling terminal, the key that the terminal called utilization is obtained is encrypted Media Stream, give callee side MP with the encrypted media flow transmission, callee side MP utilizes the key that obtains that Media Stream is decrypted again, and the media flow transmission after will deciphering is then gone out.
At second goal of the invention, the technical scheme that the present invention proposes is:
A kind of system of safely transmitting media stream comprises terminal, media stream bearing equipment, and this system also comprises the key generation unit;
Described terminal is used for the self-encryption ability information is sent to the key generation unit, obtains key, is responsible for media stream according to key;
Described media stream bearing equipment is used to receive the key that is generated by the key generation unit, is responsible for media stream according to key;
Described key generation unit is used for the cryptographic capabilities information that receiving terminal is imported, and generates key, and the key that generates is sent to terminal and media stream bearing equipment respectively.
In the such scheme, described key generation unit is the functional unit among the P-CSCF, and described media stream bearing equipment is MP, and this system further comprises:
RACS is used for receiving the key that is generated by P-CSCF key generation unit, and key is transmitted to MP.
In sum, the present invention proposes a kind of method and system of safely transmitting media stream, terminal self does not generate key, but generate key by the key generation unit, need not to carry out clock synchronization, also need not the support of PKI system, can reduce the complexity that generates key greatly, realize the safely transmitting media stream purpose, also be convenient to the popularization of media stream privacy business.Because Calling Side and callee side can independently generate the key of self, need not to consult with the other side, so, generating and issuing in the process of key, do not influence the execution of call flow.In addition, what transmit between the media stream bearing equipment owing to Calling Side and callee side is expressly, can satisfy the actual demand of Lawful Interception.
Description of drawings
Fig. 1 is a flow chart of the present invention;
Fig. 2 is the message flow schematic diagram among the method embodiment;
Fig. 3 is the basic block diagram of system of the present invention;
Fig. 4 is the structure chart of system embodiment.
Embodiment
For making the purpose, technical solutions and advantages of the present invention clearer, the present invention is described in further detail below in conjunction with the accompanying drawings and the specific embodiments.
Basic thought of the present invention is: set in advance the key generation unit, be responsible for the generation and the distribution of key; The cipher key delivery Media Stream that terminal and media stream bearing equipment utilization are obtained from the key generation unit, thus reach the purpose of safely transmitting media stream.
Fig. 1 is a flow chart of the present invention.As shown in Figure 1, the present invention includes following steps:
Step 101: the key generation unit obtains the cryptographic capabilities information of terminal in call flow, and generates the key that is used for Media Stream according to described cryptographic capabilities information.
Step 102: the key generation unit sends to the key that generates respectively terminal and is used for media stream bearing equipment again.
Step 103: the cipher key delivery Media Stream that terminal and media stream bearing equipment utilization are obtained.
Because call flow relates to Calling Side and callee side, the present invention realizes that safely transmitting media stream also correspondingly is divided into Calling Side and two kinds of situations of callee side.
For Calling Side, described terminal is a calling terminal; Described key generation unit is a Calling Side key generation unit, and Calling Side key generation unit can be the functional unit among the Calling Side CSCF; Described media stream bearing equipment is Calling Side media stream bearing equipment, i.e. Calling Side MP.
In this case, the described method of obtaining calling terminal cryptographic capabilities information of step 101 is: calling terminal makes a call, the call request message that carries the self-encryption ability information is sent to Calling Side CSCF, and Calling Side CSCF obtains the cryptographic capabilities information of calling terminal from call request message.
Correspondingly, the method that described in the step 102 key is sent to calling terminal is: when Calling Side CSCF receives call message from terminal called, the key that generates in advance is carried on described call message sends to calling terminal.
Correspondingly, the method that described in the step 102 key is sent to Calling Side MP is: the message that Calling Side CSCF will carry key sends to Calling Side resource and access control subsystem RACS; Calling Side RACS sends to key Calling Side MP again.
At this moment, calling terminal and Calling Side MP have obtained key from Calling Side P-CSCF, just can utilize described cipher key delivery Media Stream.Media stream described here can be divided into two kinds of situations again:
A kind of situation is: when Media Stream when calling terminal is transferred to terminal called, the key that the calling terminal utilization is obtained is encrypted Media Stream, give Calling Side MP with the encrypted media flow transmission, Calling Side MP utilizes the key that obtains that Media Stream is encrypted again, media flow transmission after will deciphering is then gone out, and promptly is transferred to callee side.
Another situation is: when Media Stream when terminal called is transferred to calling terminal, Calling Side MP utilizes the key that obtains to encrypt from the Media Stream of terminal called, give calling terminal with the encrypted media flow transmission, calling terminal utilizes the key that obtains that Media Stream is decrypted again.
In the practical application, Media Stream can only be transferred to terminal called from calling terminal, perhaps only is transferred to calling terminal from terminal called, and perhaps calling terminal and terminal called are all to the other side's media stream.
For callee side, described terminal is a terminal called; Described key generation unit is a callee side key generation unit, and callee side key generation unit can be the functional unit among the callee side CSCF; Described media stream bearing equipment is callee side media stream bearing equipment, i.e. callee side MP.
In this case, the described method of obtaining terminal called cryptographic capabilities information of step 101 is: terminal called receives call request message from calling terminal by callee side CSCF, the call message that carries terminal called self-encryption ability information is returned to callee side CSCF, and callee side CSCF obtains the cryptographic capabilities information of terminal called from call message.
Correspondingly, the described method that key is sent to terminal called of step 102 is: when callee side CSCF receives from calling terminal when calling out relevant message, the key that generates in advance is carried on the described message relevant with calling sends to terminal called.The message relevant with calling described here can be acknowledge message or information change message etc.
Correspondingly, the described method that key is sent to callee side MP of step 102 is: the message that callee side CSCF will carry key sends to callee side RACS, and callee side RACS sends to key callee side MP again.
At this moment, terminal called and callee side MP have obtained key from callee side P-CSCF, just can utilize described cipher key delivery Media Stream.Similar to Calling Side, media stream described here can be divided into two kinds of situations again:
A kind of situation is: when Media Stream when calling terminal is transferred to terminal called, callee side MP utilizes the key that obtains to encrypt from the Media Stream of caller terminal, give terminal called with the encrypted media flow transmission, terminal called utilizes the key that obtains that Media Stream is decrypted again.
Another situation is: when Media Stream when terminal called is transferred to calling terminal, the key that the terminal called utilization is obtained is encrypted Media Stream, give callee side MP with the encrypted media flow transmission, callee side MP utilizes the key that obtains that Media Stream is encrypted again, and the media flow transmission after will deciphering is then gone out.
Among the present invention, Calling Side and callee side all are to generate key independently, and the delivering key that generates are given the terminal and the media stream bearing equipment of this side.That is to say, when a certain adnation becomes key, since this key only be used under this side the zone in media stream, and all adopt plaintext transmission outside Calling Side and the callee side zone, so, when generating key, do not need to hold consultation with the other side, the key that does not also need self to generate sends to the other side.
It should be noted that the present invention is the method that safely transmitting media stream is described with Calling Side or callee side one side, and in actual applications, because calling procedure and media stream will relate to Calling Side and callee side simultaneously.For the present invention program better is described, following preferred embodiment relates to Calling Side and callee side simultaneously, with the method for complete description safely transmitting media stream.
Method embodiment
In the present embodiment, at Calling Side and callee side the key generation unit is set in advance, Calling Side key generation unit is the functional unit among the Calling Side P-CSCF, and callee side key generation unit is the functional unit among the callee side P-CSCF; Certainly, in the practical application, the key generation unit also can not be the functional unit among the P-CSCF, but a server independently.
In the present embodiment, Calling Side also comprises calling terminal, Calling Side RACS, Calling Side MP; Callee side also comprises terminal called, callee side RACS, callee side MP.
Suppose that in addition the key that Calling Side P-CSCF generates is x, the key that callee side P-CSCF generates is y.
Fig. 2 is the message flow schematic diagram of present embodiment.As shown in Figure 2, present embodiment may further comprise the steps:
Step 201: Calling Side makes a call, and the call request message that carries the self-encryption ability information is sent to Calling Side P-CSCF.
Call request message described here is the INVITE in the Session Initiation Protocol, can adopt four kinds of methods with the cryptographic capabilities information-bearing of calling terminal in INVITE: first method is to be carried among the SDP of INVITE; Second method is to be carried in the INVITE SIP caller attributes to receive and consult in (Accept-contact) header field; The third method is to be carried in the extension negotiation territory of SIP in the INVITE; The 4th kind of method is to be carried in the defined field of exposure draft in the INVITE (RFC4568) standard.
For first kind of bearing method, promptly be carried in the Session Description Protocol (SDP), the form of described cryptographic capabilities information is:
m＝<media><port>srtp/avp<format-list>
[a＝media_encryption:
SRTP&
[Lists?of?the?Encrypted?Algorithms]&
[Lists?of?the?Encrypted?Key?Length]&
[Lists?of?the?Message?Authentication?Algorithms]&
[Lists?of?the?Message?Authentication?Key?Length]&
[Key?Generation?side?declartion]&
[Key?derivation?rate]；]...
Wherein, the m field is carried media information, the statement of support media ability; The a field then is used for Media Stream is carried out attribute description, the implication of these attribute descriptions as shown in Table 1:
Table one
If calling terminal is specified: adopt the SRTP agreement; the AES-CM cryptographic algorithm; the length of encryption key is 128 bits or 256 bits; message authentication and protection algorithm integrallty adopt HMAC-SHA1; message authentication and integrity protection key length position 160 bits; key updating speed is 24, and the key ability information in the then described call request message is:
m＝<media><port>srtp/avp<format-list>
a＝media_encryption:SRTP&AES-CM&128；256&HMAC-SHA1&160&24
For second kind of bearing method, promptly be carried in the SIP caller attributes Accept-contact header field, its form is:
Accept_Contact:*；media_encryption＝
”SRTP&
[Lists?of?the?Encrypted?Algorithms]&
[Lists?of?the?Encrypted?Key?Length]&
[Lists?of?the?Message?Authentication?Algorithms]&
[Lists?of?the?Message?Authentication?Key?Length]&
[Key?Generation?side?declartion]&
[Key?derivation?rate]”；....
Wherein, the implication of each son field is identical with table one in the media_encryption field, repeats no more herein.
If the cryptographic capabilities information of calling terminal is identical with first method, its form is: Accept_Contact:media_encryption=" SRTP﹠amp; AES-CM﹠amp; 128; 256﹠amp; HMAC-SHA1﹠amp; 160﹠amp; 24 "
For the third bearing method, promptly be carried in the extension negotiation territory of SIP, then direct ability information with calling terminal writes in the Supported header field and gets final product, such as:
Supported:media_encryption＝SRTP-[AES-CM]-[128；256；512]-[HMAC-SHA1]-[160]
Wherein the implication of son field is identical with table one, repeats no more herein.
For the 4th kind of bearing method, promptly be carried in the RFC 4568 defined fields, its form is:
a＝crypto:1AES_CM_128_HMAC_SHAI_80
inline:
Wherein the implication of son field is also identical with table one, repeats no more herein.
Step 202: Calling Side P-CSCF sends to callee side P-CSCF with call request message.
Step 203: the key generation unit among the Calling Side P-CSCF generates key x according to the cryptographic capabilities information of calling terminal.
In the present embodiment, the key generation unit that increases newly is a functional unit among the P-CSCF, and practical application can also be for other CSCF, such as S-CSCF.
If the key generation unit is not the functional unit among the P-CSCF, but a server independently then needs to provide the interface between P-CSCF and this server, and P-CSCF obtains the key of generation from server by interface.
Step 204: Calling Side P-CSCF initiates the resource reservation process, and in the resource reservation process, Calling Side P-CSCF sends to Calling Side RACS with the key x that generates.
Step 205: Calling Side RACS sends to Calling Side MP with key x again.
Here, described step 204 and step 205 are resource reservation processes, mainly determine information such as service quality (Qos), thresholding control, and information such as definite Qos, thresholding control are sent to Calling Side MP by policy distribution message.In the resource reservation process, P-CSCF can be in resource request message (AAR) the medium sub-component data value of media component descriptor (Media-Component-Description) to field that is used to carry key of expansion in (Media-Sub-Component AVP), such as media encryption key (Media-Encryption-Key) field, the key that generates is recorded in this field, key is sent to Calling Side RACS.Form after the expansion can for:
Media-Component-Description::＝<AVP?Header:519>
{Media-Component-Number}
*[Media-Sub-Component]
[AF-Application-Identifier]
[Media-Type]
[Max-Requested-Bandwidth-UL]
[Max-Requested-Bandwidth-DL]
[Flow-Status]
[RS-Bandwidth]
[RR-Bandwidth]
[Media-Encryption-Key]
Wherein, [Media-Encryption-Key] is exactly the field of expansion, is used to carry key.
Certainly, in the practical application, key can not send to Calling Side RACS by the AAR message yet, and issues by other messages, such as resource modifying message etc., as for how issuing and how to expand the then realization with concrete relevant, repeats no more herein.
After Calling Side RACS receives key, can be by H.248 agreement or public open policy service protocol (COPS) agreement send to Calling Side MP with key.
If Calling Side RACS sends COPS message to Calling Side MP, its form is:
<Decision?Message>::＝<Common?Header>
<Client?Handle>
*(<Decision>)|<Error>
[<Integrity>]
<Decision>::＝<Context>
<Decision?Flags>
[<Named?Decision?Data:Provisioning>]
<Named?Decision?Data:Provisioning>::＝<Install?Decision>
<Install?Decision>::＝*(<PRID><EPD>)
At this moment, can specify: Op Code=2 among the Common Header, Flags=1; Client Handler object is essential; In the Decision object, specify Command-Code=1 (Install), Flags=0x02; In Named Decision Data:Provisioning object, specify C-Num=5; Expansion Media-Encryption-Key field is used to carry the key that Calling Side RACS receives in Install Decision object.
If issue key by agreement H.248, then can be when using interpolation (Add) order in association, to increase destination node, stream description (Stream Descriptor) based on media description (Media Descriptor) carries key, and soon the Media-Encryption-Key field value copies among the property identifier SDP_A and encryptkey of MediaDescriptor in the Diameter message.
In addition, after Calling Side P-CSCF received call request message in the step 202, one side continued to carry out follow-up call flow, and promptly execution in step 206; One side generates and issues key, i.e. execution in step 203～step 205.That is to say the follow-up call flow and the generation of key and to issue be two flow processs arranged side by side, not strict in time sequencing.
In addition, in the present embodiment, Calling Side P-CSCF sends to Calling Side MP by initiating the resource reservation process with key, and in actual applications, also can key be sent to Calling Side MP by a process that independently issues key.That is to say, as long as the key that generates can be sent to caller MP.
Step 206: callee side P-CSCF sends to terminal called with call request message.
Step 207: terminal called returns the call message that carries the self-encryption ability information to callee side P-CSCF, and callee side P-CSCF obtains the cryptographic capabilities information of terminal called from call message.
Here, described call message is relevant with the call request message that terminal called receives, and can be 183 message, also can be 200OK message.
Step 208: callee side P-CSCF sends to Calling Side P-CSCF with call message.
Step 209: Calling Side P-CSCF returns to calling terminal by call message with the key that self generates in advance.
In this step, if call message is 183 message, then Calling Side P-CSCF can be carried on the key x that generates in advance in the k field of SDP and send to calling terminal.In addition, if adopt the statement mechanism of RFC 4568 before, just key can be carried in the inline field.
If call message is 200OK message, then can carry key x at SIP header field of 200OK extension of message.Such as: expand a Media-Key header field, its form is as follows:
Media-Key:<Key>
Wherein, Key represents the key that generates.Like this, just can utilize 200OK that key x is returned to calling terminal.
Step 210: the generation cipher key unit among the callee side P-CSCF generates key y according to the cryptographic capabilities information of terminal called.
Step 211: callee side P-CSCF initiates the resource reservation process, and the message that will carry key y in described resource reservation process sends to callee side RACS.
Step 212: callee side RACS sends to callee side MP with key y again.
Here, described step 211～step 212 is that callee side P-CSCF is handed down to callee side MP with the cipher key processes resource reservation process that generates, and its method is identical with step 204～step 205, is not described in detail herein.
When Calling Side P-CSCF received call message, one side was carried out follow-up call flow, i.e. execution in step 208～step 209; One side generates and issues key, i.e. execution in step 210～step 212.That is to say, at callee side, the follow-up call flow and the generation of key and to issue also be two flow processs arranged side by side, not strict in time sequencing.
Step 213～step 214: calling terminal sends to callee side P-CSCF by Calling Side P-CSCF with acknowledge message.
Step 215: callee side P-CSCF sends to terminal called by acknowledge message with the key y that generates.
In the present embodiment, callee side P-CSCF is by acknowledge message, and promptly PRACK message or ACK message send to terminal called with key y.If what return before the terminal called is 183 message, then calling terminal need send PRACK message to terminal called, and callee side P-CSCF can be carried on key y in the k field of SDP in the PRACK message; If what return before the terminal called is 200OK message, then calling terminal need send ACK message to terminal called, and callee side P-CSCF can be carried on key y in the Media-Key field of expanding in the ACK message.
Step 216: the cipher key delivery Media Stream that calling terminal, Calling Side MP, callee side MP and terminal called utilization are obtained separately.
In the practical application, when calling terminal was called out terminal called, interactive messages or signaling should be transmitted by signaling link, and but behind the access success, media stream data then should transmit by data link, promptly by calling terminal, Calling Side MP, callee side MP and terminal called transmission.
The method of media stream is specially:
When Media Stream when calling terminal is transferred to terminal called, the key x that the calling terminal utilization is obtained encrypts Media Stream, gives Calling Side MP with the encrypted media flow transmission; Calling Side MP utilizes the key x that obtains that Media Stream is decrypted again, and the media flow transmission after will deciphering is then given callee side MP; Callee side MP utilizes the key y that obtains that Media Stream is encrypted, and gives terminal called with the encrypted media flow transmission, and terminal called utilizes the key y that obtains that Media Stream is decrypted again.
When Media Stream when terminal called is transferred to calling terminal, terminal called utilizes key y that Media Stream is encrypted, and gives callee side MP with the encrypted media flow transmission; Callee side MP utilizes key y that Media Stream is decrypted again, and the media flow transmission after will deciphering is then given Calling Side MP; Calling Side MP utilizes key x that Media Stream is encrypted, and gives calling terminal with the encrypted media flow transmission; Calling terminal utilizes key x that Media Stream is decrypted again.
That is to say that Media Stream carries out safe transmission after Calling Side is encrypted with key x, after callee side is encrypted with key y, carry out safe transmission.
In addition, in the practical application, if terminal called returns 183 message, calling terminal also need send information updating message, i.e. UPDATE message to terminal called after sending PRACK message.At this moment, callee side P-CSCF can not send key y by PACK message to terminal called yet, but sends key y by UPDATE message to terminal called.
In a word, the present invention it is emphasized that: the key generation unit obtains the cryptographic capabilities information of terminal in call flow, generates key according to cryptographic capabilities information, key is sent to terminal and media stream bearing equipment respectively again.As for obtaining cryptographic capabilities information in which the bar message from call flow, which bar message to give terminal by with delivering key, and how can determine for media stream bearing equipment by the user who uses the present invention program voluntarily delivering key, repeat no more herein.
The embodiment of the invention is containing the network of IP Multimedia System (IMS), and in the IMS network signaling link situation of safety guarantee can be provided is that example describes.In the practical application, the inventive method can also be applied in the network of other types, as: based on the next generation network of soft switch, its method and the present invention are similar, enumerate no longer one by one herein.
At the method for safely transmitting media stream, the present invention also proposes a kind of system of safely transmitting media stream.Fig. 3 is the basic structure schematic diagram of safely transmitting media stream system.As shown in Figure 3, this system comprises: terminal 301, media stream bearing equipment 302 and key generation unit 303.
Wherein, described terminal 301 is used for the self-encryption ability information is sent to key generation unit 303, obtains key and is responsible for Media Stream according to key.
Described media stream bearing equipment 302 is used to receive the key that is generated by key generation unit 303, is responsible for media stream according to key.
Described key generation unit 303 is used for the cryptographic capabilities information that receiving terminal 301 is imported, and generates key, and the key that generates is sent to terminal 301 and media stream bearing equipment 302 respectively.
Here, described terminal 301 can be calling terminal or terminal called; Described media stream bearing equipment 302 can be described media stream bearing equipment of Calling Side or callee side media stream bearing equipment; Described key generation unit 303 can be Calling Side key generation unit or callee side key generation unit, and the key generation unit can be the functional unit among the P-CSCF, also can be server independently.
For system configuration of the present invention and function are described better, be described in detail with a system embodiment below.
System embodiment
In the present embodiment, the key generation unit is the functional unit among the P-CSCF, and media stream bearing equipment is MP, obtains key by RACS.
Fig. 4 is a system configuration schematic diagram of the present invention.As shown in Figure 4, present embodiment comprises calling terminal 401, Calling Side P-CSCF402, Calling Side RACS403, Calling Side MP404, terminal called 405, callee side P-CSCF406, callee side RACS407, callee side MP408.
Described calling terminal 401 and terminal called 405 send to the self-encryption ability information Calling Side P-CSCF402 and callee side P-CSCF406 respectively, obtain key, are responsible for media stream according to key.
Described Calling Side P-CSCF402 and callee side P-CSCF406 generate key respectively, and the key that generates is sent to Calling Side RACS403 and callee side RACS407 respectively.
Described Calling Side RACS403 and callee side RACS407, the key with Calling Side P-CSCF402 and callee side P-CSCF406 generation is transmitted to Calling Side MP404 and callee side MP408 respectively.
Described Calling Side MP404 and callee side MP408 receive key from Calling Side RACS403 and callee side RACS407 respectively, are responsible for media stream according to key.
When calling terminal 401 made a call, calling terminal 401 sent the call request message that carries the self-encryption ability information to Calling Side P-CSCF402; Calling Side P-CSCF402 sends to terminal called 405 by callee side P-CSCF406 with call request message, simultaneously, Calling Side P-CSCF402 generates key according to the cryptographic capabilities information of calling terminal 401, and by Calling Side RACS403 key is sent to Calling Side MP404; When terminal called 405 receives call request message, return the call message that carries the self-encryption ability information to callee side P-CSCF406; Callee side P-CSCF406 returns to Calling Side P-CSCF402 with call message, the key that Calling Side P-CSCF402 will generate in advance again is carried on call message and returns to calling terminal 401, simultaneously, callee side P-CSCF406 generates key according to the cryptographic capabilities information of terminal called 405, and by callee side RACS407 key is sent to Calling Side MP408; After this, calling terminal 401, Calling Side MP404, callee side RACS407 and terminal called 405 utilize the cipher key delivery Media Stream again.
Use the present invention program, terminal and media stream bearing equipment can obtain the key that is generated by the key generation unit, do not need to carry out relatively more complicated process such as certificate management, clock synchronization, can realize safely transmitting media stream at an easy rate; What transmit between Calling Side media stream bearing equipment and the callee side media stream bearing equipment is that can satisfy legal entity is not having under the situation of key, realizes carrying out the actual demand of Lawful Interception not through encrypted media stream; In addition, be independently because Calling Side and callee side generate key, need not to hold consultation, when generating and issuing key, can not influence the execution of call flow.
In sum, more than be preferred embodiment of the present invention only, be not to be used to limit protection scope of the present invention.Within the spirit and principles in the present invention all, any modification of being done, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (12)
1. the method for a safely transmitting media stream is characterized in that, sets in advance the key generation unit, and this method may further comprise the steps:
A, key generation unit obtain the cryptographic capabilities information of terminal in call flow, and generate the key that is used for Media Stream according to described cryptographic capabilities information;
B, again the key that generates is sent to terminal respectively and is used for media stream bearing equipment;
The cipher key delivery Media Stream that C, terminal and media stream bearing equipment utilization are obtained.
2. method according to claim 1, it is characterized in that, described key generation unit is the functional unit of Calling Side call conversation control function entity CSCF, and described terminal is a calling terminal, and then the described key generation unit of the steps A method of obtaining cryptographic capabilities information is specially:
Calling terminal makes a call, and the call request message that carries the self-encryption ability information is sent to Calling Side CSCF, and Calling Side CSCF obtains the cryptographic capabilities information of calling terminal from call request message.
3. method according to claim 2 is characterized in that, the cryptographic capabilities information-bearing of described calling terminal is in the Session Description Protocol SDP of call request message; The session initiation protocol SIP caller attributes that perhaps is carried on call request message receives to be consulted in the Accept-contact header field; Perhaps be carried in the call request message in the SIP extension negotiation territory, described SIP extension negotiation territory is for supporting the supported territory; Perhaps be carried in the call request message in the defined field of exposure draft RFC 4568 standards.
4. method according to claim 2 is characterized in that, the described method that key is sent to calling terminal of step B is:
When Calling Side CSCF receives call message from terminal called, the key that generates in advance is carried on described call message sends to calling terminal.
5. method according to claim 2 is characterized in that, described media stream bearing equipment is Calling Side Media proxy MP, and the described method that key is sent to Calling Side MP of step B is:
The message that Calling Side CSCF will carry key sends to Calling Side resource and access control subsystem RACS, and Calling Side RACS sends to key Calling Side MP again.
6. method according to claim 2 is characterized in that, described step C is specially:
When Media Stream when calling terminal is transferred to terminal called, the key that the calling terminal utilization is obtained is encrypted Media Stream, give Calling Side MP with the encrypted media flow transmission, Calling Side MP utilizes the key that obtains that Media Stream is decrypted again, and the media flow transmission after will deciphering is then gone out; And/or
When Media Stream when terminal called is transferred to calling terminal, Calling Side MP utilizes the key that obtains to encrypt from the Media Stream of terminal called, gives calling terminal with the encrypted media flow transmission, calling terminal utilizes the key that obtains that Media Stream is decrypted again.
7. method according to claim 1 is characterized in that, described key generation unit is the functional unit among the callee side CSCF, and described terminal is a terminal called, and then the described method of obtaining cryptographic capabilities information of steps A is specially:
Terminal called receives call request message from calling terminal by callee side CSCF, the call message that carries terminal called self-encryption ability information is returned to callee side CSCF, and callee side CSCF obtains the cryptographic capabilities information of terminal called from call message.
8. method according to claim 7 is characterized in that, the described method that key is sent to terminal called of step B is:
When callee side CSCF receives from calling terminal when calling out relevant message, the key that generates in advance is carried on the described message relevant with calling sends to terminal called.
9. method according to claim 7 is characterized in that, described media stream bearing equipment is callee side MP, and the described method that key is sent to callee side MP of step B is:
The message that callee side CSCF will carry key sends to callee side RACS, and callee side RACS sends to key callee side MP again.
10. method according to claim 7 is characterized in that, described step C is specially:
When Media Stream when calling terminal is transferred to terminal called, callee side MP utilizes the key that obtains to encrypt from the Media Stream of caller terminal, gives terminal called with the encrypted media flow transmission, terminal called utilizes the key that obtains that Media Stream is decrypted again; And/or
When Media Stream when terminal called is transferred to calling terminal, the key that the terminal called utilization is obtained is encrypted Media Stream, give callee side MP with the encrypted media flow transmission, callee side MP utilizes the key that obtains that Media Stream is decrypted again, and the media flow transmission after will deciphering is then gone out.
11. the system of a safely transmitting media stream comprises terminal, media stream bearing equipment, it is characterized in that this system also comprises the key generation unit;
Described terminal is used for the self-encryption ability information is sent to the key generation unit, obtains key, is responsible for media stream according to key;
Described media stream bearing equipment is used to receive the key that is generated by the key generation unit, is responsible for media stream according to key;
Described key generation unit is used for the cryptographic capabilities information that receiving terminal is imported, and generates key, and the key that generates is sent to terminal and media stream bearing equipment respectively.
12. system according to claim 11 is characterized in that, described key generation unit is the functional unit among the P-CSCF, and described media stream bearing equipment is MP, and this system further comprises:
RACS is used for receiving the key that is generated by P-CSCF key generation unit, and key is transmitted to MP.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 200710000851 CN101222612A (en) | 2007-01-12 | 2007-01-12 | Method and system for safely transmitting media stream |
| PCT/CN2007/071412 WO2008083607A1 (en) | 2007-01-12 | 2007-12-29 | Method and system of safely transferring media stream |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 200710000851 CN101222612A (en) | 2007-01-12 | 2007-01-12 | Method and system for safely transmitting media stream |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101222612A true CN101222612A (en) | 2008-07-16 |
Family
ID=39608363
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 200710000851 Pending CN101222612A (en) | 2007-01-12 | 2007-01-12 | Method and system for safely transmitting media stream |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN101222612A (en) |
| WO (1) | WO2008083607A1 (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011020332A1 (en) * | 2009-08-20 | 2011-02-24 | 中兴通讯股份有限公司 | Method and system for encrypting media data of ip multimedia subsystem session |
| WO2014166366A1 (en) * | 2013-04-09 | 2014-10-16 | 中兴通讯股份有限公司 | Method and device for performing capability negotiation in a long term evolution cluster network |
| CN104796401A (en) * | 2015-03-12 | 2015-07-22 | 天翼电信终端有限公司 | A method and a system for realizing encryption speech communication over an intermediate platform |
| CN111884802A (en) * | 2020-08-25 | 2020-11-03 | 中移（杭州）信息技术有限公司 | Media stream encryption transmission method, system, terminal and electronic equipment |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108123951B (en) * | 2017-12-25 | 2020-10-09 | 成都三零瑞通移动通信有限公司 | Cluster communication off-line direct-communication voice group call transmission encryption method and device |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1115924C (en) * | 1999-09-09 | 2003-07-23 | 深圳市中兴通讯股份有限公司 | Encryption method for mobile telephone |
| JP2003101570A (en) * | 2001-09-21 | 2003-04-04 | Sony Corp | Communication processing system and method, and its server device and computer program |
| CN100512103C (en) * | 2004-04-07 | 2009-07-08 | 华为技术有限公司 | Secret key distributing method of end-to-end encrypted telecommunication |
| JP2007005878A (en) * | 2005-06-21 | 2007-01-11 | Kddi Corp | Shared key generating method, shared key generating system, encrypted data copying method, shared key generating program, encrypted data transmission program, and encrypted data reception program |
| CN100527875C (en) * | 2005-06-30 | 2009-08-12 | 华为技术有限公司 | Method for achieving media flow security and communication system |
-
2007
- 2007-01-12 CN CN 200710000851 patent/CN101222612A/en active Pending
- 2007-12-29 WO PCT/CN2007/071412 patent/WO2008083607A1/en active Application Filing
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011020332A1 (en) * | 2009-08-20 | 2011-02-24 | 中兴通讯股份有限公司 | Method and system for encrypting media data of ip multimedia subsystem session |
| WO2014166366A1 (en) * | 2013-04-09 | 2014-10-16 | 中兴通讯股份有限公司 | Method and device for performing capability negotiation in a long term evolution cluster network |
| CN104796401A (en) * | 2015-03-12 | 2015-07-22 | 天翼电信终端有限公司 | A method and a system for realizing encryption speech communication over an intermediate platform |
| CN104796401B (en) * | 2015-03-12 | 2017-11-03 | 天翼电信终端有限公司 | A kind of method and system that enciphoring voice telecommunication is realized by halfpace |
| CN111884802A (en) * | 2020-08-25 | 2020-11-03 | 中移（杭州）信息技术有限公司 | Media stream encryption transmission method, system, terminal and electronic equipment |
| CN111884802B (en) * | 2020-08-25 | 2023-04-11 | 中移（杭州）信息技术有限公司 | Media stream encryption transmission method, system, terminal and electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2008083607A1 (en) | 2008-07-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9537837B2 (en) | Method for ensuring media stream security in IP multimedia sub-system | |
| CN101232368B (en) | Method for distributing media stream cryptographic key and multimedia subsystem | |
| CN101635823B (en) | Method and system of terminal for encrypting videoconference data | |
| EP1717986B1 (en) | Key distribution method | |
| WO2015180654A1 (en) | Method and apparatus for achieving secret communications | |
| EP2426852B1 (en) | Method and system for implementing secure forking calling session in ip multi-media subsystem | |
| JP4856723B2 (en) | Method, apparatus and / or computer program product for encrypting and transmitting media data between a media server and a subscriber device | |
| CN101175074A (en) | Method and system for implementing end-to-end media stream cryptographic key negotiation | |
| CN104683291B (en) | Session key negotiation method based on IMS system | |
| CN101141251B (en) | Method, system and equipment of message encryption signature in communication system | |
| CN104683098B (en) | A kind of implementation method of secure traffic, equipment and system | |
| CN101222320B (en) | Method, system and device for media stream safety context negotiation | |
| CN108833943A (en) | The encrypted negotiation method, apparatus and conference terminal of code stream | |
| CN101222612A (en) | Method and system for safely transmitting media stream | |
| CN102025485B (en) | Key negotiation method, key management server and terminal | |
| EP2266251B1 (en) | Efficient multiparty key exchange | |
| CN101729535B (en) | Implementation method of media on-demand business | |
| WO2021109998A1 (en) | Media content transmission method and apparatus, and storage medium | |
| WO2008083620A1 (en) | A method, a system and an apparatus for media flow security context negotiation |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Open date: 20080716 |