WO2007051415A1

WO2007051415A1 - Mobile communication system, and information transmitting method and device wherein

Info

Publication number: WO2007051415A1
Application number: PCT/CN2006/002932
Authority: WO
Inventors: Peng Wang; Hanyan Huang; Jing Wang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-11-01
Filing date: 2006-11-01
Publication date: 2007-05-10

Abstract

A mobile communication system, and information transmitting method and device wherein are provided in the invention. By means of extending the parameter in interaction criterion protocol, the transmitting signalling on A1p link between base station controller ( or goal base station controller) and mobile switch center (MSC) emulation entity can take 2833 encrpytion control information. The MSC emulation entity transmits the cryptographic key to media gateway(or goal media gateway), and the media gateway recover the cryptographic key. Then the base station controller ( or goal base station controller) and the media gateway(or goal media gateway) can encrypt/decode the 2833 information which is to be transmitted or has been transmitted by use of the same cryptographic key. By transmitting encrypted 2833 information between base station controller and media gateway, the security of transmitting 2833 information in A2p port can de improved, and accordingly service satisfaction level of operator will be increased.

Description

Mobile communication system and method and device for transmitting information therein The present application claims to be submitted to the Chinese Patent Office on November 1, 2005, the application number is 200510117145.0, and the invention name is "a method for implementing encrypted communication, Chinese patent application, Chinese patent application filed on November 29, 2005, China Patent Office, application number 200510101949, entitled "A method for encrypting and transmitting 2833 information in CDMA" and submitted to China on December 20, 2005 Patent Office, Application No. 200510135859.4, entitled "A Method for Implementing Encrypted Transmission of 2833 Information in CDMA", the entire contents of which are incorporated herein by reference.

The present invention relates to the field of mobile communications, and in particular to a mobile communication system and a method and apparatus for transmitting information therein.

Background technique

According to the division of the 3GPP2 (3GPP2, Third Generation Partnership Project 2) organization, the Code Division Multiple Access (CDMA) network evolved from the IS-95 system to the CDMA2000 series, after stage 0. Phase (Phase 1), Phase 1 (Phase 1), Phase 2 (Phase 2), and Phase 3 (Phase 3), the CDMA2000 All-IP (ALL-IP) network is finally implemented.

In Phase 2, the principle of independent separation of signaling and bearer, access network and core network has emerged. Phase 2 is further subdivided into Step 1 (STEP1), Step 2 (STEP2), and Step n (STEPn). Specifically, in step 2, the Mobile Switch Center/Visited Location Register (MSC/VL) of the second generation mobile communication (2G) network is split into a mobile switching center emulation entity (Mobile Switch) Center Emulation (MSCe), Media Gateway (MGW) and Media Resource Function Processor (MRFP), wherein the mobile switching center emulation entity has a similarity to the mobile switching center. Function, can also be called directly as a mobile switching center. Also added a home location register emulation (Home Location Register Emulation, HLRe) and other network elements, including 2G base station subsystem (BSS) and 3G base station subsystem (BSS/) access, and public switched telephone network (PSTN), The public land mobile network (PLMN) and the Internet Protocol (IP) network interoperate to provide support for traditional mobile station (MS) services.

As shown in FIG. 1, a schematic structural diagram of a CDMA access network is shown. The MS 110 generally consists of a baseband, an intermediate frequency, and a radio frequency. The baseband part is responsible for the forwarding control of the radio frequency signal and the baseband signal, the intermediate frequency is connected to the baseband part and the radio frequency part, and the radio frequency part is responsible for transmitting and receiving the wireless signal. The MS can be a terminal device such as a mobile phone, a PDA (Personal Digital Assistant).

The Base Station Controller (BSC) 120 is a part of the base station system. The BSC 120 mainly handles functions such as system information broadcasting, handover, cell resource allocation, and user control and other radio resource management.

The MGW 130 provides voice service and circuit domain related data service transmission and exchange functions, and implements a wireless access network circuit domain and a public circuit switched network (PSTN, ISDN), other mobile networks (GSM, CDMA, etc.), and a packet network. Business flow conversion. The MGW 130 provides packet switching functions, which can be upgraded to meet the development needs of wireless networks to all-IP networks.

The BSC 120 establishes an Alp link with the MSCe 140 through the Alp port, and the BSC 120 passes the signaling between the Al link 150 and the MSCe 140. The BSC 120 is connected to the MGW 130 via the A2p port via the IP network 160, and the A2p port is used to carry services. The MSCe 140 and the MGW 130 are in contact via an H248 link 170, which is a media gateway control protocol.

The CDMA system's receiving service (such as dialing the carrier service number and automatic voice prompt input language selection) uses Dual Tone Multi-Frequency (DTMF) to implement number transmission. In the framework of CDMA system call control and bearer separation, after implementing A-port IP, the BSC A2p port uses DTMF information transmission using IP or Real-Time Streaming Protocol (IP/TP) packets, and the transmission method follows the RFC2833 protocol. The transmitted DTMF information is generally referred to as 2833 information. In the RTP package, the 2833 information is transmitted in clear code, which is easy to be captured. The tool intercepts and parses out the actual DTMF information contained in it, which will result in the leakage of confidential information (such as bank account password).

As described above, in the IP-based A-port processing of the existing CDMA protocol standard, the A2P port bearer establishment must use the RFC2833 protocol for DTMF information transmission. For example, in FIG. 1, when the call is turned on, the user presses the button in the MS 110, and the dialed number is first transmitted to the BSC 120 through the outband signaling on the wireless side; the BSC 120 first converts the button information into DTMF information, and The DTMF information is transmitted to the MGW 130 through the IP/RTP packet at the A2p port of the BSC. This transmission method is the plain text standard 2833 mode. Because the A2p port is connected to the IP network, the packet is easily intercepted and illegally obtained from the DTMF information, resulting in the leakage of confidential information of the mobile user.

That is, in the prior art, DTMF signals and other network signaling and events can be transmitted in RTP packets. Among the above information transmitted, a considerable part of the information has higher security requirements. Such as: transaction data of the commercial sector such as banks, personal information of users, etc.

However, the prior art does not encrypt the transmitted information when transmitting the information, and the security of the communication is low. In this case, if the information is illegally acquired during transmission, the person who illegally obtains the information can directly read the content contained in the acquired information, which is likely to adversely affect the legitimate owner of the information, thereby reducing user satisfaction.

In fact, there are still many other types of communication protocols that cannot implement encrypted communication of information. The security of communication using these communication protocols is also low, which may adversely affect the legitimate owner of the information.

Summary of the invention

Embodiments of the present invention provide a mobile communication system and a method and apparatus for transmitting information therein, which can improve the security of DTMF information transmitted by an A2P port.

According to one aspect of the invention, a method of transmitting information in a mobile communication system includes:

The sender between the base station controller and the mobile switching center emulation entity generates 2833 encryption control information and transmits related signaling carrying the 2833 encryption control information; the 2833 encryption control information includes the A port key information and uses The name of the first encryption algorithm that encrypts the 2833 information; The receiver of the related signaling obtains an A-port shared key for encrypting the 2833 information corresponding to the A-port key information;

The mobile switching center emulation entity generates 2833 encrypted attribute information by using the A port shared key, and sends the 2833 encrypted attribute information to the media gateway; the 2833 encrypted attribute information includes the first encryption algorithm name and the H248 port key Information

The media gateway obtains an A-port shared key according to the H248 port key information; the sending end between the base station controller and the media gateway uses the A-port shared key and the first encryption algorithm to encrypt and transmit the 2833 information; The peer end of the sending end decrypts by using the A port shared key and the first encryption algorithm.

Optionally, the 2833 encryption control information is carried in the A2p bearer format feature parameter in the extended interoperability specification protocol related signaling, and the 2833 encrypted attribute information is carried in the extended H248 signaling.

According to another aspect of the present invention, a base station controller includes:

a signaling processing unit, configured to send to the mobile switching center emulation entity or receive relevant signaling that carries the 2833 encrypted control information from the mobile switching center emulation entity; the 2833 encrypted control information includes the A port key information and is used for The name of the first encryption algorithm that encrypts the 2833 information;

The information transmission unit is configured to implement 2833 information transmission with the media gateway, and process the 2833 information by using the A-port shared key corresponding to the A-port key information and the first encryption algorithm.

According to still another aspect of the present invention, a mobile switching center emulation entity includes: a signaling processing unit, configured to send or receive, from a base station controller, related signaling carrying 2833 encrypted control information; The 2833 encryption control information includes the A port key information and the first encryption algorithm name used to encrypt the 2833 information;

The encryption attribute information processing unit is configured to generate 2833 encrypted attribute information by using the A port shared key corresponding to the A port key information in the 2833 encryption control information, and send the 2833 encrypted attribute information to the media gateway; the 2833 encryption The attribute information includes the first encryption algorithm name and H248 port key information.

According to still another aspect of the present invention, a media gateway, comprising: An encryption attribute information processing unit, configured to obtain an A-port shared key and a first encryption algorithm according to the 2833 encrypted attribute information sent by the mobile switching center emulation entity;

The information transmission unit is configured to implement 2833 information transmission with the base station controller, and process the 2833 information by using the A-port shared key corresponding to the A-port key information and the first encryption algorithm.

According to another aspect of the present invention, a mobile communication system includes a base station controller, a mobile switching center emulation entity, and a media gateway;

The base station controller is configured to send or receive relevant signaling that carries the 2833 encryption control information to the mobile switching center emulation entity; the 2833 encryption control information includes the A port key information and is used for The 2833 information is encrypted by the first encryption algorithm name; and when the media gateway performs the 2833 information transmission, the first encryption algorithm and the A port shared key corresponding to the A port key information are used to process the 2833 information;

The mobile switching center emulation entity is configured to send or receive the relevant signaling carrying the 2833 encryption control information to the base station controller, and share the A port corresponding to the A port key information in the 2833 encryption control information. The key generation 2833 encrypts the attribute information, and sends the 2833 encrypted attribute information to the media gateway; the 2833 encrypted attribute information includes the first encryption algorithm name and the H248 port key information;

The media gateway is configured to obtain an A-port shared key according to the H248 port key information; and process the 2833 information by using the A-port shared key and the first encryption algorithm.

According to still another aspect of the present invention, a method for transmitting information in a mobile communication system includes: a medium having communication encryption capability at a first communication node and a second communication node, and an intersection of a first communication node and a second communication node The capability, the first and second communication nodes determine the same data encryption key;

The first and second communication nodes apply the media capability of the intersection and the determined data encryption key for encrypted communication.

Embodiments of the present invention are between a base station controller (or target base station controller) and a mobile switching center emulation entity, a mobile switching center emulation entity, and a media gateway (or during call setup, during a call, or after call handover) (or Key information transmission between the target media gateways, enabling the media gateway (or target media gateway) to obtain the base station controller (or the target base station controller) The same key. Then, the key is used to encrypt and transmit the 2833 information in the A2p port. It can guarantee the security of 2833 information transmission on the A2p port, thus protecting the interests of mobile users and improving the service satisfaction of operators.

In the embodiment of the present invention, the key information can be transmitted by extending the A2p bearer format feature parameter of the IOS protocol and extending the H248 protocol, which is relatively simple to implement.

Embodiments of the present invention determine, by the first communication node and the second communication node, media capabilities and encrypted communication capabilities for supporting encrypted communications; when both the first and second communication nodes have communication encryption capabilities and media capabilities with intersections And determining, by the first and second communication nodes, the same data encryption key, and applying the media capability and the determined data encryption key to perform encrypted communication. Therefore, even if the information transmitted between the first and second communication nodes is illegally obtained, the information obtained by the illegally obtained information cannot be correctly parsed or directly read out, and the legal owner of the information may be avoided. The adverse effects caused by the communication have improved the security of communication. DRAWINGS

1 is a schematic structural diagram of a CDMA access network in the prior art; FIG. 2 is a schematic structural diagram of a CDMA access network according to an embodiment of the present invention; FIG. 3 is a schematic diagram of the present invention when a CDMA call is established or called. A flowchart of a first embodiment for implementing encrypted transmission of 2833 information during the process;

4 is a flow chart of a second embodiment of the present invention for implementing encrypted transmission of 2833 information during a CDMA call setup or call; a flowchart of an embodiment;

Figure 6 is a block diagram of a first embodiment of the mobile communication system of the present invention;

Figure 7 is a block diagram of a second embodiment of the mobile communication system of the present invention;

Figure 8 is a flow chart of an embodiment of a method of transmitting information in a mobile communication system of the present invention. detailed description

The embodiment of the present invention implements encrypted transmission of 2833 information in the A2p port in CDMA, which can improve the security of the DTMF information transmitted by the A2p port. Embodiments of the present invention can be applied to a CDMA system as shown in FIG. 2.

The system includes a base station controller (BSC) 220, a media gateway (MGW) 230, and Mobile Switching Center Emulation Entity (MSCe) 240. Among them, the BSC 220 transmits signaling between the Alp link 250 and the MSCe 240. The BSC 220 is coupled to the MGW 230 via an IP network 260 via an A2p port. The MSCe 240 and the MGW 230 are in contact via the H248 link 270.

The BSC 220 is configured to send or receive information related to the 2833 encryption control information from the MSCe 240. The 2833 encryption control information includes the A port key information and the second information for encrypting the 2833 information. An encryption algorithm name; and when the 2834 information transmission is performed with the MGW 230, the A-port shared key pair 2833 information corresponding to the A-port key information is processed by the first encryption algorithm.

The MSCe 240 is configured to send or receive the relevant signaling that carries the 2833 encryption control information from the BSC 220, and generate the 2833 encryption by using the A-port shared key corresponding to the A-port key information in the 2833 encryption control information. Attribute information, and the 2833 encrypted attribute information is sent to the MGW 230; the 2833 encrypted attribute information includes the first encryption algorithm name and H248 port key information;

The MGW 230 is configured to obtain an A-port shared key according to the H248 port key information; and process the 2833 information by using the A-port shared key and the first encryption algorithm.

In the embodiment of the present invention, the parameters of the specific signaling in the Interoperability Specification (IOS) protocol are extended, so that the BSC (or the target BSC) is made at the time of call setup, during the call, and after the call is handed over. The signaling transmitted in the Alp link between the MSCe may carry 2833 encrypted control information (including at least a key used to encrypt the 2833 information); through the H248 link between the MSCe and the MGW (or the target MGW), Make the MGW (or target MGW) get the key. Then the BSC (or the target BSC) and the MGW (or the target MGW) can use the same key to encrypt and decrypt the 2833 information. Among them, the IOS protocol is a general term for defining the access side and the network side port in the CDMA system. In addition, the key can also be encrypted during the transmission of the key.

The specific steps of the first embodiment at the time of call establishment or during the call of the present invention will be described with reference to Fig. 3.

In step S30, it is required to expand parameters in the signaling in the IOS protocol (for example, A2p Bearer Format-Specific Parameters), and define extended information, indicating that the A2p port has encryption capability, and Specify the specific encryption algorithm type and Information such as the key used. For example, in one embodiment, the extension information includes the following: Extended ID: may be represented by 1-byte type information, for example, a value of 2, indicating

2833 encryption control information;

Extended length: can be expressed by 1 byte length information, including 1 byte flag bit and indefinite length byte (such as up to 8 bytes) key letter;

Specific extended parameters: can be expressed in 1-byte length information.

In the specific extended parameter, 1-bit information is used to indicate whether to use the 2833 encryption indication. When the value of the bit is "0", it means that the current call does not use 2833 encryption. When the value of the bit is "1", it means The second call uses 2833 encryption;

The type of the encryption algorithm is represented by 3-bit information, and the encryption algorithm must be a symmetric algorithm. For example, in one embodiment of the present invention, when the value of the 3 bits is "000", it means

RC4 encryption algorithm, other values are temporarily reserved;

Additional 4-bit information: Temporarily reserved;

In addition, 4 ~ 8 bytes of information is used to indicate the A port key information (A-SHARE-DATA), which is the encrypted current call 2833 shared key (CALL-KEY), and the length is related to the algorithm.

The foregoing is only an example of an extended A2p bearer format feature parameter in an embodiment of the present invention. The present invention is not limited thereto, and those skilled in the art may derive more extended methods from the present invention, for example, Other parameters in the IOS signaling are extended.

The first embodiment of the present invention also extends the H248 protocol to define a 2833 encryption attribute of the Session Description Protocol (SDP) format, so that the H428 link side of the MSCe and the MGW has the received BSC key encrypted. Ability. In this embodiment, the 2833 force. The format of the secret attribute can be "a = encrypt_params: force. The secret algorithm name is encrypted key (H248-SHARE-DATA)". The format consists of three parts. For example, for the RC4 algorithm, its 2833 encryption attribute might appear as "a = encrypt_params: rc4 a6Z*oplK" , where "a6Z*oplK" is the encrypted 32-bit key. Of course, in different embodiments, the keys can be different.

On this basis, the call process can be extended.

In step S31, an A port control key (A1P-KEY) is preset between the BSC and the MSCe; and an H248 port control key is preset between the MGW and the MSCe. (1-1248-KEY).

In step S32, the relevant signaling carrying the 2833 encryption control information is transmitted between the BSC and the MSCe during call setup or during the call. In the embodiment of the present invention, the A2p bearer format feature parameter in the related signaling carries 2833 encryption control information, indicating that the call needs to be encrypted 2833. The signaling may include: a CM Service Request message, a Paging Response message or a Bearer Update Response message, an assignment completion message, and a Additional Service Request message. Or switch the Handoff Request Acknowledge message. The exchange process between the BSC and the MSCe of the above messages is the same as the normal bearer information exchange process defined by the protocol. The 2833 encryption control information includes information such as A-port key information (A-SHARE-DATA), an encryption algorithm used (hereinafter referred to as a second encryption algorithm), and the second encryption algorithm is a symmetric algorithm (eg, RC4 algorithm), the A port key information (A-SHARE-DATA) is used by the A port shared key (CALL-KEY) and the A port control key (A1P-KEY) to utilize the second The encryption algorithm is encrypted, and the A-port shared key (CALL-KEY) is different in each call, for example, it can be randomly generated.

In this embodiment, there are two cases in which the relevant signaling carrying the 2833 encryption control information is transmitted between the BSC and the MSCe. One is that the BSC is used as the key distribution entity, that is, the BSC sends the 2833 encryption control to the MSCe. Signaling of information, wherein the A-port shared key (CALL-KEY) is generated by the BSC; the other is used by the MSCe as a key distribution entity, that is, the MSCe sends a message carrying the 2833 encryption control information to the BSC. The A-port shared key (CALL-KEY) is generated by the MSCe.

In step S33, after receiving the 2833 encryption control information, the signaling receiving end (MSCe or BSC) passes the pre-configured A port control key (A1P-KEY) and the 2833 encryption control information A port key. The information (A-SHARE-DATA) is calculated by the second encryption algorithm (decryption process), and the A-port shared key (CALL-KEY) is obtained.

In step S34, the MSCe uses the H248 port control key (H248-EY) to encrypt the generated or decrypted A-port shared key (CALL-KEY) with a third encryption algorithm to generate H248 port key information ( H248-SHARE- DATA ).

In step S35, when the MSCe performs bearer establishment or bearer attribute modification, in the H248 The bearer setup request message or the bearer attribute modification request message sends 2833 encrypted attribute information (the format may be "a = encrypt jparams: encryption algorithm name H248-SHARE-DATA") to the MGW, where the encryption algorithm name is the third The name of the encryption algorithm.

In step S36, after receiving the 2833 encrypted attribute information, the MGW adopts an H248 port control key (H248-KEY), and performs H248 port key information (H248-SHARE-DATA) in the received 2833 encrypted attribute information. The decryption calculation (using the third encryption algorithm) obtains the A-port shared key (CALL-KEY). In this way, the MGW obtains the same A-port shared key (CALL-KEY) as in the BSC.

In the next step S37, the BSC and the MGW can use the same A-port shared key (CALL-KEY) to perform encryption and decryption of the 2833 information.

For example, when the call is connected, the user presses the button in the MS, and the dialed number is first transmitted to the BSC through the outband signaling on the wireless side; the BSC first converts the button information into DTMF information, and uses the A port to share the key (CALL -KEY) Encrypt the DTMF information, and send the encrypted DTMF information to the MGW in the 2833 mode through the IP/RTP packet at the A2p port. After receiving the encrypted DTMF information, the MGW decrypts the obtained A-port shared key and obtains the decrypted DTMF information. Similarly, the MGW can also transmit it to the BSC's bearer service for encryption and decrypt it at the BSC end. Wherein, the first encryption algorithm can be used for adding/decrypting the 2833 information.

The foregoing first encryption algorithm, the second encryption algorithm, and the third encryption algorithm may be the same encryption algorithm, or may be different encryption algorithms. In the implementation application, the flexible selection may be performed according to requirements. When different encryption algorithms are selected, an algorithm name indication can be added to the extended parameters, which will be used to encrypt the key and force the 2833 information. If the secret algorithm name is transmitted at the same time, the three encryption algorithms can be completely different. In the above example, the 2833 encryption control information transmitted between the BSC and the MSCe carries the identifier for encrypting the A-port shared key. a second encryption algorithm name and a first encryption algorithm name for encrypting the 2833 information; and the 2833 encryption attribute information transmitted between the MSCe and the MGW carries the first element for encrypting the shared key of the A port The third encryption algorithm name and the first encryption algorithm name used to encrypt the 2833 information. In this way, after receiving the 2833 encryption attribute information, the MGW may recover the A-port shared key by using a third encryption algorithm, and adopt the first encryption calculation. The law encrypts and decrypts the 2833 information.

In Fig. 4, a second embodiment of the present invention is shown. Generally, in a real-world networking, the network used for signaling (such as the Alp signaling and H248 signaling link described above) is more strict and more secure than the transport network carrying the information, so in Figure 4 When the Alp interface and the I-I248 interface exchange keys (that is, the A-port shared key), the key does not need to be encrypted and transmitted, and the plaintext transmission can be performed, and the application can be satisfied in many environments. The specific steps are as follows: In step S40, the parameters in the signaling in the IOS protocol need to be extended. For the expansion method, refer to the description of the first embodiment of the present invention. In the extended parameter, only the portable parameter is used. The name of the algorithm for encrypting the 2833 information and the key used, without carrying the algorithm name for encrypting the key.

Extend the H248 to define the 2833 encryption attribute in the Session Description Protocol (SDP) format. The format of the 2833 encryption attribute can be "a = encryptjparams: encryption algorithm name key", which consists of three parts. For example, for the RC4 algorithm, its 2833 force. The secret attribute may appear as "a = encrypt_params: rc4 a6Z*oplK" , where "a6Z*oplK" is the encrypted 32-bit key.

In step S41, during the call setup or during the call, the BSC and the MSCe transmit the relevant signaling carrying the 2833 encryption control information; for example, the corresponding parameters in the relevant signaling (such as the A2p bearer format feature parameter) are carried in the relevant signaling. 2833 Encryption control information, indicating that the call requires 2833 encryption. The 2833 encryption control information includes an A-port shared key (CALL-KEY), an encryption algorithm (first encryption algorithm) used for encrypting the 2833 information, and the A-port shared key (CALL-KEY). ) is different in every call, for example, it can be generated randomly.

In this embodiment, there are two cases in which the relevant signaling carrying the 2833 encryption control information is transmitted between the BSC and the MSCe. One is that the BSC is used as the key distribution entity, that is, the BSC sends the 2833 encryption control to the MSCe. Signaling of information, wherein the A-port shared key (CALL-KEY) is generated by the BSC; the other is used by the MSCe as a key distribution entity, that is, the MSCe sends a message carrying the 2833 encryption control information to the BSC. In the order, the A-port shared key (CALL-KEY) is generated by the MSCe.

In step S42, the recipient of the signaling (such as MSCe or BSC) receives the above After the 2833 encryption control information, the A-port shared key (CALL-KEY) and the first encryption algorithm name information are extracted. And generating, by the MSCe end, a 2833 encryption attribute information (the format is "a = encrypt_params: encryption algorithm name key" by using the A-port shared key (CALL-KEY) generated or obtained, wherein the encryption algorithm name is An encryption algorithm name, the key is the A-port shared key (CALL-KEY).

In step S43, the MSCe performs the bearer establishment or bearer attribute modification, and the 2833 encrypted attribute information (the format may be "a = encrypt__params: encryption algorithm name H248-" in the H248 bearer setup request message or the bearer attribute modification request message. SHARE-DATA" ) is sent to the MGW.

In step S44, after receiving the 2833 encrypted attribute information, the MGW obtains an A-port shared key (CALL-KEY) and a first encryption algorithm name. The BSC and the MGW can use the same A-port shared key (CALL-KEY) to encrypt and decrypt the transmitted or received 2833 information by using the first encryption algorithm.

In an embodiment of the invention, after the call is established, it may be decided to use the new A-port shared key. Its key transfer process is similar to the two embodiments described above. Briefly described as follows, a message carrying A-port key information (for example, a bearer update response message) is transmitted between the BSC and the MSCe; and a new A-port shared key in the A-port key information is decrypted at the MSCe or BSC end. The MSCe sends a 2833 encrypted attribute message containing the shared key of the A port to the MGW in the bearer modification message, where the shared key of the A port can be encrypted; then the MGW obtains (may need to decrypt) the new A port. The shared key; At this point, both the BSC and the MGW obtain the same new A-port shared key, and the new A-port shared key can be used to encrypt and decrypt the 2833 information to be transmitted or received.

As shown in Figure 5, a flow diagram of an embodiment of the present invention for exchanging keys after switching is shown. In the case where the call is established and a hard handoff occurs, it is necessary to enable the target BSC and the target MSCe to obtain the same encryption key.

In step S51, an A-port control key is configured between the target BSC and the serving MSCe, and the A-port control key may be the same as or different from the A-port control key before the handover; H248 port control is configured between the target MGW and the serving MSCe. Key, the H248 port control key can be the same as or different from the H248 port control key before the switch. In step S52, related signaling carrying 2833 encryption control information is transmitted between the target BSC and the serving MSCe. In the present invention, 2833 encryption control information is carried in the A2p bearer format feature parameter in the related signaling. The signaling may include: a Paging Request, an Assignment Request, a Service Notification, a Bearer Update Required message, and a Bearer Update Required message. The bearer update response message or the handoff request message is carried out. The exchange process between the BSC and the MSCe is the same as the normal bearer information exchange process defined by the protocol, where the 2833 encryption control information is included. There is information such as A port key information, an encryption algorithm used (hereinafter referred to as a second encryption algorithm), and the second encryption algorithm is a symmetric algorithm (such as RC4 algorithm), and the A port key information is The A-port shared key and the A-port control key are encrypted by using the second encryption algorithm, and the A-port shared key may be the same as or different from the A-port shared key used before the handover.

In this embodiment, there are two cases in which the relevant signaling carrying the 2833 encryption control information is transmitted between the target BSC and the serving MSCe. One is that the target BSC is used as the key distribution entity, that is, the target BSC sends the information to the serving MSCe. The signaling carries the 2833 encryption control information, where the A-port shared key is generated by the target BSC; the other is used by the serving MSCe as a key distribution entity, that is, the serving MSCe sends the 2833 encryption to the target BSC. Controlling signaling of the information, wherein the A-port shared key is generated by the serving MSCe.

In step S53, after receiving the 2833 encryption control information, the signaling receiving end (the serving MSCe or the target BSC) uses the pre-configured A port control key and the A port key information in the 2833 encryption control information. The second encryption algorithm performs a calculation (decryption process) to obtain an A-port shared key.

In step S54, the serving MSCe encrypts the generated or decrypted A-port shared key with the H248 interface control key by using a third encryption algorithm to generate H248 port key information.

In step S55, when the bearer establishment or bearer attribute modification is performed, the serving MSCe encrypts the attribute information in the H248 bearer attribute modification request message (the format may be "a = encrypt_params: encryption algorithm name H248 port control key") Sent to the target MGW, where the encryption algorithm name is the name of the third encryption algorithm. In step S56, after receiving the 2833 encrypted attribute information, the target MGW uses the H248 port control key to perform decryption calculation with the H248 port key information in the received 2833 encrypted attribute information (using the third encryption algorithm). , get the A port shared key. In this way, the target MGW obtains the same A-port shared key as in the target BSC.

In the next step S57, the target BSC; the target MGW can use the same key to perform encryption and decryption processing on the 2833 information to be transmitted or received.

Also, in this embodiment, when a key (ie, A-port shared key) exchange is performed between the serving MSCe and the target BSC, between the serving MSCe and the target MGW, there is no need to encrypt the key (for example, in plaintext) Form transfer). This process is similar to the embodiment shown in Figure 4 and will not be described in detail herein.

The embodiment of the present invention implements encrypted transmission of 2833 information in CDMA, and extends the A2p bearer format characteristic parameter of the IOS protocol and the extended H248 protocol by establishing a call, during a call, or after a call handover. And the key information exchange between the BSC (or the target BSC) and the MSCe, between the MSCe and the MGW (or the target MGW), so that the MGW (or the target MGW) end obtains the same key as the BSC (or the target BSC) end. . Then, the key is used to encrypt and transmit the 2833 information in the A2p port. It can guarantee the security of DTMF information transmission on the A2p port, thus protecting the interests of mobile users and improving the service satisfaction of operators.

Referring to FIG. 6, an embodiment of the mobile communication system of the present invention includes a base station controller (BSC) 220, a media gateway (MGW) 230, and a mobile switching center emulation entity (MSCe) 240.

The BSC 220 includes:

The signaling processing unit 610 is configured to send, to the MSCe 240, related signaling that carries the 2833 encryption control information, where the 2833 encryption control information includes the A-port key information and the first encryption algorithm used to encrypt the 2833 information. Name

The information transmission unit 620 is configured to implement 2833 information transmission with the MGW 230, and process the 2833 information by using the A-port shared key corresponding to the A-port key information and the first encryption algorithm.

The MSCe 240 includes:

The signaling processing unit 630 is configured to receive, from the BSC 220, the 2833 encrypted control information. Corresponding signaling; the 2833 encryption control information includes A-port key information and a first encryption algorithm name used to encrypt 2833 information;

The encryption attribute information processing unit 640 is configured to generate 2833 encrypted attribute information by using the A port shared key corresponding to the A port key information in the 2833 encryption control information, and send the 2833 encrypted attribute information to the MGW 230; The encrypted attribute information includes the first encryption algorithm name and H248 port key information.

The MGW 230 includes:

The encryption attribute information processing unit 650 is configured to: obtain an A-port shared key and a first encryption algorithm according to the 2833 encryption attribute information sent by the MSCe 240;

The information transmission unit 660 is configured to implement 2833 information transmission with the BSC 220, and process the 2833 information by using the A-port shared key corresponding to the A-port key information and the first encryption algorithm.

In an embodiment, the signaling processing unit 610 includes: an A-port key information generating unit 611, configured to encrypt the A-port shared key and a pre-configured A-port control key by using a second encryption algorithm. The A-port key information; the encryption control information filling unit 612 is configured to carry the A-port key information, the first encryption algorithm name, and the second encryption algorithm name in the 2833 encryption control information; the signaling sending unit 613 And for transmitting related signaling carrying the 2833 encryption control information.

The encryption control information filling unit 612 may be an A2p bearer format feature parameter expansion unit, configured to fill the A-port key information, the first encryption algorithm name, and the second encryption algorithm name into the A2p bearer format feature parameter.

In this case, the signaling processing unit 630 of the MSCe 240 includes: a signaling receiving unit 631, configured to receive related signaling that carries the 2833 encrypted control information; and the 2833 encrypted control information includes an A port. The key information and the first encryption algorithm name used to encrypt the 2833 information; the information obtaining unit 632 is configured to obtain the A port key information and the second encryption algorithm from the 2833 encryption control information; The obtaining unit 633 is configured to decrypt the A port key information by using the second encryption algorithm to obtain an A port shared key.

In an embodiment, the encryption attribute information processing unit 640 of the MSCe 240 includes: an H248 port key information generating unit 641, configured to use the A port shared key and the pre-configured The H248 port control key is encrypted by the third encryption algorithm to generate the H248 port key information. The encrypted attribute information filling unit 642 is configured to carry the H248 port key information, the first encryption algorithm name, and the pre-invention in the 2833 encryption attribute information. The configured third encryption algorithm name; the encryption attribute information sending unit 643 is configured to send the 2833 encrypted attribute information to the media gateway when performing bearer establishment or bearer attribute modification.

The ciphering attribute information filling unit 642 is an H248 signaling filling unit, and is configured to carry the 2833 ciphering attribute information in the extended H248 signaling.

In this case, the encryption attribute information processing unit 650 of the MGW 230 includes: an information obtaining unit 651, configured to obtain H248 port key information and a third encryption algorithm from the 2833 encrypted attribute information; H248 port key information The processing unit 652 is configured to use a pre-configured H248 port control key, perform decryption calculation on the H248 port key information by using a third encryption algorithm, obtain an A port shared key, and obtain the first key from the H248 port key information. An encryption algorithm name.

Referring to FIG. 7, another embodiment of the mobile communication system of the present invention includes a base station controller (BSC) 220, a media gateway (MGW) 230, and a mobile switching center emulation entity (MSCe) 240.

This embodiment is substantially the same as the embodiment shown in FIG. 6, except that in this embodiment, the MSCe 240 transmits the relevant signaling carrying the 2833 encryption control information to the BSC 220.

The MSCe 240 includes:

The signaling processing unit 630 is configured to send, to the BSC 220, related signaling that carries the 2833 encryption control information, where the 2833 encryption control information includes the A-port key information and the first encryption algorithm used to encrypt the 2833 information. Name

The BSC 220 includes:

The signaling processing unit 610 is configured to receive, from the MSCe 240, related signaling that carries the 2833 encryption control information, where the 2833 encryption control information includes the A-port key information and the first encryption algorithm used to encrypt the 2833 information. name; The information transmission unit 620 is configured to implement 2833 information transmission with the MGW 230, and process the 2833 information by using the A-port shared key corresponding to the A-port key information and the first encryption algorithm.

In an embodiment, the signaling processing unit 630 of the MSCe 240 includes: an A-port key information generating unit 631, configured to use the second encryption by using the A-port shared key and the pre-configured A-port control key. The algorithm encrypts the A-port key information, and the encryption control information filling unit 632 is configured to carry the A-port key information, the first encryption algorithm name, and the second encryption algorithm name in the 2833 encryption control information. The signaling sending unit 633 is configured to send related signaling that carries the 2833 encrypted control information.

The encryption control information filling unit 632 may be an A2p bearer format feature parameter extension unit, configured to fill the A-port key information, the first encryption algorithm name, and the second encryption algorithm name into the A2p bearer format feature parameter.

In this case, the signaling processing unit 610 of the BSC 220 includes: a signaling receiving unit 611, configured to receive related signaling carrying the 2833 encrypted control information; and the 2833 encrypted control information includes an A port. The key information and the first encryption algorithm name used to encrypt the 2833 information; the information obtaining unit 612 is configured to obtain the A port key information and the second encryption algorithm from the 2833 encryption control information; The obtaining unit 613 is configured to decrypt the A port key information by using the second encryption algorithm to obtain an A port shared key.

In the above embodiment, the transmission and exchange of the shared key between the two parties are completed by a third party. Those skilled in the art understand that the data encryption key can also be determined by negotiation between the communicating parties.

Referring to FIG. 8, in the present invention, the process of determining an embodiment of a data encryption key by negotiation between two communicating parties includes:

Step 101: The same public key and encryption policy are preset in the calling communication node (the first communication node) and the called communication node (the second communication node). The calling communication node sends a call setup request to the called communication node, which can be implemented by the Setup message of the Q931 protocol.

Step 102: After receiving the call setup request from the calling communication node, the called communication node sends a call processing response to the calling communication node to notify the calling communication node that the call is being processed. The call processing response can be implemented by a Call Proceedin message of the Q931 protocol.

Step 103: The called communication node sends a ringing message to the calling communication node to notify the calling communication node that the called communication node is ringing. The ringing message can be implemented by an alerting message of the Q931 protocol.

Step 104: When the called communication node accepts the call from the calling communication node by off-hook or the like, the called communication node sends a call response response to the calling communication node.

Step 105: A connection establishment process is performed between the primary and the called communication nodes to establish a communication connection for supporting communication between the primary and the called communication nodes.

The specific connection establishment process generally includes: the called communication node sends a connection establishment request including at least the called communication node communication identifier to the calling communication node; and the calling communication node receives the connection establishment request from the called communication node, determines and The communication node corresponding to the communication identifier included in the connection establishment request communicates, and sends a connection establishment response including the communication identifier of the calling communication node to the called communication node; the called communication node receives the connection establishment response from the calling communication node After that, it is determined that the communication node corresponding to the communication identifier included in the connection establishment response communicates. Certainly, if the call setup request in step 101 carries the caller communication node communication identifier, the called communication node determines to communicate with the communication node corresponding to the communication identifier after receiving the communication identifier, and the calling communication node does not need to The communication identifier is carried in the connection establishment response.

The above connection establishment process can be implemented by the Connect message of the Q931 protocol or by the H245 protocol. If implemented by the H245 protocol, the communication identifier includes an H245 Internet Protocol (IP) address and a listening port number supported by the H245 protocol.

Step 106: When the calling communication node has communication encryption capability, the calling communication node initiates a communication encryption capability negotiation process with the called communication node. The operation included in the negotiation process is mainly as follows: The calling communication node sends a communication encryption capability negotiation request to the called communication node, where the communication encryption capability negotiation request includes at least the media capability information and the communication encryption capability information of the calling communication node. The media capability information represents a media capability of the calling communication node. Specifically, the media capability information represents a media encoding and decoding capability of the calling communication node when performing data communication; the communication encryption capability information represents a calling communication. The node has encrypted communication capabilities. The communication encryption capability information may be represented by an extended field.

After the called communication node receives the communication encryption capability negotiation request from the calling communication node, it is judged Whether the communication encryption capability and the media capability of the intersection with the calling communication node are present, if the called communication node sends a communication encryption capability negotiation response to the calling communication node, the communication encryption capability negotiation response may carry the called party The media capability information and the communication encryption capability information of the communication node; otherwise, the called communication node sends a negotiation failure message to the calling communication node, and the calling communication node stops performing subsequent encrypted communication with the called communication node after receiving the negotiation failure message. Operation. The communication encryption capability and the respective media capabilities are usually preset in the primary and called communication nodes.

The process shown in Figure 8 is based on the success of communication encryption capability negotiation.

There are various methods for the called communication node to determine whether it has communication encryption capability, such as: adding encryption enablement in the communication configuration parameter of the called communication node, and the encryption setting is enabled by the operator in advance. Or prohibited. Then, when the called communication node queries its own communication configuration parameters, if it is known that the encryption enable is currently enabled, the called communication node determines that it has communication encryption capability; otherwise, the called communication node determines that it does not have communication encryption capability. .

If the main operation of the communication encryption capability negotiation process is embodied, the communication encryption capability negotiation process initiated by the calling communication node and the called communication node may be various. The first communication encryption capability negotiation process is:

The calling communication node sends a communication encryption capability negotiation request including the media capability information and the communication encryption capability information to the called communication node, and the communication encryption capability information is represented by a public key, that is, the communication encryption capability negotiation request includes The public key represents the communication encryption capability of the calling communication node. After receiving the communication encryption capability negotiation request from the calling communication node, the called communication node obtains the media capability that it has by using the existing technology, and compares the acquired media capability with the media capability information included in the communication encryption capability negotiation request. Whether there is an intersection of the represented media capabilities. If there is an intersection, the called communication node determines that it has the media capability of the intersection with the calling communication node; otherwise, the called communication node determines that it does not have the media that intersects with the calling communication node. ability.

The called communication node further determines whether it has communication encryption capability, and if so, the called communication node applies the encryption policy preset in advance to encrypt the public key included in the communication encryption capability negotiation request, and uses the encryption result as The called side data encryption key when subsequently communicating with the calling communication node. After that, the called communication node sends a communication encryption to the calling communication node. The capability negotiation response notifies the calling communication node that the called communication node has the communication encryption capability and the media capability that intersects with the calling communication node; the calling communication node receives the communication encryption capability negotiation response from the called communication node, and determines that Performing encrypted communication with the calling communication node, and encrypting the public key by applying the encryption policy set in advance, and using the encryption result as a calling side data encryption key when communicating with the called communication node.

Of course, the master and the called communication node may also encrypt the public key without applying the encryption policy, and directly use the public key as the primary and called side data encryption keys for subsequent communication.

In an actual application, the communication encryption capability negotiation response may carry the called side data encryption key, and the calling communication node applies the encryption policy to the called party included in the received communication encryption capability negotiation response. The side data encryption key is decrypted, and it is judged whether the result of the decryption is the same as the public key. If the same, the calling communication node sends an acknowledgement message to the called communication node; otherwise, the calling communication node sends the called communication node to the called communication node. Negotiation failure message.

Certainly, after receiving the communication encryption capability negotiation response, the calling communication node may not directly perform the decryption operation, but directly determine whether the called side data encryption key included in the received response is related to the generated master. The calling side data encryption key is the same. If the same, the calling communication node sends an acknowledgement message to the called communication node; otherwise, the calling communication node sends a negotiation failure message to the called communication node.

The communication encryption capability negotiation response may further carry media capability information corresponding to the media capability of the called communication node that has an intersection with the calling communication node.

The second communication encryption capability negotiation process is: the calling communication node sends a communication encryption capability negotiation request including the media capability information and the communication encryption capability information to the called communication node, and the communication encryption capability information is randomly generated by the calling communication node. The random number representation, that is, the random number included in the communication encryption capability negotiation request represents that the calling communication node has communication encryption capability. The called communication node determines whether it has the media capability of the intersection with the calling communication node, and the specific determination method is the same as the corresponding determination method in the negotiation process of the first communication encryption capability.

The called communication node also determines whether it has communication encryption capability, generates a called side data encryption key after determining that it has communication encryption capability, and performs subsequent transmission to the calling communication node. The communication encryption capability negotiation response and the like, the specific operation method is substantially the same as the corresponding method in the first communication encryption capability negotiation process, except that the performed operation is no longer directed to the public key but to the random number.

The advantage of applying random numbers for encrypted communication is that: when a new communication such as a new session is performed between the primary and the called communication nodes, a new random number can be randomly generated, and the random encryption number is used to generate the data encryption key. . It can be seen that each time the primary and the called communication node perform a new communication, the generated data encryption key is different from the previous one. The flexibility of the data encryption key generation makes the illegal acquisition of the information even in one communication. Deciphering the data encryption key, and the same method can not be used to decipher the data encryption key used in each communication, which can further improve communication security.

Of course, the calling communication node may use the random number as the calling side data encryption key when communicating with the called communication node, and encrypt the random number by using the set public key and encryption policy, and encrypt the random number. As a result, the communication encryption capability information is carried in the communication encryption capability negotiation request and sent to the called communication node. After the called communication node receives the communication encryption capability negotiation request and determines that it has the encryption capability, the public key and the encryption policy set by the application decrypt the communication encryption capability information included in the received communication encryption capability negotiation request, and The decrypted result is used as a called side data encryption key when subsequently communicating with the calling communication node. It can be seen that the called side data encryption key is the same as the random number sent by the calling communication node.

The third communication encryption capability negotiation process is: the calling communication node sends a pre-negotiation request including the media capability information and the communication encryption capability information to the called communication node, and the communication encryption capability information is represented by a communication encryption capability flag, the communication The cryptographic capability flag is used to notify the called communication node that the calling communication node has communication encryption capability. For example, when the communication encryption capability sent by the calling communication node is marked as 1, it indicates that the calling communication node has communication encryption capability.

After the called communication node receives the pre-negotiation request from the calling communication node, it determines whether it has the media capability of the intersection with the calling communication node, and the specific determining method and the corresponding determining method in the negotiation process of the first communication encryption capability The same is true, the difference is that the current determination method is for pre-negotiation requests. The called communication node also determines whether it has communication encryption capability and sends a pre-negotiation response to the calling communication node after determining that it has communication encryption capability. After the calling communication node receives the pre-negotiation response from the called communication node, the called communication section The point performs substantially the same operation as the second or third communication encryption capability negotiation process. Of course, since the called communication node has determined whether it has the media capability and the communication encryption capability, the called communication node does not need to perform the second and third communication encryption capability negotiation processes to determine the media capability and communication encryption. Ability to operate.

Step 107: When the called communication node has communication encryption capability, the called communication node initiates a communication encryption capability negotiation process with the calling communication node, and the operation included in the communication encryption capability negotiation process is substantially the same as the operation in step 106. The difference is that step 107 has an interchange of the operating body with respect to step 106. Certainly, the communication encryption capability information corresponding to the communication encryption capability set in the called communication node represents that the called communication node has an encrypted communication capability; the media capability information corresponding to the media capability set in the called communication node represents the called communication node. The media capability information, in particular, the media capability information represents the media encoding and decoding capability of the called communication node when performing data communication. ,

Step 107 and step 106 do not have a strict chronological relationship.

In practical applications, only one of step 107 or step 106 may be performed, which does not affect subsequent data encryption communication.

Step 108: Applying the prior art to establish a media channel between the primary and the called communication node, the specific media channel establishment process is generally as follows: The primary/called communication node sends at least the primary/called communication to the called/calling communication node. a media channel setup request for the node IP address and the communication port number; the called/calling communication node receives the media channel setup request from the primary/called called communication node, and after receiving the request, sends the at least one included to the primary/called called communication node / The media channel of the calling communication node IP address and the communication port number establishes a response. In this way, the calling and called communication nodes acquire the address information used by the other party for data communication, and can perform subsequent data communication based on the address information.

Of course, if the media channel establishment request is rejected by the calling/calling communication node, a channel establishment rejection message is sent to the master/called communication node, and the channel establishment rejection message may also carry a rejection reason.

Step 109: The media channel established by the application between the primary and the called communication node performs an encrypted data communication process. The specific operation is:

The master/called communication node applies the master/called side data encryption key and the encryption policy pair The data sent to the called/calling communication node is encrypted, and the encrypted encrypted data is transmitted to the called/calling communication node; the called/calling communication node applies the called/calling side data encryption key and the The encryption policy decrypts the encrypted data from the master/called communication node and applies subsequent techniques to perform subsequent processing based on the decrypted data.

Steps 101 through 105 may be implemented by a communication protocol such as Q931, and may further include other signaling interactions.

Steps 106 to 109 are generally implemented by the H245 protocol, and the communication encryption capability negotiation request may be implemented by a Terminal Capability Set (TSS), and the communication encryption capability negotiation response may be confirmed by a terminal capability request (Terminal Capability). Set Ack, TCS Ack) implementation, the media channel setup request may be implemented by an Open Logic Channel message, and the media channel setup response may be implemented by an Open Logic Channel Ack, the channel The establishment of a reject message can be implemented by an Open Logic Channel Reject message.

Of course, step 106 to step 109 may further include other signaling interactions, and may also be implemented by other communication protocols; and step 106 and step 107 may also be implemented by a Session Description Protocol (SDP).

Step 106 and/or step 107 can be performed at any time prior to step 109.

The media capability information may be any communication protocol name supported by the primary or called communication node to ensure that the recipient knows which communication protocol the sender supports. Such as: G.711, G.723, H.263, RFC 2833, etc. In this way, the calling communication node can transmit the name of the communication protocol supported by itself as the media capability information to the called communication node; the called communication node obtains the communication protocol supported by itself, and compares the name and the received communication protocol. Whether there is an intersection of the communication protocol names, if there is an intersection, the called communication node determines that it has the media capability of the intersection with the calling communication node. Regardless of what content of the media capability information is represented, in order to ensure that the primary and the called communication node can communicate normally, both the primary and the called communication node apply the media capability communication in which the intersection exists.

The primary and called communication nodes may be communication terminals, gateways or media controller units (MCUs), and the like.

The encryption policy may be a commonly used XOR algorithm, a negation algorithm, an MD5 algorithm, and the like. The flow shown in FIG. 8 can be implemented by a communication protocol such as Session Initiation Protocol (SIP), H323 protocol, etc. The encrypted communication in step 109 is usually encrypted for the RFC 2833 protocol data packet. When the process shown in FIG. 8 is implemented by SIP, step 107 may not be performed, and the key operations in step 106 are split into steps 101 and 104, respectively. The specific splitting manner is: performing the operation of sending the communication encryption capability negotiation request by the calling communication node to the called communication node in step 106 to step 101; sending the called communication node to the calling communication node to encrypt the communication in step 106; The operation of the capability negotiation response is performed in step 104.

In summary, the embodiment of the present invention simulates an entity between a base station controller (or a target base station controller) and a mobile switching center emulation entity, a mobile switching center emulation entity, during a call setup, during a call, or after a call handover. The key information is transmitted between the media gateway (or the target media gateway) and the media gateway (or target media gateway) to obtain the same key as the base station controller (or the target base station controller). Then use the key to encrypt and transmit the 2833 information in the A2p port. It can guarantee the security of 2833 information transmission on the A2p port, thus protecting the interests of mobile users and improving the service satisfaction of operators.

In the embodiment of the present invention, the key information can be transmitted by extending the A2p bearer format feature parameter of the IOS protocol and the extended H248 protocol, and the implementation thereof is relatively simple.

In summary, the method for implementing encrypted communication provided by the embodiment of the present invention, the first communication node sends its own media capability information and communication encryption capability information to the second communication node; the media capability information represents the communication node. Having a media capability, the communication encryption capability information represents that the communication node has an encrypted communication capability; and the second communication node determines, according to the media capability information and the communication encryption capability information from the first communication node, whether it has communication encryption capability and the first The communication node has an intersecting media capability, if so, the first and second communication nodes determine the same data encryption key and apply the media capability and the determined data encryption key for encrypted communication. The first communication node may be a calling communication node, and the second communication node may be a called communication node. Therefore, even if the information transmitted between the first and second communication nodes is illegally obtained, the information obtained by the illegally obtained information cannot be correctly parsed or directly read out, and the legal owner of the information may be avoided. The adverse effects caused by the communication have improved the security of communication.

Claims

Rights request

A method for transmitting information in a mobile communication system, comprising: a sender between a base station controller and a mobile switching center emulation entity generating 2833 encrypted control information and transmitting the 2833 encrypted control information Corresponding signaling; the 2833 encryption control information includes A-port key information and a first encryption algorithm name used to encrypt 2833 information;

The receiver of the related signaling obtains an A-port shared key corresponding to the A-port key information for encrypting the 2833 information;

The media gateway obtains an A-port shared key according to the H248 port key information;

The transmitting end between the base station controller and the media gateway uses the shared key of the A port and the first encryption algorithm to encrypt and transmit the 2833 information; the peer end of the sending end uses the shared key of the A port and the first encryption The algorithm decrypts.

The method according to claim 1, wherein the 2833 encryption control information is carried in an A2p bearer format feature parameter in the extended interoperability specification protocol related signaling, and the 2833 encrypted attribute information bearer In the extended H248 signaling.

The method according to claim 1, wherein the A port key information and the H248 port key information are all the A port shared key.

4. The method of claim 1 wherein:

The sender generates 2833 encryption control information, including: the sender of the related signaling encrypts the A-port shared key and the pre-configured A-port control key by using a second encryption algorithm to generate the A-port key The information of the A port key information, the first encryption algorithm name, and the second encryption algorithm name are carried in the 2833 encryption control information;

The receiving party obtains the A-port shared key for encrypting the 2833 information corresponding to the A-port key information, and the method includes: after the receiver of the related signaling obtains the A-port key information, The second encryption algorithm decrypts to obtain the A-port shared key.

5. The method according to claim 4, wherein the mobile switching center is simulated The real entity generates the 2833 encrypted attribute information by using the A-port shared key, and the method includes: the mobile switching center emulation entity uses the A-port shared key and the pre-configured H248 port control key to encrypt by using a third encryption algorithm to generate the H248 port. Key information; carrying the H248 port key information and the pre-configured third encryption algorithm name in the 2833 encryption attribute information;

The transmitting the 2833 encrypted attribute information to the media gateway, the method includes: sending, by the mobile switching center, the bearer establishment or the bearer attribute modification, the 2833 encrypted attribute information to the media gateway;

The media gateway obtains the A-port shared key according to the H248 port key information, and the method includes: after receiving the 2833 encryption attribute information, the media gateway adopts a pre-configured H248 port control key, and the H248 port key information is used by the media gateway. The third encryption algorithm performs decryption calculation, obtains an A-port shared key, and obtains a first encryption algorithm name from the H248 port key information.

The method according to claim 5, wherein after the handover in the call, the mobile switching center emulation entity is a serving mobile switching center emulation entity; the base station controller is a switched target base station The controller is the target media gateway after the handover.

The method according to any one of claims 1 to 6, wherein the sending of the 2833 encrypted attribute information to the media gateway is performed by the mobile switching center emulation entity when the bearer establishment and the bearer attribute modification are performed. The mobile switching center emulation entity sends the H248 bearer setup request message or the bearer attribute modification request message to the media gateway.

The method according to claim 7, wherein the related signaling carrying the 2833 encryption control information is transmitted during a call setup or a call; the related signaling is a call management service. Request message, call response message, bearer update request message, assignment completion message, value added service request message, handover request response message, call request message, assignment request message, value added service notification message, service notification message, bearer update request message, Carry an update response message or a switch request message.

The method according to claim 5, wherein the first encryption algorithm, the second encryption algorithm, and the third encryption algorithm are all symmetric encryption algorithms.

The method according to claim 9, wherein the first encryption algorithm, the second encryption algorithm, and the third encryption algorithm are the same encryption algorithm; or the first encryption algorithm The method, the second encryption algorithm and the third encryption algorithm are different encryption algorithms.

A base station controller, comprising:

The base station controller according to claim 11, wherein the signaling processing unit comprises:

The A-port key information generating unit is configured to encrypt the A-port shared key and the pre-configured A-port control key by using a second encryption algorithm to generate the A-port key information;

An encryption control information filling unit, configured to carry the A port key information, the first encryption algorithm name, and the second encryption algorithm name in the 2833 encryption control information;

The signaling sending unit is configured to send related signaling that carries the 2833 encrypted control information.

The base station controller according to claim 12, wherein the encryption control information filling unit is an A2p bearer format feature parameter expansion unit, configured to use the A port key information, the first encryption algorithm name, and The second encryption algorithm name is populated into the A2p bearer format feature parameter.

a signaling receiving unit, configured to receive related signaling that carries the 2833 encryption control information; the 2833 encryption control information includes A-port key information and a first encryption algorithm name used to encrypt 2833 information;

An information obtaining unit, configured to obtain A-port key information and a second encryption algorithm from the 2833 encryption control information;

The A-port shared key obtaining unit is configured to decrypt the A-port key information by using the second encryption algorithm to obtain an A-port shared key.

A mobile switching center emulation entity, comprising: a signaling processing unit, configured to send or receive, from a base station controller, related signaling carrying 2833 encrypted control information; The information includes the A port key information and the first encryption algorithm name used to encrypt the 2833 information;

The mobile switching center emulation entity according to claim 15, wherein the encrypted attribute information processing unit comprises:

The H248 port key information generating unit is configured to use the A-port shared key and the pre-configured H248 port control key to perform the third encryption algorithm to generate the H248 port key information; the encrypted attribute information filling unit is configured to: Carrying the H248 port key information, the first encryption algorithm name, and the pre-configured third encryption algorithm name in the 2833 encryption attribute information;

The encryption attribute information sending unit is configured to send the 2833 encrypted attribute information to the media gateway when performing bearer establishment or bearer attribute modification.

The mobile switching center emulation entity according to claim 16, wherein the encrypted attribute information padding unit is an H248 signaling padding unit, configured to carry the 2833 encrypted attribute information in the extended H248 signaling. in.

The mobile switching center emulation entity according to claim 15, wherein the signaling processing unit comprises:

The mobile switching center emulation entity according to claim 18, wherein the encryption control information filling unit is an A2p bearer format feature parameter expansion unit, configured to use the A port key information and the first encryption algorithm. Name and second encryption algorithm name are filled to A2p Loaded in the format feature parameters.

21. A media gateway, comprising:

An encryption attribute information processing unit, configured to obtain an A-port shared key and a first encryption algorithm according to the 2833 encrypted attribute information sent by the mobile switching center emulation entity;

The media gateway according to claim 21, wherein the encryption attribute information processing unit comprises:

An information obtaining unit, configured to obtain H248 port key information and a third encryption algorithm from the 2833 encryption attribute information;

The H248 port key information processing unit is configured to use a pre-configured H248 port control key, and decrypt the H248 port key information by using a third encryption algorithm to obtain an A port shared key, and obtain the A port shared key from the H248 port key. The first encryption algorithm name is obtained in the message.

23. A mobile communication system comprising a base station controller, a mobile switching center emulation entity, and a media gateway; wherein

The base station controller is configured to send or receive relevant signaling that carries the 2833 encryption control information to the mobile switching center emulation entity; the 2833 encryption control information includes the A port key information and is used for 2833 the first encryption algorithm name for encrypting the information; and when the 2833 information transmission is performed with the media gateway, using the first encryption algorithm The A-port shared key pair 2833 information corresponding to the A-port key information is processed; the mobile switching center emulation entity is configured to send or receive, from the base station controller, relevant signaling carrying the 2833 encrypted control information; Generating 2833 encrypted attribute information by using the A port shared key corresponding to the A port key information in the 2833 encryption control information, and transmitting 2833 encrypted attribute information to the media gateway; the 2833 encrypted attribute information includes the first Encryption algorithm name and H248 port key information;

The system according to claim 23, wherein the 2833 encryption control information is carried in an A2p bearer format feature parameter in the extended interoperability specification protocol related signaling, and the 2833 encrypted attribute information bearer In the extended H248 signaling.

The system according to claim 23 or 24, wherein the mobile switching center emulation entity is a serving mobile switching center emulation entity; the base station controller is a switched target base station controller; The gateways are all target media gateways after switching.

26. A method of transmitting information in a mobile communication system, comprising: when both the first communication node and the second communication node have communication encryption capabilities and media capabilities at which the first communication node and the second communication node have intersections And the first and second communication nodes determine the same data encryption key;

The method according to claim 26, wherein the communication encryption capability information is a random number generated by a first communication node or a preset public key; the first and second communication nodes determine the same Data encryption key, including:

The second communication node encrypts the random number or the public key from the first communication node by applying a preset encryption policy, and uses the encrypted result as a data encryption key for subsequent communication with the first communication node;

The first communication node applies a pre-set encryption policy to encrypt the self-generated random number or the public key sent to the second communication node, and uses the encryption result as a data encryption key for subsequent communication with the second communication node.

The method according to claim 26, wherein the communication encryption capability information is an encryption obtained by encrypting a random number generated by a first communication node by using a preset encryption policy and a preset public key. Result: the first and second communication nodes determine the same data encryption key, including:

The second communication node decrypts the communication encryption capability information from the first communication node by using a preset encryption policy and a public key, and uses the decryption result as a data encryption key for subsequent communication with the first communication node;

The first communication node uses the encrypted result as a data encryption key for subsequent communication with the second communication node.

The method according to claim 26, wherein the communication encryption capability information is a random number generated by a first communication node or a preset public key; the first and second communication nodes determine the same Data encryption key, including: '

The second communication node uses the random number or public key from the first communication node as a data encryption key for subsequent communication with the first communication node;

The first communication node uses the random number generated by itself or the public key transmitted to the second communication node as a data encryption key to be subsequently communicated with the second communication node.

The method of claim 26, wherein the performing the encrypted communication comprises:

The first/second communication node encrypts the data sent to the second/first communication node by applying the data encryption key and a preset encryption policy, and transmits the encrypted encrypted data to the second/first communication Node

The second/first communication node applies the data encryption key and the encryption policy to decrypt the encrypted data from the first/second communication node.

31. The method of claim 26, wherein before determining the same data encryption key, the method further comprises:

The first communication node sends its own media capability information and communication encryption capability information to the second communication node;

The second communication node determines, according to the media capability information and the communication encryption capability information from the first communication node, whether it has communication encryption capability and an intersection with the first communication node. Media capabilities.

The method according to claim 31, wherein the determining whether the user has the communication encryption capability and the media capability that intersects with the first communication node includes:

The second communication node acquires the media capability that it has, and compares whether the acquired media capability has an intersection with the media capability corresponding to the media capability information from the first communication node. If there is an intersection, the second communication node determines that it has the first Communication nodes have overlapping media capabilities;

The second communication node queries the communication configuration parameter of the communication encryption capability in the communication configuration parameter of the communication. If the queried communication configuration parameter supports communication encryption, the second communication node determines that it has communication encryption capability.

33. The method according to claim 32, wherein the media capability information is a communication protocol name, and the second communication node determines whether it has a media capability that intersects with the first communication node, and is:

The second communication node acquires the communication protocol supported by itself, and compares whether the name of the obtained communication protocol and the communication protocol name from the first communication node are intersected. If there is an intersection, the second communication node determines that it has the existence with the first communication node. Intersection of media capabilities.

The method according to claim 32, wherein the communication configuration parameter related to the communication encryption capability is encryption enabled, and the second communication node determines whether it has communication encryption capability, which is:

The second communication node queries the encryption enablement in the self communication configuration parameter. If the queried encryption enable is set to the enabled state, the second communication node determines that it has the communication encryption capability.

The method according to any one of claims 26 to 34, wherein the performing the encrypted communication is to encrypt and transmit the RFC 2833 protocol data packet.

The method according to any one of claims 26 to 34, wherein the first communication node interacts with the second communication node by using a session initiation protocol or an H323 protocol.