WO2007085186A1

WO2007085186A1 - Media stream key management method, system and application server

Info

Publication number: WO2007085186A1
Application number: PCT/CN2007/000241
Authority: WO
Inventors: Jun Yan; Jincheng Li; Xiangyang Wu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-01-24
Filing date: 2007-01-23
Publication date: 2007-08-02
Also published as: CN101009551B; CN101009551A; CN101313510A

Abstract

A media stream key management method based on IP multimedia subsystem, media stream key management system and application server, wherein the application server and a multi-media streaming server acquire a key and send control unitedly, the application server can send a media stream encryption key TEK to a terminal and the multi-media streaming server directly, the media stream encryption key can be used for multi-media streaming content between the encryption multi-media streaming server and the terminal directly; the application server also can adopt a layered key management style, which can send the key and an encryption key KEK to the terminal and the multi-media streaming server, then distribute TEK through KEK. The present invention can reduce key management overhead of multi-media streaming server, improve efficiency of multi-media streaming server.

Description

Media stream key management method and system and application server The present application claims a key management system and method for media stream based on IP multimedia subsystem submitted to Chinese Patent Office on January 24, 2006, application number 20061003380.4 The priority of the Chinese Patent Application, the entire contents of which is incorporated herein by reference. Technical field

The present invention relates to a communication medium, and more particularly to a media stream key management method and system, and an application server.

Background technique

The streaming media service is a new service that has developed rapidly in recent years. It uses streaming technology to transmit multimedia files, including video and audio files, on a packet-switched network. These multimedia files can be played immediately without having to download them completely. The key technology for streaming media service implementation is streaming technology.

The IP Multimedia Subsystem (IMS) uses the IP packet domain as the bearer channel for its control signaling and media transmission. It uses the Session Initiation Protocol (SIP) as the call control signaling to implement service management. Separation of session control and bearer access.

Streaming media services based on IMS can make full use of the existing features of the IMS network and reuse functions in the IMS network architecture, such as authentication and billing, so that streaming media services can be efficiently and quickly developed.

The security of media streams is an important aspect to consider in streaming media business. How to effectively ensure the security of media stream transmission, so that the media stream is not illegally copied during the transmission process, which involves the legitimate interests of the content provider; at the same time, the security protection of the media stream also protects the user's personal privacy from being illegal. Stealing.

In the prior art, the media stream is protected by directly negotiating a key for media stream protection between the streaming server and the terminal, and the streaming server and the terminal share the key and encrypt the media content with the key. details as follows: 1. The streaming media server and the terminal are based on a symmetric key architecture, and share the key K with each other;

2. Based on the shared key K, the streaming media server and the terminal negotiate a media stream encryption key Kt;

3. The streaming media server uses the key encryption key Kt to encrypt the media stream and transmit it to the terminal. The terminal uses Kt to decrypt the received media stream and play the program.

The basic idea of the above solution is to directly negotiate the key between the streaming server and the terminal based on the symmetric key K shared in advance.

In general, this key management method requires the streaming server and the terminal to share certain information in advance, such as a symmetric key, based on which they can initiate negotiation of the media stream encryption key. However, in a streaming media service, the same streaming server may serve many users at the same time. Under this architecture, the streaming server needs to save the initial symmetric key for each user. This key management method imposes a relatively large burden on the streaming server.

When different terminals request the same media content, different users use different media stream encryption keys because the information used by different terminals in the negotiation process is different. Therefore, the streaming media server needs to be the same. A content is encrypted multiple times. This is not necessary for certain applications where security is relatively low, such as television broadcasting. Broadcast programs generally only need to be encrypted once on the streaming server, while providing multiple users with monthly services, and multiple users use the same key. For such applications, if different users are separately encrypted, the computing overhead and storage requirements of the streaming server are greatly increased, and the efficiency of the streaming server is reduced.

Summary of the invention

The embodiment of the invention provides a media stream key management method and system, and an application server, which can reduce the key management overhead of the streaming media server and improve the efficiency of the streaming media server.

A media stream key management method according to an embodiment of the present invention includes: an application server obtains a media stream encryption key; and sends the media stream encryption key to a terminal and a streaming media server; and the terminal and the streaming media server The media stream encryption key encrypts/decrypts the streamed media content.

A media stream key management method according to another embodiment of the present invention includes: a terminal and an application server negotiate a media stream encryption key;

The application server sends the media stream encryption key to the streaming media server;

The terminal and the streaming server encrypt/decrypt the transmitted streaming media content with the media stream encryption key. A media stream key management method provided by another embodiment of the present invention includes:

The application server acquires a media stream encryption key from a streaming media server;

The application server sends the media stream encryption key to the terminal;

The terminal and the streaming server encrypt/decrypt the transmitted streaming media content with the media stream encryption key.

A media stream key management method according to another embodiment of the present invention includes: an application server sends a key encryption key to a streaming media server; a streaming media server obtains a media stream encryption key, and uses the key encryption key pair The media stream encryption key is encrypted and sent to the terminal; the terminal decrypts using the previously obtained key encryption key to obtain a media stream encryption key; and the terminal and the streaming media server encrypt/decrypt the transmission using the media stream encryption key. Streaming content.

A media stream key management method according to another embodiment of the present invention includes: an application server sends a key encryption key to a streaming media server; and the streaming media server uses the key encryption key to negotiate with the terminal to determine a media stream encryption key. The terminal and the streaming server encrypt/decrypt the transmitted streaming media content with the media stream encryption key.

A media stream key management system according to an embodiment of the present invention includes: an application server, a terminal, and a streaming media server; the terminal is configured to send a service request to the application server; and the application server generates a service request according to the received service request. The media stream encryption key transmits the media stream encryption key to the terminal and the streaming media server; the streaming media server and the terminal encrypt/decrypt the transmitted streaming media content with the media stream encryption key.

A media stream key management system according to another embodiment of the present invention includes: an application server, a terminal, and a streaming media server; the terminal is configured to send a service request to the application server; and the application server receives the terminal Generating a key encryption key and transmitting it to the streaming server; the streaming server is configured to generate a media stream encryption key, and encrypt and send the media stream encryption key by using the key encryption key To the terminal; the terminal decrypts using the key encryption key to obtain a media stream encryption key, and encrypts/decrypts the transmitted streaming media content with the media stream encryption key with the streaming media server.

A media stream key management system according to another embodiment of the present invention includes: an application server, a terminal, and a streaming media server; the terminal is configured to send a service request to the application server; and the application server receives the terminal Generate a key encryption key after the business request and send it to the streaming media a server; the streaming media server uses the key encryption key to negotiate with the terminal to determine a media stream encryption key; and the streaming media server and the terminal encrypt/decrypt the transmitted streaming media content by using the media stream encryption key .

An application server according to an embodiment of the present invention includes: a receiving unit, a key obtaining unit, and a transmitting unit; the receiving unit is configured to receive a service request from the terminal, and notify the key obtaining unit; the key obtaining unit is After receiving the notification, the key is acquired according to the preset key acquisition manner and sent to the transmission unit; the transmission unit transmits the acquired key to the terminal and/or the streaming media server.

The embodiment of the present invention performs the key acquisition and delivery control through the application server and the streaming media server, that is, the unified management of the key through the application server on the service level, not only on the streaming media server. Therefore, the key management function is simplified and clear; in addition, the streaming media server does not need to store key information between the terminal and the terminal, and the keys are obtained through interaction with the application server, thereby reducing the key of the streaming media server. Manage overhead and increase the efficiency of streaming media servers.

DRAWINGS

1 is a schematic diagram of a key management system for an IMS-based media stream according to the present invention;

2 is a schematic flowchart of a method for managing a key of an IMS-based media stream according to a first embodiment of the present invention;

3 is a schematic diagram of a process of a key management method for an IMS-based media stream according to a second embodiment of the present invention;

4 is a schematic flowchart of a method for managing a key of an IMS-based media stream according to a third embodiment of the present invention;

FIG. 5 is a schematic diagram of an embodiment of an application server of the present invention.

detailed description

The IMS network realizes the separation of service management, session control and service bearer, and the execution level of the entire service is very clear. The streaming media service in the IMS can control the acquisition and distribution of keys through the application server, thereby uniformly managing the keys.

Through the unified management of the keys on the application server at the service level, rather than just on the streaming server, the key management function can be simplified and simplified. The streaming media server does not need to save the key information between the terminal and the terminal, and the keys are obtained through interaction with the application server, thereby Reduced key management overhead for streaming media servers.

When the application server is responsible for distributing the keys of the encrypted media stream for the terminal and the streaming server, the application server can distribute the same media stream encryption key for different terminals requesting the same service, for example, when multiple users simultaneously watch the same TV channel. The application server can issue the same media stream encryption key for these users, so only one content encryption process is performed on the streaming media server. When the streaming media server is responsible for distributing the media stream encryption key for different terminals, the streaming media server can distribute the same media stream encryption key for the terminal requesting the same content, thereby ensuring that the streaming media server only needs to encrypt the content once.

Referring to FIG. 1, an embodiment of a key management system for an IMS-based media stream according to the present invention includes: a terminal 101, a proxy CSCF 105, a service CSCF 104, an application server 102, and a streaming server 103, wherein the proxy CSCF 105 is used. The streaming service request sent by the terminal 101 to the application server 102 is forwarded to the serving CSCF 104, and the key forwarded by the serving CSCF 104 is received and forwarded to the terminal 101; the service CSCF 104 is used to trigger the request to the application The server 102 performs a streaming media service request, and receives a key sent by the application server 102, and forwards the key to the proxy CSCF 105 or the streaming media server 103. The application server 102 is configured to receive the streaming media service request sent by the terminal 101, and generate a secret. The key is sent to the terminal 101 and the streaming server 103; the streaming server 103 is configured to transmit the encrypted media content encrypted/decrypted with the terminal 101. The application server 102 and the terminal 101 can be connected via a Ut interface.

As can be seen from Figure 1, all streaming media service requests are processed by the application server. After the terminal is authenticated, it is connected to the IMS network. At the same time, after the authentication and key agreement process, the security association is established between the terminal and the proxy CSCF, so that the security of the key is delivered between the application server and the terminal.

Generally, there are two kinds of keys, one is a key of a media stream that is transmitted in real time between an encryption terminal and a streaming media server, and is called a Traffic Encryption Key (TEK); The security of the flow, TEK's life cycle is relatively short, and the changes are more frequent, such as 10s update. The other is the Key Encryption Key (KEK), which is used to encrypt the TEK to protect the security of the TEK. KEK has a long life cycle. For example, for users who pay for it, KEK can remain unchanged during the streaming service. For subscribers, KEK can remain unchanged for the entire subscription period, thus ensuring KEK. Protection frequently The efficiency of the TEK sent.

The application server can directly deliver the TEK to the terminal and the streaming media server. The media stream encryption key is directly used to encrypt the streaming media content between the streaming media server and the terminal; the application server can also adopt a layered key management mode. The KEK can be delivered to the terminal and the streaming server, and the TEK can be distributed through the protection of the KEK.

There are several ways for application servers and streaming servers to obtain keys. They can generate keys themselves, or they can request keys from other entities, such as a separate Key Management Center (KMC). The manner in which the application server and the streaming server obtain keys in the present invention includes, but is not limited to, the above.

The embodiment of the application server of the key management system of the IMS-based media stream of the present invention needs to implement the following functions on the original basis:

1. After receiving the service request sent by the terminal, the application server obtains the key (KEK and/or TEK) through a certain key extraction method;

2. After the application server obtains the key, it needs to send the key to the terminal and/or the streaming server. 3. If the key obtained by the application server is KEK, the application server needs to save the KEK during the lifetime. Key. If the network related entity saves the KEK, the application server does not need to save. When the key needs to be used during the lifetime, it needs to save the KEK entity request. The key management method of the present invention may have the following embodiments according to different types of keys issued by the application server and different entities to be delivered:

The first embodiment is: After receiving the service request sent by the terminal, the application server obtains a key in one of several ways of obtaining the key, and sends the key as a TEK to the terminal and the streaming server. The terminal and the streaming server use the TEK to encrypt/decrypt the streaming media content transmitted between the two.

The second embodiment is: After receiving the service request sent by the terminal, the application server obtains a key in one of several ways of obtaining the key, and sends the key as a KEK to the terminal and the streaming media server. The streaming server obtains a key in one of several ways of obtaining a key, and uses the key as a TEK to transmit the TEK to the terminal through the protection of the KEK. The terminal and the streaming server encrypt/decrypt the TEK with the TEK. After the application server delivers the KEK to the terminal and the streaming server, the terminal and the streaming server negotiate the TEK with the KEK. The advantage of using delivery instead of negotiation is that you can control the streaming server to be used by different users who use the same service. The same TEK, which reduces the load on the streaming server encryption.

The process of delivering the TEK to the terminal by the MRFP through the protection of the KEK can be performed by using a multicast key stream.

among them. The streaming server can generate the TEK itself or obtain the TEK from the application server. Third Embodiment: After receiving the service request sent by the terminal, the application server obtains two keys in one of several ways of obtaining a key, one as KEK and one as TEK:. The application server delivers the KEK to the terminal and sends the TEK to the terminal through the KEK protection. At the same time, the application server sends the TEK to the streaming server. The terminal and the streaming server use the TEK to encrypt/decrypt the streaming media content transmitted between the two.

In addition, in the third embodiment, after the application server obtains KEK and TEK,

The KEK is sent to the streaming server, and the TEK is sent to the streaming server through the protection of the KEK. At the same time, the application server sends the TEK to the terminal. The TEK encrypts/decrypts the streaming media content transmitted between the terminal and the streaming server.

The fourth embodiment is as follows: After the application server receives the service request sent by the terminal, the application server and the terminal can also obtain the key shared by the two through the GB A (General Bootstrapping Architecture) or other methods as the TEK. The key is sent to the streaming server as a TEK. The terminal and the streaming server use the TEK to encrypt/decrypt the streaming content transferred between the two.

The fifth embodiment is: After the application server receives the service request sent by the terminal, the application server obtains the TEK generated by the streaming server. The key is sent to the terminal as a TEK. The terminal and the streaming server use the TEK to encrypt/decrypt the streaming media content transmitted between the two.

In the second embodiment and the third embodiment described above, the application server and the terminal can also obtain the key shared by both by the GBA (General Bootstrapping Architecture) or other methods as KEK.

In the foregoing second embodiment and the third embodiment, the network side entity may save the KEK during the validity period of the service, so that when the terminal requests the service again, the same KEK is used to deliver the TEK, thereby reducing the application server to obtain the KEK. frequency. The network side entity that holds the KEK may be an application server or a separate key management center, depending on how the KEK is generated.

A long-lived feature for KEK. KEK can be packaged in the copyright object and sent to Terminal. The reason for choosing to do this is that KEK can have a relatively long life cycle, and the key protected by the copyright object can also be valid for the period specified by the copyright object. Moreover, the terminal generally supports the acquisition of copyright objects.

The copyright object can be sent to the terminal when the user orders the business. At this time, the KEK is stored in the copyright distribution center or the key management center, depending on the implementation of copyright management. When the user requests the service, the application server requests the key from the copyright issuing center or the key management center; the application server can also send the KEK to the terminal in the real-time manner when the user requests the service, and the application server can The KEK is passed to a copyright distribution center, and the copyright distribution center issues the KEK in the form of a copyright object.

Referring to FIG. 2, a method for key management of an IMS-based media stream according to a first embodiment of the present invention includes the following steps:

The terminal sends a streaming service request to the application server, and the request may be performed through the Ut interface, or may be triggered by the proxy CSCF and the serving CSCF to the application server to perform a streaming service request. Before the request, the terminal has passed the authentication and key agreement process. Establishing a security alliance between the terminal and the proxy CSCF;

A2. After receiving the service request, the application server determines whether the service request is a streaming media service request, and the determination may be based on specific content requested by the user, or based on some special identifier in the request; if the service request is a flow If the media service request is performed, step a3 is performed; if not, the process is processed according to other service definitions;

23. The application server obtains the media stream encryption key TEK in one of several ways of obtaining a key, and the figure illustrates the manner in which the key is obtained through the KMC;

A4. The application server delivers the media stream encryption key TEK to the terminal and the streaming server. Generally, the TEK delivers the TEK to the terminal through the serving CSCF and the proxy CSCF;

A5. The terminal and streaming server use the media stream encryption key TEK to encrypt/decrypt the streaming media content transmitted between the two.

In the first embodiment of the present invention, the terminal and the media server can subscribe to the application server.

( Subscribe ) Changes in the TEK. After the TEK changes, the application server sends a message to the terminal and the media server via Notify.

In the first embodiment of the present invention, the application server may select to distribute the same media stream encryption key for the terminal requesting the same service, so that the streaming media server only needs to encrypt the content once. and, 00241 one 9 one

Through the dynamic key distribution of the application server, the streaming media server and the terminal do not need to share the key information in advance, which reduces the key management burden of the streaming media server.

Referring to FIG. 3, a method for key management of an IMS-based media stream according to a second embodiment of the present invention includes the following steps:

After receiving the service request, the application server determines whether the request is a streaming media service request, and the determination may be based on specific content requested by the user, or based on some special identifier in the request; if the request is a streaming media service If the request is yes, step b3 is performed, and if not, the process is processed according to other services;

B3. The application server obtains the media stream encryption key KEK in one of several ways of obtaining a key, and the figure illustrates the manner of obtaining the key through the KMC;

B4. The application server issues a key encryption key KEK to the terminal, and the KEK issuing method shown in the figure is to directly deliver the KEK to the terminal by the application server, and the KEK can also be sent to the terminal in the manner of a copyright object;

B5. After receiving the KEK, the terminal sends an acknowledgement message to the application server. The purpose of this step is to ensure that the terminal has received the KEK before receiving the TEK, so that the TEK can be successfully decrypted.

B6. The application server sends a key encryption key KEK to the streaming media server;

Bl. The streaming server obtains a key in one of several ways to obtain a key, and uses the key as a TEK to be sent to the terminal through the protection of the KEK. The figure shows that the streaming server directly delivers the TEK to the terminal. . The streaming media server can also deliver the TEK to the application server, and the application server sends the TEK to the terminal.

B8. The terminal sends a subscription (SUBSCRIBE) message, subscribes to the change of the TEK; because the TEK changes frequently, the streaming server needs to notify the terminal in time after updating the TEK. The terminal sends a SUBSCRIBE message to the streaming server to subscribe to the change of the TEK. If the TEK is delivered to the terminal through the application server, the application server sends a SUBSCRIBE message to the streaming server to subscribe to the change of the TEK. B9. The terminal and the streaming server encrypt/decrypt the streaming media content transmitted between the two by using the media stream encryption key TEK;

After the blO. TEK is updated, the streaming server notifies the terminal by a NOTIFY message. If the TEK is sent to the terminal through the application server, after the TEK is updated, the streaming server notifies the application server of the changed TEK through the NOTIFY message, and the application server sends the TEK to the terminal.

In the step b7, when the streaming server sends the TEK to the terminal, the established connection channel may be used, for example, if there is an RTSP (Real-Time Streaming Protocol) channel, or between the terminal and the streaming server. A separate delivery channel is set up, which can carry related address parameters in the SDP (Session Description Protocol) signaling for establishing a media stream.

In the second embodiment of the present invention, the streaming media server may select to distribute the same media stream encryption key for the terminal requesting the same content, so that the streaming media server only needs to encrypt the content once, and the terminals may be different applications. The services provided by the server. Moreover, the dynamic distribution of the EK by the streaming server eliminates the need to share key information between the streaming server and the terminal, thereby reducing the key management burden of the streaming server.

Referring to FIG. 4, a method for key management of an IMS-based media stream according to a third embodiment of the present invention includes the following steps:

C2. After receiving the service request, the application server determines whether the request is a streaming media service request, and the determination may be based on specific content requested by the user, or based on some special identifier in the request; if the request is a streaming media service If the request is yes, step c3 is performed; if not, the process is processed according to other services;

C3. The application server obtains the media stream encryption key KEK and the media stream encryption key TEK in one of several ways of obtaining the key, and the figure illustrates the manner of obtaining the key through the KMC;

C4. The application server sends the key encryption key KEK to the terminal. The KEK delivery mode shown in the figure is that the application server directly delivers the KEK to the terminal, and the KEK can also be issued in the form of a copyright object. Give the terminal

C5. The application server protects the KEK by the key encryption key, and delivers the media stream encryption key TEK to the terminal and the streaming server;

C6. The terminal sends a subscription (SUBSCRIBE) message to the application server, and subscribes to the change of the TEK; since the change of the TEK is frequent, the application server needs to notify the terminal in time after updating the TEK; c7. The media stream encryption key TEK for the terminal and the streaming media server Encrypting/decrypting streaming media content transmitted between the two;

C8. After the TEK is updated, the application server notifies the terminal by means of a notification message;

C9. The application server simultaneously transmits the updated TEK to the streaming server.

In the third embodiment of the present invention, the application server may choose to distribute the same media stream encryption key for the terminal requesting the same service, so that the streaming media server only needs to encrypt the content once. Moreover, through the dynamic key distribution of the application server, the streaming media server and the terminal do not need to share the key information in advance, thereby reducing the key management burden of the streaming media server.

Referring to FIG. 1 again, in the key management system of the IMS-based media stream of the present invention, the specific unit functions are described in the following scenarios:

1. The application server 102 delivers the media stream encryption key:

The terminal 101 is configured to send a service request to the application server 102.

The application server 102 generates a media stream encryption key according to the received service request and sends the media stream encryption key to the terminal 101 and the streaming server 103;

And the streaming media server and the terminal encrypt/decrypt the transmitted streaming media content by using the media stream encryption key;

The proxy call control function entity 105 is configured to receive a service request sent by the terminal 101 to the application server 102, forward it to the service call control function entity 104, and receive the key forwarded by the service call control function entity 104, and forward it to the terminal. 101;

The service call control function entity 104 is configured to trigger a service request to the application server 102 to perform a streaming service request, and receive a key issued by the application server 102, and forward it to the proxy call control function entity 105 or the streaming server 103.

Second, the streaming media server 103 sends a media stream encryption key:

The terminal 101 is configured to send a service request to the application server 102. The application server 102 generates a key encryption key after receiving the service request of the terminal 101 and sends it to the streaming server 102;

The streaming media server 103 is configured to generate a media stream encryption key, and encrypt the media stream encryption key by using the key encryption key and send it to the terminal 101;

The terminal 101 decrypts using the key encryption key to obtain a media stream encryption key, and encrypts/decrypts the transmitted streaming media content with the media stream encryption key with the streaming media server 103;

The proxy call control function entity 105 is configured to receive a service request sent by the terminal 101 to the application server 102, forward it to the service call control function entity 104, and receive the key forwarded by the service call control function entity 104, and forward it to the terminal. 101 ;

3. The streaming server 103 negotiates the media stream encryption key with the terminal 102:

The application server 102 generates a key encryption key after receiving the service request of the terminal 101 and sends it to the streaming server 103;

The streaming media server 103 negotiates with the terminal 101 to determine a media stream encryption key by using the key encryption key;

The streaming server 103 and the terminal 101 encrypt/decrypt the transmitted streaming media content with the media stream encryption key.

Referring to FIG. 5, an application server embodiment of the present invention includes:

Receiving unit 501, key obtaining unit 502 and transmitting unit 503;

The receiving unit 501 is configured to receive a service request from the terminal, and notify the key obtaining unit 502;

The key obtaining unit 502 acquires the key according to the preset key acquisition manner after receiving the notification, and sends the key to the transmission unit 503;

The transmission unit 503 transmits the acquired key to the terminal and/or the streaming server.

The method for obtaining the key by the key obtaining unit 502 includes at least: generating a key by itself, generating a key by negotiating with the terminal, obtaining a key from other network entities, and the like.

The key includes a key encryption key and/or a media stream encryption key.

The application server further includes: a key storage unit 504;

If the key acquisition unit 502 acquires a key encryption key, it is stored in the key storage unit 504 during the lifetime of the key encryption key.

The embodiment of the present invention performs key management by combining the application server and the streaming media server, thereby effectively reducing the burden of key management of the streaming media server. The application server and the streaming media server can choose to distribute the same media stream encryption key for different users according to different service types and different security requirements, so that when different users consume the same content, only the streaming media server The content is encrypted once to reduce the processing power of the streaming server.

Claims

Rights request

A media stream key management method, comprising:

The application server obtains a media stream encryption key;

Transmitting the media stream encryption key to the terminal and the streaming media server;

2. The media stream key management method according to claim 1, wherein the step of the application server obtaining the media stream encryption key is:

The application server generates a media stream encryption key.

The media stream key management method according to claim 1, wherein the step of transmitting the media stream encryption key to the terminal and the streaming media server comprises:

The application server generates a key encryption key and transmits the key encryption key to the terminal.

The application server negotiates with the terminal to determine a key encryption key.

The media stream key management method according to claim 3 or 4, wherein the step of transmitting the media stream encryption key to the terminal comprises:

The application server encrypts the media stream encryption key by using the key encryption key; and sends the encrypted media stream encryption key to the terminal;

The terminal decrypts the received encrypted media stream encryption key using the key encryption key to obtain a media stream encryption key.

The media stream key management method according to claim 3, wherein the step of generating a media stream encryption key by the server or the application server generating a key encryption key comprises: the application server itself generating the media stream encryption Key or key encryption key.

The media stream key management method according to claim 3, wherein the step of the application server generating the media stream encryption key or the application server generating the key encryption key comprises: applying the server to the key management center Initiate a key request;

The key management center generates a corresponding media stream encryption key or key encryption key.

The media stream key management method according to claim 1, wherein the step of the application server obtaining the media stream encryption key comprises:

The terminal sends a service request to the application server;

The application server determines whether the service request is a streaming service request, and if so, generates a media stream encryption key.

The media stream key management method according to claim 8, wherein the step of the terminal sending a service request to the application server comprises:

The terminal sends a service request to the application server through the Ut interface;

Or

The terminal triggers the service request to the application server through the proxy call session control function entity and the service call session control function entity.

The media stream key management method according to claim 8, wherein the step of transmitting the media stream encryption key to the terminal comprises:

The application server sends the media stream encryption key to the terminal via the proxy call session control function entity and the service call session control function entity.

The media stream key management method according to claim 1, wherein the step of obtaining a media stream encryption key comprises:

It is judged according to the service request from the terminal whether another user has applied for the service before, and if so, generates the same media stream encryption key as the previous user's media stream encryption key.

The media stream key management method according to claim 1, further comprising: the terminal and the streaming media server subscribe to the application server for a change of the media stream encryption key; when the media stream encryption key changes The application server notifies the terminal and the streaming server.

13. A media stream key management method, comprising:

The terminal and the application server negotiate a media stream encryption key;

The media stream key management method according to claim 13, wherein the step of the terminal and the application server negotiating the media stream encryption key is: The terminal and the application server obtain the shared key through the universal booting architecture;

The shared key is used as a media stream encryption key.

A media stream key management method, comprising:

The application server sends the media stream encryption key to the terminal;

A media stream key management method, comprising:

The application server sends a key encryption key to the streaming server;

The streaming server obtains a media stream encryption key, and encrypts the media stream encryption key by using the key encryption key and sends the encryption key to the terminal;

The terminal decrypts using the previously obtained key encryption key to obtain a media stream encryption key; the terminal and the streaming server encrypt/decrypt the transmitted streaming content with the media stream encryption key.

The media stream key management method according to claim 16, wherein the step of the streaming media server acquiring the media stream encryption key is:

The streaming server generates a media stream encryption key;

Or receive a media stream encryption key from the application server.

The media stream key management method according to claim 16, wherein the step of the application server transmitting the key encryption key to the streaming server comprises:

The application server generates a key encryption key;

Before the streaming media server generates the media stream encryption key, the method further includes:

The application server sends the key encryption key to the terminal.

The media stream key management method according to claim 16, wherein the step of the server transmitting the key encryption key to the streaming server comprises:

The terminal and the application server obtain the shared key through the universal booting architecture; The shared key is used as a key encryption key.

The media stream key management method according to claim 18, wherein the step of the application server transmitting the key encryption key to the terminal comprises:

The application server directly sends the key encryption key to the terminal; the application server sends the key encryption key to the terminal in the form of a copyright object.

The media stream key management method according to any one of claims 16 to 21, wherein the step of the streaming media server transmitting the media stream encryption key to the terminal comprises:

The streaming server sends the media stream encryption key to the terminal using the established connection channel; or

Establish a separate delivery channel between the streaming media server and the terminal;

The media stream encryption key is sent to the terminal using the channel.

The media stream key management method according to claim 22, wherein the single delivery channel is a UDP channel or an RTP channel.

The streaming server directly sends the media stream encryption key to the terminal.

The media stream key management method according to any one of claims 16 to 21, wherein the step of the streaming media server transmitting the media stream encryption key to the terminal is:

The media stream encryption key encrypted by the key encryption key is sent to the terminal through the multicast key stream.

The media stream key management method according to claim 16, wherein after the streaming media server sends the media stream encryption key to the terminal, the method includes:

After the media stream encryption key is updated, the streaming media server notifies the terminal by the notification message.

The streaming server sends the media stream encryption key to the application server;

The application server forwards the media stream encryption key to the terminal.

The media stream key management method according to claim 27, wherein the stream is After the media server sends the media stream encryption key to the application server, the steps include:

The application server sends a subscription message to the streaming server.

The media stream key management method according to claim 27, wherein after the application server forwards the media stream encryption key to the terminal, the method includes:

After the media stream encryption key is updated, the streaming media server sends the changed media stream encryption key to the application server by using the notification message;

The media stream key management method according to claim 16, wherein the key encryption key is stored in an application server or a key management center.

The media stream key management method according to claim 21, wherein the step of the application server transmitting the key encryption key to the terminal in the form of a copyright object comprises:

The application server passes the key encryption key to the copyright publishing center;

The copyright distribution center then issues the key encryption key to the terminal in the form of a copyright object.

32. A media stream key management method, comprising:

The application server sends a key encryption key to the streaming server;

The streaming server determines the media stream encryption key by negotiating with the terminal using the key encryption key; and the terminal and the streaming server encrypt/decrypt the transmitted streaming media valley with the media stream encryption key.

The media stream key management method according to claim 32, wherein the step of the application server transmitting the key encryption key to the streaming server comprises:

The application server generates a key encryption key;

Before the streaming media server determines the media stream encryption key by using the key encryption key to negotiate with the terminal, the streaming media server further includes:

The application server sends the key encryption key to the terminal.

The media stream key management method according to claim 32, wherein the step of the application server transmitting the key encryption key to the streaming server comprises: The terminal and the application server obtain the shared key through the universal booting architecture;

The shared key is used as a key encryption key.

The media stream key management method according to claim 33, wherein the step of the application server transmitting the key encryption key to the terminal comprises:

The application server directly sends the key encryption key to the terminal;

Or

The application server sends the key encryption key to the terminal in the form of a copyright object.

The media stream key management method according to claim 36, wherein the step of the application server transmitting the key encryption key to the terminal in the form of a copyright object comprises:

38. A media stream key management system, comprising:

Application server, terminal and streaming server;

The terminal is configured to send a service request to the application server;

The application server generates a media stream encryption key according to the received service request, and sends the media stream encryption key to the terminal and the streaming media server;

The streaming server and the terminal encrypt/decrypt the transmitted streaming media content with the media stream encryption key.

The media stream key management system according to claim 38, wherein the system further comprises:

a proxy call control function entity and a service call control function entity;

The proxy call control function entity is configured to receive a service request sent by the terminal to the application server, forward it to the service call control function entity, and receive the key forwarded by the service call control function entity, and forward the key to the terminal;

The service call control function entity is configured to trigger a service request to the application server to perform a streaming service request, and receive a key delivered by the application server, and forward the key to the proxy call control function entity or the streaming media server.

The media stream key management system according to claim 38 or 39, wherein the application server is connected to the terminal through a Ut interface.

41. A media stream key management system, comprising:

Application server, terminal and streaming server;

The terminal is configured to send a service request to the application server;

After receiving the service request of the terminal, the application server generates a key encryption key and sends the key encryption key to the streaming media server;

The streaming media server is configured to generate a media stream encryption key, and encrypt the media stream encryption key by using the key encryption key and send the data to the terminal;

The terminal decrypts using the key encryption key to obtain a media stream encryption key, and encrypts/decrypts the transmitted streaming media content with the media stream encryption key with the streaming media server.

The media stream key management system according to claim 41, wherein the system further comprises:

The media stream key management system according to claim 41 or 42, wherein the application server is connected to the terminal through a Ut interface.

44. A media stream key management system, comprising:

Application server, terminal and streaming server;

The terminal is configured to send a service request to the application server;

Determining, by the streaming media server, the media stream encryption key by using the key encryption key to negotiate with the terminal;

The media stream key management system according to claim 44, wherein the system further comprises:

The media stream key management system according to claim 44 or 45, wherein the application server is connected to the terminal through a Ut interface.

47. An application server, comprising:

a receiving unit, a key obtaining unit, and a transmitting unit;

The receiving unit is configured to receive a service request from the terminal, and notify the key obtaining unit; after receiving the notification, the key obtaining unit acquires a key according to a preset key acquisition manner and sends the key to the transmission unit;

The transmission unit transmits the acquired key to the terminal and/or the streaming server.

48. The application server of claim 47, wherein the key comprises a key encryption key and/or a media stream encryption key.

The application server according to claim 48, wherein the application server further comprises: a key storage unit;

If the key acquisition unit acquires a key encryption key, it is stored in the key storage unit during the lifetime of the key encryption key.