WO2016095473A1 - 安全通话的方法、终端、系统和计算机存储介质 - Google Patents

安全通话的方法、终端、系统和计算机存储介质 Download PDF

Info

Publication number
WO2016095473A1
WO2016095473A1 PCT/CN2015/082404 CN2015082404W WO2016095473A1 WO 2016095473 A1 WO2016095473 A1 WO 2016095473A1 CN 2015082404 W CN2015082404 W CN 2015082404W WO 2016095473 A1 WO2016095473 A1 WO 2016095473A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
calling terminal
called terminal
calling
called
Prior art date
Application number
PCT/CN2015/082404
Other languages
English (en)
French (fr)
Inventor
任斌
钟安利
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016095473A1 publication Critical patent/WO2016095473A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention relates to communication technologies, and in particular, to a method for secure call, a calling terminal, a called terminal, a system, and a computer storage medium.
  • the terminal In daily voice calls, the terminal usually has a caller ID function, but currently the modified calling number appears in the network, controls the caller ID number of the called party, and masquerades the phone number into a number trusted by the called party to achieve fraud.
  • the purpose of the called party so it is unreliable to trust the other party based on the caller ID; and during the voice call exchange, the content of the call may be eavesdropped.
  • the embodiments of the present invention are intended to provide a method for securely talking, a terminal, a system, and a computer storage medium, which can prevent the occurrence of the calling number camouflage and the content of the call being eavesdropped, and improve the security of the call.
  • an embodiment of the present invention provides a method for a secure call, where the method is applied to a called terminal in a call, and the method includes:
  • the called terminal After receiving the incoming call of the calling terminal, the called terminal receives the identifier of the first digital certificate sent by the calling terminal, and verifies the validity of the number of the calling terminal according to the first digital certificate identifier;
  • the first digital certificate is a digital certificate of the calling terminal, and corresponds to a number of the calling terminal;
  • the calling terminal After the called terminal determines that the number of the calling terminal is legal, the calling terminal passes the Number verification of the identity of the calling terminal;
  • the called terminal After the called terminal determines that the identity of the calling terminal is legal, the called terminal negotiates a communication password with the calling terminal;
  • the called terminal performs encrypted communication with the calling terminal by using the communication password.
  • the method further includes:
  • the called terminal sends a second digital certificate identifier to the calling terminal, where the second digital certificate is a digital certificate of the called terminal, corresponding to the number of the called terminal;
  • the digital certificate identifier is used to enable the calling terminal to acquire the second digital certificate, and determine, according to the second digital certificate, that the calling number of the calling terminal is the number of the called terminal;
  • the called terminal causes the calling terminal to verify the identity legality of the called terminal by its own number.
  • the called terminal verifies the validity of the number of the calling terminal according to the first digital certificate identifier, including:
  • the called terminal acquires the first digital certificate from the authentication center according to the identifier of the first digital certificate
  • the called terminal acquires the number of the calling terminal by using the first digital certificate, and matches the number of the calling terminal with an incoming call number;
  • the called terminal determines that the incoming call number is the number of the calling terminal.
  • the called terminal enables the calling terminal to verify the identity legality of the called terminal by using its own number, including:
  • the called terminal receives an original first verification array sent by the calling terminal, where the original first verification array includes a first random number randomly generated by the calling terminal and a number of the called terminal ;
  • the called terminal signs the original first verification array by its own private key, and Sending the signed first verification array to the calling terminal, where the signed first verification array is used by the calling terminal according to the obtained public key of the called terminal and the signed number A verification array verifies the identity legitimacy of the called terminal.
  • the called terminal verifies the identity legality of the calling terminal by using the number of the calling terminal, including:
  • the called terminal sends an original second verification array to the calling terminal, where the original second verification array includes a second random number randomly generated by the called terminal and a number of the calling terminal;
  • the called terminal verifies the signed second verification array according to the calling terminal public key acquired from the authentication center, and obtains the verified second verification array;
  • the called terminal determines that the identity of the calling terminal is legal.
  • the called terminal negotiates a communication password with the calling terminal, including:
  • the called terminal randomly generates a communication password, and encrypts the communication password by using a public key of the calling terminal to obtain an encrypted communication password;
  • the called terminal sends the encrypted communication password to the calling terminal, and the encrypted communication password is used by the calling terminal to decrypt the encrypted communication password according to its private key. After that, the communication password is obtained.
  • the called terminal negotiates a communication password with the calling terminal, including:
  • the called terminal decrypts the encrypted communication password according to its own private key to obtain the communication password.
  • the called terminal performs encrypted communication with the calling terminal by using the communication password, and includes:
  • the called terminal After receiving the first encrypted voice data sent by the calling terminal by using the telephone network, the called terminal decrypts the first encrypted voice data according to the communication password to obtain first voice data; a voice data is original voice data collected by the calling terminal;
  • the called terminal encrypts the second voice data according to the communication password to obtain second encrypted voice data; and sends the second encrypted voice data to the calling terminal through the telephone network;
  • the second encrypted voice data is original voice data collected by the called terminal.
  • an embodiment of the present invention provides a method for a secure call, where the method is applied to a calling terminal in a call, and the method includes:
  • the calling terminal After the calling terminal initiates a call to the called terminal, and the called terminal connects the call, sends an identifier of the first digital certificate to the called terminal; wherein the first digital certificate is the calling terminal a digital certificate corresponding to the number of the calling terminal; the identifier of the first digital certificate is used by the called terminal to acquire the first digital certificate and a public key of the calling terminal, and according to the Determining, by the first digital certificate, an incoming call number of the called terminal as a number of the calling terminal;
  • the calling terminal verifies the validity of the number of the called terminal according to the identifier of the second digital certificate of the called terminal, where the second digital certificate is a digital certificate of the called terminal, and the The number of the called terminal corresponds to;
  • the calling terminal After the calling terminal determines that the number of the called terminal is legal, the calling terminal verifies the identity legality of the called terminal by using the number of the called terminal;
  • the calling terminal After the calling terminal determines that the identity of the called terminal is legal, the calling terminal and the calling terminal Said called terminal negotiates a communication password;
  • the calling terminal performs encrypted communication with the called terminal by using the communication password.
  • the method further includes: the calling terminal, by using its own number, causes the called terminal to verify identity legality of the calling terminal.
  • the calling terminal verifies the validity of the number of the called terminal according to the identifier of the second digital certificate of the called terminal, including:
  • the calling terminal acquires the number of the called terminal by using the second digital certificate, and matches the number of the called terminal with the calling number of the calling terminal;
  • the calling terminal determines that the calling number is the number of the called terminal.
  • the calling terminal verifies the identity legality of the called terminal by using the number of the called terminal, including:
  • the calling terminal sends an original first verification array to the called terminal, where the original first verification array includes a first random number randomly generated by the calling terminal and a number of the called terminal;
  • the calling terminal receives the signed first verification array returned by the called terminal, where the signed first verification array is used by the called terminal to perform the original first verification according to its own private key.
  • the array is encrypted
  • the calling terminal verifies the signed first verification array according to the public key of the called terminal acquired from the authentication center, and obtains the verified first verification array;
  • the calling terminal determines that the identity of the called terminal is legal
  • the calling terminal causes the called terminal to verify the location by its own number.
  • the identity legality of the calling terminal including:
  • the calling terminal receives an original second verification array sent by the called terminal, where the original second verification array includes a second random number randomly generated by the called terminal and a number of the calling terminal ;
  • the calling terminal signs the original second verification array by its own private key, and sends the signed second verification array to the called terminal, where the signed second verification array is used.
  • the called terminal verifies the identity legality of the calling terminal according to the obtained public key of the calling terminal and the second verification array after the signature.
  • the calling terminal negotiates a communication password with the called terminal, including:
  • the calling terminal randomly generates a communication password, and encrypts the communication password by using the public key of the called terminal to obtain an encrypted communication password;
  • the calling terminal sends the encrypted communication password to the called terminal, and the encrypted communication password is used by the called terminal to decrypt the encrypted communication password according to its private key. After that, the communication password is obtained.
  • the calling terminal negotiates a communication password with the called terminal, including:
  • the calling terminal receives the encrypted communication password sent by the called terminal, wherein the encrypted communication password is randomly generated by the called terminal, and then according to the public key of the calling terminal. Encrypted to get;
  • the calling terminal decrypts the encrypted communication password according to its own private key to obtain the communication password.
  • the calling terminal performs encrypted communication with the called terminal by using the communication password, including:
  • the calling terminal encrypts the first voice data according to the communication password to obtain first encrypted voice data; and sends the first encrypted voice data to the called terminal by using a telephone network;
  • a voice data is original voice data collected by the calling terminal;
  • the calling terminal receives the second encrypted voice data sent by the called terminal by using the telephone network, decrypting the second encrypted voice data according to the communication password to obtain second voice data;
  • the second voice data is original voice data collected by the called terminal.
  • an embodiment of the present invention provides a called terminal, where the called terminal includes: an on unit, a receiving unit, a first verification unit, a second verification unit, a first negotiation unit, and a first communication unit, among them,
  • connection unit is configured to connect an incoming call of the calling terminal
  • the receiving unit is configured to receive an identifier of the first digital certificate sent by the calling terminal after the connecting unit turns on the incoming call of the calling terminal, where the first digital certificate is the a digital certificate of the calling terminal, corresponding to the number of the calling terminal;
  • the first verification unit is configured to verify the validity of the number of the calling terminal according to the first digital certificate identifier
  • the second verification unit is configured to verify identity legality of the calling terminal by using a number of the calling terminal;
  • the first negotiating unit is configured to negotiate a communication password with the calling terminal
  • the first communication unit is configured to perform encrypted communication with the calling terminal by using a communication password negotiated by the first negotiating unit.
  • the called terminal further includes a first sending unit, configured to send a second digital certificate identifier to the calling terminal, where the second digital certificate is a digital certificate of the called terminal, and The number of the called terminal is corresponding to; the second digital certificate identifier is used to enable the calling terminal to acquire the second digital certificate, and determine, according to the second digital certificate, that the calling number of the calling terminal is The number of the called terminal;
  • the second verification unit is further configured to enable the calling terminal to verify identity legality of the called terminal by using the number of the called terminal itself.
  • the first verification unit is configured to:
  • the second verification unit is configured to:
  • the original first verification array includes a first random number randomly generated by the calling terminal and a number of the called terminal;
  • the second verification unit is configured to:
  • an original second verification array Sending, to the calling terminal, an original second verification array, where the original second verification array includes a second random number randomly generated by the called terminal and a number of the calling terminal;
  • the first negotiation unit is configured to:
  • the first negotiation unit is configured to:
  • the first communications unit is configured to:
  • an embodiment of the present invention provides a calling terminal, where the calling terminal includes: a call originating unit, a second sending unit, a third verifying unit, a fourth verifying unit, a second negotiating unit, and a second Communication unit, wherein
  • the call initiating unit is configured to initiate a call to the called terminal
  • the second sending unit is configured to send, after the called terminal connects the call, an identifier of the first digital certificate to the called terminal, where the first digital certificate is a digital certificate of the calling terminal Corresponding to the number of the calling terminal; the identifier of the first digital certificate is used for Determining, by the called terminal, the first digital certificate and the public key of the calling terminal, and determining, according to the first digital certificate, that the called number of the called terminal is the number of the calling terminal;
  • the third verification unit is configured to verify the validity of the number of the called terminal according to the identifier of the second digital certificate of the called terminal, where the second digital certificate is a digital certificate of the called terminal Corresponding to the number of the called terminal;
  • the fourth verification unit is configured to verify identity legality of the called terminal by using the number of the called terminal;
  • the second negotiating unit is configured to negotiate a communication password with the called terminal
  • the second communication unit is configured to perform encrypted communication with the called terminal by using the communication password.
  • the fourth verification unit is further configured to: enable the called terminal to verify identity legality of the calling terminal by using its own number.
  • the third verification unit is configured to receive an identifier of the second digital certificate sent by the called terminal, and obtain the second digital certificate from the authentication center according to the identifier of the second digital certificate;
  • the fourth verification unit is configured to:
  • an original first verification array Sending, to the called terminal, an original first verification array, where the original first verification array includes a first random number randomly generated by the calling terminal and a number of the called terminal;
  • the fourth verification unit is configured to:
  • the second negotiating unit is configured to:
  • the second negotiating unit is configured to:
  • the second communications unit is configured to:
  • the first voice data is The original voice data collected by the calling terminal;
  • the second encrypted voice data is original voice data collected by the called terminal.
  • an embodiment of the present invention provides a system for a secure call, where the system includes a called terminal and a calling terminal, where
  • the called terminal is configured to: after receiving an incoming call of the calling terminal, receive an identifier of the first digital certificate sent by the calling terminal, and verify, according to the first digital certificate identifier, the calling terminal Number legality; wherein the first digital certificate is a digital certificate of the calling terminal, and corresponds to a number of the calling terminal;
  • the called terminal After determining that the identity of the calling terminal is legal, the called terminal negotiates a communication password with the calling terminal;
  • the calling terminal is configured to:
  • the identifier of the first digital certificate is sent to the called terminal; wherein the first digital certificate is a digital certificate of the calling terminal, and The number of the calling terminal is corresponding to; the identifier of the first digital certificate is used by the called terminal to acquire the first digital certificate and the public key of the calling terminal, and determine according to the first digital certificate.
  • the called party number of the called terminal is a number of the calling terminal;
  • the calling terminal negotiates a communication password with the called terminal;
  • the embodiment further provides a computer storage medium, where the computer storage medium stores computer executable instructions, wherein the computer executable instructions are used to perform at least one of the methods of the first to third aspects one.
  • the embodiment of the invention provides a method for secure call, a calling terminal, a called terminal, a system and a computer storage medium, and the calling party and the called party perform mutual authentication and negotiation communication on the digital certificates issued by the third party through the third-party authentication center.
  • the password encrypts the call voice, which prevents the caller number from being spoofed and the content of the call being intercepted, thereby improving the security of the call.
  • FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart of a method for a secure call according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of another method for secure call according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic flowchart of a method for a secure call of a calling and called terminal according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of a process for a calling terminal to request a digital certificate from a CA according to an embodiment of the present disclosure
  • FIG. 6 is a schematic flowchart of verifying the legality of a calling terminal number by a called terminal according to an embodiment of the present invention
  • FIG. 7 is a schematic flowchart of verifying the legality of a called terminal number by a calling terminal according to an embodiment of the present invention.
  • FIG. 8 is a schematic flowchart of confirming identity legality of a called terminal by a calling terminal according to an embodiment of the present invention
  • FIG. 9 is a schematic flowchart of confirming identity legality of a calling terminal according to an embodiment of the present invention.
  • FIG. 10 is a schematic flowchart of a negotiation communication password according to an embodiment of the present invention.
  • FIG. 11 is a schematic flowchart of another negotiation communication password according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of a called terminal according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of another called terminal according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of a calling terminal according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of a system for a secure call according to an embodiment of the present invention.
  • an application scenario of an embodiment of the present invention is shown. It can be understood that the application scenario is only used to describe the technical solution of the embodiment of the present invention, and is not limited to the present invention.
  • the calling terminal 1, the authentication center 2, and the called terminal 3 are understood.
  • the authentication center 2 may be a trusted third-party certificate authority (CA), responsible for the digital certificate. Generate, sign, download, and logout.
  • CA trusted third-party certificate authority
  • the authentication center 2 and the calling terminal 1 and the called terminal 3 can be connected by the data network 4 respectively; and the calling terminal 1 and the called terminal 3 can be connected by the voice network 5, such as a telephone network.
  • This embodiment of the present invention does not specifically limit this.
  • FIG. 1 is taken as an example.
  • FIG. 2 it is a flowchart of a method for a secure call according to an embodiment of the present invention.
  • the method may be applied to a called terminal, and may include:
  • the called terminal After receiving the incoming call of the calling terminal, the called terminal receives the identifier of the first digital certificate sent by the calling terminal, and verifies the validity of the number of the calling terminal according to the first digital certificate identifier;
  • the first digital certificate is a digital certificate of the calling terminal, and corresponds to the number of the calling terminal.
  • the validity of the number of the calling terminal is verified according to the first digital certificate identifier, and the specific process may include:
  • the called terminal acquires the first digital certificate and the public key of the calling terminal from the authentication center according to the identifier of the first digital certificate;
  • the called terminal acquires the number of the calling terminal by using the first digital certificate, and matches the number of the calling terminal with the incoming call number;
  • the called terminal determines the number of the incoming call number as the calling terminal.
  • the authentication center may be a trusted third-party CA, which is responsible for generating, signing, downloading, and deregistering the digital certificate, and may specifically be based on the terminal number and the private identity of the CA according to the request of the terminal.
  • the key generates a digital certificate for the terminal, and generates a corresponding key pair for the terminal, saves the public key of the terminal, and sends the private key of the terminal to the corresponding terminal.
  • the security call is established on the basis of the mutual authentication, and the process may include:
  • the called terminal sends an identifier of the second digital certificate to the calling terminal, where the second digital certificate is a digital certificate of the called terminal, corresponding to the number of the called terminal; and the identifier of the second digital certificate is used to enable the calling terminal to obtain The second digital certificate and the public key of the called terminal, and determining, according to the second digital certificate, the calling number of the calling terminal is the number of the called terminal.
  • both the called terminal and the calling terminal complete the verification of the validity of the other party's number.
  • the security call is established on the basis of mutual authentication. Therefore, in addition to determining the identity legality of the calling terminal, the process may further include: the called terminal passes its own The number causes the calling terminal to verify the identity legitimacy of the called terminal.
  • the called terminal enables the calling terminal to verify the identity legality of the called terminal by using its own number, which may include the following process:
  • the called terminal receives the original first verification array sent by the calling terminal, where the original first verification array includes the first random number randomly generated by the calling terminal and the number of the called terminal;
  • the called terminal signs the original first verification array by its own private key, and sends the signed first verification array to the calling terminal, wherein the signed first verification array is used by the calling terminal according to the acquisition.
  • the public key of the called terminal and the signed first verification array verify the identity legitimacy of the called terminal.
  • the called terminal verifies the identity legality of the calling terminal by using the number of the calling terminal, and may include the following process:
  • the called terminal sends an original second verification array to the calling terminal, where the original second verification array includes a second random number randomly generated by the called terminal and a number of the calling terminal;
  • the called terminal receives the signed second verification array sent by the calling terminal, wherein the signed second verification array is obtained by the calling terminal signing the original second verification array by using its own private key;
  • the called terminal verifies the signed second verification array according to the obtained calling terminal public key, and obtains the verified second verification array
  • the called terminal determines that the identity of the calling terminal is legal.
  • the called terminal negotiates the communication password with the calling terminal, and specifically includes:
  • the called terminal randomly generates a communication password, and encrypts the communication password through the public key of the calling terminal to obtain the encrypted communication password;
  • the called terminal sends the encrypted communication password to the calling terminal, and the encrypted communication password is used by the calling terminal to decrypt the encrypted communication password according to its private key, and obtain the communication password.
  • the called terminal negotiates the communication password with the calling terminal, and specifically includes:
  • the called terminal receives the encrypted communication password sent by the calling terminal, wherein the encrypted communication password is randomly generated by the calling terminal, and then encrypted according to the public key of the called terminal;
  • the called terminal decrypts the encrypted communication password according to its private key to obtain a communication password.
  • S204 The called terminal performs encrypted communication with the calling terminal by using a communication password.
  • the called terminal performs encrypted communication with the calling terminal through the communication password, including:
  • the called terminal After receiving the first encrypted voice data sent by the calling terminal through the telephone network, the called terminal decrypts the first encrypted voice data according to the communication password to obtain the first voice data; wherein the first voice data is collected by the calling terminal.
  • Voice data After receiving the first encrypted voice data sent by the calling terminal through the telephone network, the called terminal decrypts the first encrypted voice data according to the communication password to obtain the first voice data; wherein the first voice data is collected by the calling terminal.
  • the called terminal encrypts the second voice data according to the communication password to obtain the second encrypted voice data; and sends the second encrypted voice data to the calling terminal through the telephone network; wherein the second encrypted voice data is the called terminal Raw voice data collected.
  • the embodiment of the invention provides a method for secure call, which is applied to the called terminal side, and both the calling party and the called party perform mutual authentication on the digital certificates issued by the third party authentication center and
  • the negotiation communication password encrypts the call voice, which prevents the caller number camouflage and the content of the call from being eavesdropped, and improves the security of the call.
  • FIG. 3 it is a flowchart of a method for a secure call according to an embodiment of the present invention.
  • the method may be applied to a calling terminal, and may include:
  • the first digital certificate is a digital certificate of the calling terminal, and corresponds to a number of the calling terminal; and the identifier of the first digital certificate is used by the called terminal to obtain the first a digital certificate and a public key of the calling terminal, and determining, according to the first digital certificate, an incoming call number of the called terminal as a number of the calling terminal.
  • S302 The calling terminal verifies the validity of the number of the called terminal according to the identifier of the second digital certificate of the called terminal.
  • the second digital certificate is a digital certificate of the called terminal, and corresponds to the number of the called terminal.
  • the calling terminal verifies the validity of the number of the called terminal according to the identifier of the second digital certificate of the called terminal.
  • the specific process may include:
  • the calling terminal receives the identifier of the second digital certificate sent by the called terminal, and obtains the second digital certificate and the public key of the called terminal from the authentication center according to the identifier of the second digital certificate;
  • the calling terminal acquires the number of the called terminal by using the second digital certificate, and matches the number of the called terminal with the calling number of the calling terminal;
  • the calling terminal determines that the calling number is the number of the called terminal.
  • the calling terminal verifies the identity of the called terminal by the number of the called terminal
  • the process may further include: the calling terminal, by its own number, causes the called terminal to verify the identity legality of the calling terminal.
  • the following process may be included:
  • the calling terminal sends an original first verification array to the called terminal, where the original first verification array includes a first random number randomly generated by the calling terminal and a number of the called terminal;
  • the calling terminal receives the signed first verification array returned by the called terminal, wherein the signed first verification array is obtained by the called terminal encrypting the original first verification array according to its private key;
  • the calling terminal verifies the signed first verification array according to the public key of the called terminal, and obtains the verified first verification array
  • the calling terminal determines that the identity of the called terminal is legal.
  • the following process may be included:
  • the calling terminal receives the original second verification array sent by the called terminal, where the original second verification array includes a second random number randomly generated by the called terminal and a number of the calling terminal;
  • the calling terminal signs the original second verification array by its own private key, and sends the signed second verification array to the called terminal, wherein the signed second verification array is used by the called terminal according to the acquisition.
  • the public key of the calling terminal and the second verification array after the signature verify the identity legitimacy of the calling terminal.
  • the calling terminal negotiates the communication password with the called terminal, which may include:
  • the calling terminal randomly generates a communication password, and encrypts the communication password by using the public key of the called terminal to obtain an encrypted communication password;
  • the calling terminal sends the encrypted communication password to the called terminal, and the encrypted communication password is used by the called terminal to decrypt the encrypted communication password according to its private key, and obtain the communication password.
  • the calling terminal negotiates the communication password with the called terminal, which may include:
  • the calling terminal receives the encrypted communication password sent by the called terminal, wherein the encrypted communication password is randomly generated by the called terminal, and then encrypted according to the public key of the calling terminal;
  • the calling terminal decrypts the encrypted communication password according to its private key to obtain a communication password.
  • S305 The calling terminal performs encrypted communication with the called terminal by using a communication password.
  • the calling terminal performs encrypted communication with the called terminal by using a communication password, including:
  • the calling terminal encrypts the first voice data according to the communication password to obtain the first encrypted voice data; and sends the first encrypted voice data to the called terminal through the telephone network; wherein the first voice data is collected by the calling terminal Voice data
  • the embodiment of the present invention provides a method for secure call, which is applied to the calling terminal side, and the calling party and the called party perform mutual authentication on the digital certificates issued by the third-party authentication center and encrypt the call voice by negotiating the communication password. It can prevent the caller number camouflage and the content of the call being eavesdropped, and improve the security of the call.
  • FIG. 4 is a detailed flowchart of a method for a secure call of a calling and called terminal according to an embodiment of the present invention.
  • the primary and the called terminal are smart phones
  • the authentication center is a third-party CA.
  • the embodiment does not specifically limit this, and the detailed process may include:
  • the process in which the calling terminal requests the digital certificate from the CA may include the S501.
  • S504 the process in which the calling terminal requests the digital certificate from the CA.
  • S501 The calling terminal sends a certificate request message to the CA.
  • the certificate request message may include the number of the calling terminal and the user information of the calling terminal.
  • the CA generates a certificate conforming to the preset standard format according to the certificate request message, and obtains a digital certificate corresponding to the calling terminal by encrypting the private key.
  • the preset standard format may be a standard X.509 certificate format, and the digital certificate includes the number of the calling terminal and the user information of the calling terminal.
  • S503 The CA generates a corresponding key pair for the calling terminal, and sends the private key in the key pair and the digital certificate corresponding to the calling terminal to the calling terminal.
  • sequence between the S52 and the SCA to generate the corresponding key pair for the calling terminal is not limited in the embodiment of the present invention.
  • the CA discloses its public key, the digital certificate corresponding to the calling terminal, and the public key in the key pair.
  • steps S501 to 504 may be that the calling terminal and the CA are connected through the Internet, or use a Wi-Fi (WI-less, FIDE) connection, or through the third or fourth generation.
  • the mobile communication data service is used as a communication link between the calling terminal and the CA, and is not specifically limited in this embodiment of the present invention.
  • the calling terminal completes the process of requesting the digital certificate from the CA.
  • the called terminal can also request the digital certificate from the CA according to the foregoing process, which is not described in the embodiment of the present invention. .
  • S402 The calling terminal initiates an incoming call to the called terminal.
  • S403 The called terminal connects to the call
  • the basic idea of the secure call provided by this embodiment is that after verifying the number and identity legality of both the calling and called terminals, the communication encryption and decryption are performed by negotiating the password, so S402 and The process of S403 can establish a two-way PCM (Pulse Code Modulation) transmission and reception channel for the subsequent number and identity legality verification of the calling and called terminals and the communication password negotiation.
  • PCM Pulse Code Modulation
  • S404 The calling and called terminals verify the validity of the number of the other party by using the digital certificate of the other party;
  • step S404 may include the following steps: the called terminal verifies the validity of the number of the calling terminal, and the calling terminal verifies the validity of the number of the called terminal.
  • the method may include:
  • S601 The calling terminal sends the identifier of the first digital certificate to the called terminal.
  • S602 The called terminal sends an acquisition request of the first digital certificate to the CA according to the identifier of the first digital certificate.
  • S603 The CA sends the first digital certificate, its own public key, and the public key of the calling terminal to the called terminal.
  • S604 The called terminal verifies the first digital certificate according to the public key of the CA. After the first digital certificate passes the verification, the called terminal obtains the number of the calling terminal from the first digital certificate.
  • the called terminal matches the number of the calling terminal obtained in the first digital certificate with the caller number; it can be understood that the result after the matching includes both consistency and inconsistency, then:
  • the calling terminal verifies the validity of the number of the called terminal, as shown in FIG. :
  • S701 The called terminal sends an identifier of the second digital certificate to the calling terminal.
  • S702 The calling terminal sends an acquisition request of the second digital certificate to the CA according to the identifier of the second digital certificate.
  • S703 The CA sends the second digital certificate, its own public key, and the public key of the called terminal to the calling terminal.
  • S704 The calling terminal verifies the second digital certificate according to the public key of the CA. After the second digital certificate passes the verification, the calling terminal obtains the number of the called terminal from the second digital certificate.
  • S705 The calling terminal matches the number of the called terminal obtained in the second digital certificate with the self-calling number. It can be understood that the matching result includes two types: consistency and inconsistency, then:
  • step S404 the process of verifying the validity of the number of the other party by using the digital certificate of the other party as described in step S404, the foregoing two verification processes may be performed sequentially or simultaneously; The order of the two verification processes is not specifically limited.
  • S405 The calling party and the called party mutually verify the identity of the other party according to the mutual number
  • the verification process of identity legality also includes the case where the calling terminal confirms the identity legality of the called terminal and the called terminal determines the identity legality of the calling terminal:
  • a process for the calling terminal to confirm the identity legality of the called terminal may include: S801 to S807:
  • S801 The calling terminal randomly generates a set of random numbers, and forms an original first verification array with the number of the called terminal;
  • a set of random numbers randomly generated by the calling terminal is referred to as a first random number.
  • the original first verification array may be specifically formed by means of “first random number + called terminal number”.
  • S803 the called terminal signs the original first verification array by its own private key, and sends the signed first verification array to the calling terminal;
  • S804 The calling terminal verifies the signed first verification array according to the public key of the called terminal, and obtains the verified first verification array.
  • FIG. 9 is a flowchart of a method for confirming the identity of the calling terminal by the called terminal according to the embodiment of the present invention, which may specifically include: S901 to S907:
  • S901 The called terminal randomly generates a set of random numbers, and forms a original second verification array with the number of the calling terminal;
  • the original second verification array may be specifically formed by means of “second random number + calling terminal number”.
  • S902 The called terminal sends the original second verification array to the calling terminal.
  • S903 the calling terminal signs the original second verification array by its own private key, and sends the signed second verification array to the called terminal.
  • S904 The called terminal verifies the signed second verification array according to the public key of the calling terminal, and obtains the verified second verification array.
  • S905 The called terminal matches the verified second verification array with the original second verification array; it can be understood that the matching produces two results:
  • FIG. 8 and FIG. 9 the calling terminal and the called terminal complete step S405, and the process in which the calling party and the called party mutually verify the identity of the other party according to the numbers of each other, it can be understood that FIG. 8 and FIG. 9
  • the order of the execution may also be sequential or simultaneous, and this embodiment does not specifically limit this.
  • step S406 the calling terminal negotiates a communication password with the called terminal;
  • the process of negotiating the communication password may include S1001 to S1003:
  • S1001 The calling terminal randomly generates a communication password, and encrypts the communication password by using the public key of the called terminal to obtain the encrypted communication password;
  • S1002 The calling terminal sends the encrypted communication password to the called terminal.
  • S1003 The called terminal decrypts the encrypted communication password according to its own private key, and obtains a communication password.
  • the process of negotiating the communication password may include S1101 to S1103:
  • S1101 The called terminal randomly generates a communication password, and encrypts the communication password by using the public key of the calling terminal to obtain the encrypted communication password;
  • S1102 The called terminal sends the encrypted communication password to the calling terminal.
  • S1103 The calling terminal decrypts the encrypted communication password according to its private key, and obtains a communication password.
  • the specific encrypted communication process can include the following two processes:
  • the encrypted communication process for the calling terminal to send voice data to the called terminal may include:
  • the calling terminal may encrypt the first voice data according to the communication password to obtain the first encrypted voice data; and send the first encrypted voice data to the called terminal through the telephone network; wherein the first voice data is collected by the calling terminal Original speech data;
  • the called terminal receives the first encrypted voice data sent by the calling terminal through the telephone network
  • the first encrypted voice data is decrypted according to the communication password, to obtain the first voice data.
  • the encrypted communication process for the called terminal to send voice data to the calling terminal may include:
  • the called terminal encrypts the second voice data according to the communication password to obtain the second encrypted voice data; and sends the second encrypted voice data to the calling terminal through the telephone network; wherein the second encrypted voice data is collected by the called terminal Original speech data;
  • the calling terminal receives the second encrypted voice data sent by the called terminal through the telephone network. Then, the second encrypted voice data is decrypted according to the communication password to obtain the second voice data.
  • the above is a detailed process of the security call of the calling and called terminals. After both the calling and called terminals verify the other party's number and identity legality, the communication encryption and decryption are performed by negotiating the password, thereby preventing the calling number. Camouflage and the content of the call are eavesdropped, improving the security of the call.
  • a structure of a called terminal 120 including: a receiving unit 1201, a receiving unit 1202, a first verification unit 1203, and a first a verification unit 1204, a first negotiation unit 1205, and a first communication unit 1206, wherein
  • the switch-on unit 1201 is configured to connect an incoming call of the calling terminal
  • the receiving unit 1202 is configured to receive, after the unit 1201 turns on the incoming call of the calling terminal, the identifier of the first digital certificate sent by the calling terminal, where the first digital certificate is the digital certificate of the calling terminal, and the calling party The number of the terminal corresponds to;
  • the first verification unit 1203 is configured to verify the validity of the number of the calling terminal according to the first digital certificate identifier
  • the second verification unit 1204 is configured to verify identity legality of the calling terminal by using the number of the calling terminal;
  • the first negotiating unit 1205 is configured to negotiate a communication password with the calling terminal.
  • the first communication unit 1206 is configured to perform encrypted communication with the calling terminal through the communication password negotiated by the first negotiating unit 1205.
  • the called terminal in this embodiment may be a communication terminal device having a communication function such as a mobile phone, a tablet computer, or a digital communication terminal or an analog communication terminal.
  • the hardware structure corresponding to the connection unit 1201, the receiving unit 1202, and the first communication unit 1206 may include a communication interface of the called terminal, such as a communication antenna.
  • the first verification unit 1203, the second verification unit 1204, and the first negotiation unit may include a processor with information processing.
  • the processor can complete the functions corresponding to the first verification unit 1203, the second verification unit 1204, and the first negotiation unit 1205 by executing the executable code.
  • the processor may include a processing structure or a processing chip having an information processing function, such as an application processor AP, a central processing unit CPU, a microprocessor MCU, a central processing unit CPU, a digital signal processor DSP, a programmable array PLC, and the like.
  • an application processor AP a central processing unit CPU
  • a microprocessor MCU a central processing unit CPU
  • a digital signal processor DSP digital signal processor
  • programmable array PLC programmable array
  • the first verification unit 1203, the second verification unit 1204, and the first negotiation unit 1205 may respectively correspond to different processors, or any two of them may correspond to the same processor.
  • the called terminal 120 further includes: a first sending unit 1207, configured to send a second digital certificate identifier to the calling terminal; wherein the second digital certificate is a digital certificate of the called terminal 120, and The number of the called terminal 120 corresponds to; the second digital certificate identifier is used to enable the calling terminal to acquire the second digital certificate and the public key of the called terminal 120, and determine the calling number of the calling terminal as the called terminal according to the second digital certificate. 120 number;
  • the second verification unit 1204 is further configured to enable the calling terminal to verify the identity legality of the called terminal 120 by the number of the called terminal 120 itself.
  • the first verification unit 1203 is configured to:
  • the number of the incoming call number is determined to be the number of the calling terminal.
  • the second verification unit 1204 is configured to:
  • the original first verification array includes a first random number randomly generated by the calling terminal and a number of the called terminal 120;
  • the second verification unit 1204 is configured to:
  • the original second verification array includes a second random number randomly generated by the called terminal 120 and a number of the calling terminal;
  • the first negotiating unit 1205 is configured to:
  • the first negotiating unit 1205 is configured to:
  • the encrypted communication password is decrypted according to the private key of the called terminal 120 itself to obtain a communication password.
  • the first communication unit 1206 is configured to:
  • the communication secret After receiving the first encrypted voice data sent by the calling terminal through the telephone network, according to the communication secret Decrypting the first encrypted voice data to obtain first voice data; wherein the first voice data is original voice data collected by the calling terminal;
  • the calling terminal 120 After the called terminal 120 authenticates the calling party's number and identity legality, the calling terminal 120 performs communication encryption and decryption by negotiating a password, thereby preventing the calling number camouflage and the content of the call being eavesdropped. The situation happens to improve the security of the call.
  • a structure of a calling terminal 140 including: a call originating unit 1401, a second sending unit 1402, and a third verifying unit 1403. a fourth verification unit 1404, a second negotiation unit 1405, and a second communication unit 1406, wherein
  • the call initiation unit 1401 is configured to initiate a call to the called terminal.
  • the second sending unit 1402 is configured to: after the called terminal connects the call, send the identifier of the first digital certificate to the called terminal; wherein the first digital certificate is a digital certificate of the calling terminal 140, and the calling terminal 140 Corresponding to the number; the identifier of the first digital certificate is used by the called terminal to acquire the first digital certificate and the public key of the calling terminal, and determine, according to the first digital certificate, the called terminal
  • the caller number is the number of the calling terminal;
  • the third verification unit 1403 is configured to verify the validity of the number of the called terminal according to the identifier of the second digital certificate of the called terminal, where the second digital certificate is a digital certificate of the called terminal, corresponding to the number of the called terminal;
  • the fourth verification unit 1404 is configured to verify identity legality of the called terminal by using the number of the called terminal;
  • the second negotiating unit 1405 is configured to negotiate a communication password with the called terminal.
  • the second communication unit 1406 is configured to perform encrypted communication with the called terminal by using a communication password.
  • the calling terminal in this embodiment may be a communication terminal device having a communication function, such as a mobile phone, a tablet computer, or a digital communication terminal or an analog communication terminal.
  • the hardware structure corresponding to the call initiating unit 1401, the second sending unit 1402, and the second communication unit 1406 may include a communication interface of the called terminal, such as a communication antenna.
  • the hardware structures corresponding to the third verification unit 1403, the fourth verification unit 1404, and the second negotiation unit 1405 may all include a processor having information processing.
  • the processor can complete the functions corresponding to the first verification unit 1203, the second verification unit 1204, and the first negotiation unit 1205 by executing the executable code.
  • the processor may include a processing structure or a processing chip having an information processing function, such as an application processor AP, a central processing unit CPU, a microprocessor MCU, a central processing unit CPU, a digital signal processor DSP, a programmable array PLC, and the like.
  • an application processor AP a central processing unit CPU
  • a microprocessor MCU a central processing unit CPU
  • a digital signal processor DSP digital signal processor
  • programmable array PLC programmable array
  • the third verification unit 1403, the fourth verification unit 1404, and the second negotiation unit 1405 and the first negotiation unit 1205 may respectively correspond to different processors, or any two of them may correspond to the same processor.
  • the fourth verification unit 1404 is further configured to cause the called terminal to verify the identity legitimacy of the calling terminal 140 by the number of the calling terminal 140 itself.
  • the third verification unit 1403 is configured to: receive an identifier of the second digital certificate sent by the called terminal, and obtain a second digital certificate from the authentication center according to the identifier of the second digital certificate;
  • the fourth verification unit 1404 is configured to:
  • the original first verification array includes the main Calling the first random number randomly generated by the terminal 140 and the number of the called terminal;
  • the fourth verification unit 1404 is further configured to:
  • the original second verification array includes a second random number randomly generated by the called terminal and a number of the calling terminal 140;
  • the original second verification array is signed by the private key of the calling terminal 140 itself, and the second verification array after the signature is sent to the called terminal, wherein the second verification array after the signature is used by the called terminal according to the called terminal.
  • the obtained public key of the calling terminal 140 and the second verification array after the signature verify the identity legality of the calling terminal 140.
  • the second negotiating unit 1405 is configured to:
  • the second negotiating unit 1405 is configured to:
  • the encrypted communication password is decrypted according to the private key of the calling terminal 140 itself to obtain a communication password.
  • the second communication unit 1406 is configured to:
  • the first voice data is encrypted according to the communication password to obtain the first encrypted voice data; and the first encrypted voice data is sent to the called terminal through the telephone network; wherein the first voice data is the original voice data collected by the calling terminal 140. ;
  • the calling terminal 140 provided in this embodiment can perform communication encryption and decryption by negotiating a password after verifying the number and identity legality of the other party, thereby preventing the calling number from being spoofed and the content of the call being eavesdropped. The situation happens to improve the security of the call.
  • the system 150 may include: a called terminal 120 and a calling terminal 140, where
  • the called terminal 120 is configured as:
  • the identifier of the first digital certificate sent by the calling terminal 140 is received, and the validity of the number of the calling terminal 140 is verified according to the first digital certificate identifier; wherein the first digital certificate is mainly The digital certificate called the terminal 140 corresponds to the number of the calling terminal 140;
  • the communication password is negotiated with the calling terminal 140;
  • the calling terminal 140 is configured to:
  • the identifier of the first digital certificate is sent to the called terminal 120, where the first digital certificate is a digital certificate of the calling terminal, and The number of the calling terminal corresponds to; the identifier of the first digital certificate is used Obtaining, by the called terminal, the first digital certificate and the public key of the calling terminal, and determining, according to the first digital certificate, that an incoming call number of the called terminal is a number of the calling terminal;
  • the second digital certificate is a digital certificate of the called terminal 120, corresponding to the number of the called terminal 120;
  • the communication password is negotiated with the called terminal 120;
  • the encrypted communication with the called terminal 120 is performed by the communication password.
  • An embodiment of the present invention further provides a computer storage medium having stored therein computer executable instructions for performing at least one of the foregoing methods. Specifically, at least one of the methods shown in FIG. 2 to FIG. 11 can be implemented by executing executable instructions in the computer storage medium described in this embodiment.
  • the computer storage medium described in this embodiment may include a mobile storage device, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. Medium.
  • the computer storage medium is a non-transitory storage medium such as a ROM.
  • the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware.
  • the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)
  • Telephone Function (AREA)

Abstract

本发明实施例公开了一种安全通话的方法，终端和系统，该方法可以包括：被叫终端接通主叫终端的来电呼叫后，接收所述主叫终端发送的第一数字证书的标识，并根据所述第一数字证书标识验证所述主叫终端的号码合法性；所述被叫终端确定所述主叫终端的号码合法后，通过所述主叫终端的号码验证所述主叫终端的身份合法性；所述被叫终端确定所述主叫终端的身份合法后，所述被叫终端与所述主叫终端协商出通信密码；所述被叫终端通过所述通信密码与所述主叫终端进行加密通信。本发明实施例还公开了一种计算机存储介质。

Description

安全通话的方法、终端、系统和计算机存储介质 技术领域
本发明涉及通信技术，尤其涉及一种安全通话的方法、主叫终端、被叫终端、系统和计算机存储介质。
背景技术
在日常的语音通话中，终端通常具有来电显示功能，但是目前在网络中出现修改主叫号码，控制被叫方的来电显示号码，将电话号码伪装成某个被叫方信任的号码，达到欺骗被叫的目的，所以仅仅根据来电显示对对方进行信任是不可靠的；而且在语音通话交流过程中，通话内容还存在被窃听的可能。
发明内容
本发明实施例期望提供一种安全通话的方法，终端、系统和计算机存储介质，能够防止主叫号码伪装以及通话内容被窃听的情况发生，提高通话的安全性。
本发明实施例的技术方案是这样实现的：
第一方面，本发明实施例提供了一种安全通话的方法，所述方法应用于通话中的被叫终端，所述方法包括：
所述被叫终端接通主叫终端的来电呼叫后，接收所述主叫终端发送的第一数字证书的标识，并根据所述第一数字证书标识验证所述主叫终端的号码合法性；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；
所述被叫终端确定所述主叫终端的号码合法后，通过所述主叫终端的 号码验证所述主叫终端的身份合法性；
所述被叫终端确定所述主叫终端的身份合法后，所述被叫终端与所述主叫终端协商出通信密码；
所述被叫终端通过所述通信密码与所述主叫终端进行加密通信。
基于上述方案，所述方法还包括：
所述被叫终端向所述主叫终端发送第二数字证书标识；其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；所述第二数字证书标识用于使所述主叫终端获取所述第二数字证书，并根据所述第二数字证书确定所述主叫终端的呼叫号码为所述被叫终端的号码；
所述被叫终端通过自身的号码使所述主叫终端验证所述被叫终端的身份合法性。
基于上述方案，所述被叫终端根据所述第一数字证书标识验证所述主叫终端的号码合法性，包括：
所述被叫终端根据所述第一数字证书的标识从认证中心获取所述第一数字证书；
所述被叫终端通过所述第一数字证书获取所述主叫终端的号码，并将所述主叫终端的号码与来电号码进行匹配；
当所述主叫终端的号码与所述来电号码一致时，所述被叫终端确定所述来电号码为所述主叫终端的号码。
基于上述方案，所述被叫终端通过自身的号码使所述主叫终端验证所述被叫终端的身份合法性，包括：
所述被叫终端接收由所述主叫终端发送的原始第一验证数组，其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号码；
所述被叫终端通过自身的私钥对所述原始第一验证数组进行签名，并 将签名后的第一验证数组发送至所述主叫终端，其中，所述签名后的第一验证数组用于所述主叫终端根据获取的被叫终端的公钥和所述签名后的第一验证数组验证所述被叫终端的身份合法性。
基于上述方案，所述被叫终端通过所述主叫终端的号码验证所述主叫终端的身份合法性，包括：
所述被叫终端向所述主叫终端发送原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
所述被叫终端接收由所述主叫终端发送的签名后的第二验证数组，其中，所述签名后的第二验证数组由所述主叫终端通过自身的私钥对所述原始第二验证数组进行签名得到；
所述被叫终端根据从所述认证中心获取的主叫终端公钥对所述签名后的第二验证数组进行验证，得到验证后的第二验证数组；
当所述验证后的第二验证数组与所述原始第二验证数组匹配时，所述被叫终端确定所述主叫终端的身份合法。
基于上述方案，所述被叫终端与所述主叫终端协商出通信密码，包括：
所述被叫终端随机生成通信密码，并通过所述主叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
所述被叫终端将所述加密后的通信密码发送至所述主叫终端，所述加密后的通信密码用于所述主叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
基于上述方案，所述被叫终端与所述主叫终端协商出通信密码，包括：
所述被叫终端接收由所述主叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述主叫终端随机生成通信密码后，根据所述被叫终端的公钥进行加密得到；
所述被叫终端根据自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
基于上述方案，所述被叫终端通过所述通信密码与所述主叫终端进行加密通信，包括：
所述被叫终端通过电话网络接收所述主叫终端发送的第一加密语音数据后，根据所述通信密码对所述第一加密语音数据进行解密，得到第一语音数据；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
以及，所述被叫终端根据所述通信密码将第二语音数据进行加密，得到第二加密语音数据；并通过所述电话网络将所述第二加密语音数据发送至所述主叫终端；其中，所述第二加密语音数据为所述被叫终端采集的原始语音数据。
第二方面，本发明实施例提供了一种安全通话的方法，所述方法应用于通话中的主叫终端，所述方法包括：
所述主叫终端向被叫终端发起呼叫且所述被叫终端接通呼叫后，向所述被叫终端发送第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
所述主叫终端根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；
所述主叫终端确定所述被叫终端的号码合法之后，所述主叫终端通过所述被叫终端的号码验证所述被叫终端的身份合法性；
所述主叫终端确定所述被叫终端的身份合法之后，所述主叫终端与所 述被叫终端协商出通信密码；
所述主叫终端通过所述通信密码与所述被叫终端进行加密通信。
基于上述方案，所述方法还包括：所述主叫终端通过自身的号码使所述被叫终端验证所述主叫终端的身份合法性。
基于上述方案，所述主叫终端根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，包括：
所述主叫终端接收所述被叫终端发送的第二数字证书的标识，并根据所述第二数字证书的标识从认证中心获取所述第二数字证书；
所述主叫终端通过所述第二数字证书获取所述被叫终端的号码，并将所述被叫终端的号码与所述主叫终端的呼叫号码进行匹配；
当所述被叫终端的号码与所述呼叫号码一致时，所述主叫终端确定所述呼叫号码为所述被叫终端的号码。
基于上述方案，所述主叫终端通过所述被叫终端的号码验证所述被叫终端的身份合法性，包括：
所述主叫终端向所述被叫终端发送原始第一验证数组；其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号码；
所述主叫终端接收所述被叫终端返回的签名后的第一验证数组，其中，所述签名后的第一验证数组由所述被叫终端根据自身的私钥对所述原始第一验证数组进行加密得到；
所述主叫终端根据从所述认证中心获取的被叫终端的公钥对所述签名后的第一验证数组进行验证，得到验证后的第一验证数组；
当所述验证后的第一验证数组与所述原始第一验证数组匹配时，所述主叫终端确定所述被叫终端的身份合法；
基于上述方案，所述主叫终端通过自身的号码使所述被叫终端验证所 述主叫终端的身份合法性，包括：
所述主叫终端接收由所述被叫终端发送的原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
所述主叫终端通过自身的私钥对所述原始第二验证数组进行签名，并将签名后的第二验证数组发送至所述被叫终端，其中，所述签名后的第二验证数组用于所述被叫终端根据获取的主叫终端的公钥和所述签名后的第二验证数组验证所述主叫终端的身份合法性。
基于上述方案，所述主叫终端与所述被叫终端协商出通信密码，包括：
所述主叫终端随机生成通信密码，并通过所述被叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
所述主叫终端将所述加密后的通信密码发送至所述被叫终端，所述加密后的通信密码用于所述被叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
基于上述方案，所述主叫终端与所述被叫终端协商出通信密码，包括：
所述主叫终端接收由所述被叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述被叫终端随机生成通信密码后，根据所述主叫终端的公钥进行加密得到；
所述主叫终端根据自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
基于上述方案，所述主叫终端通过所述通信密码与所述被叫终端进行加密通信，包括：
所述主叫终端根据所述通信密码将第一语音数据进行加密，得到第一加密语音数据；并通过电话网络将所述第一加密语音数据发送至所述被叫终端；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
以及，所述主叫终端通过所述电话网络接收所述被叫终端发送的第二加密语音数据后，根据所述通信密码对所述第二加密语音数据进行解密，得到第二语音数据；其中，所述第二语音数据为所述被叫终端采集的原始语音数据。
第三方面，本发明实施例提供了一种被叫终端，所述被叫终端包括：接通单元、接收单元、第一验证单元、第二验证单元、第一协商单元和第一通信单元，其中，
所述接通单元，配置为接通主叫终端的来电呼叫；
所述接收单元，配置为所述接通单元接通所述主叫终端的来电呼叫之后，接收所述主叫终端发送的第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；
所述第一验证单元，配置为根据所述第一数字证书标识验证所述主叫终端的号码合法性；
所述第二验证单元，配置为通过所述主叫终端的号码验证所述主叫终端的身份合法性；
所述第一协商单元，配置为与所述主叫终端协商出通信密码；
所述第一通信单元，配置为通过所述第一协商单元协商出的通信密码与所述主叫终端进行加密通信。
基于上述方案，所述被叫终端还包括第一发送单元，配置为向所述主叫终端发送第二数字证书标识；其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；所述第二数字证书标识用于使所述主叫终端获取所述第二数字证书，并根据所述第二数字证书确定所述主叫终端的呼叫号码为所述被叫终端的号码；
所述第二验证单元，还配置为通过所述被叫终端自身的号码使所述主叫终端验证所述被叫终端的身份合法性。
基于上述方案，所述第一验证单元，配置为：
根据所述第一数字证书的标识从认证中心获取所述第一数字证书；
以及，通过所述第一数字证书获取所述主叫终端的号码，并将所述主叫终端的号码与所述来电号码进行匹配；
以及，当所述主叫终端的号码与所述来电号码一致时，确定所述来电号码为所述主叫终端的号码.
基于上述方案，所述第二验证单元，配置为：
接收由所述主叫终端发送的原始第一验证数组，其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号码；
以及，通过所述被叫终端自身的私钥对所述原始第一验证数组进行签名，并将签名后的第一验证数组发送至所述主叫终端，其中，所述签名后的第一验证数组用于所述主叫终端根据获取的被叫终端的公钥和所述签名后的第一验证数组验证所述被叫终端的身份合法性；
基于上述方案，所述第二验证单元，配置为：
向所述主叫终端发送原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
以及，接收由所述主叫终端发送的签名后的第二验证数组，其中，所述签名后的第二验证数组由所述主叫终端通过自身的私钥对所述原始第二验证数组进行签名得到；
以及，根据从所述认证中心获取的主叫终端公钥对所述签名后的第二验证数组进行验证，得到验证后的第二验证数组；
以及，当所述验证后的第二验证数组与所述原始第二验证数组匹配时，确定所述主叫终端的身份合法。
基于上述方案，所述第一协商单元，配置为：
随机生成通信密码，并通过所述主叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
以及，将所述加密后的通信密码发送至所述主叫终端，所述加密后的通信密码用于所述主叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
基于上述方案，所述第一协商单元，配置为：
接收由所述主叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述主叫终端随机生成通信密码后，根据所述被叫终端的公钥进行加密得到；
以及，根据所述被叫终端自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
基于上述方案，所述第一通信单元，配置为：
通过电话网络接收所述主叫终端发送的第一加密语音数据后，根据所述通信密码对所述第一加密语音数据进行解密，得到第一语音数据；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
以及，根据所述通信密码将第二语音数据进行加密，得到第二加密语音数据；并通过所述电话网络将所述第二加密语音数据发送至所述主叫终端；其中，所述第二加密语音数据为所述被叫终端采集的原始语音数据。
第四方面，本发明实施例提供了一种主叫终端，所述主叫终端，包括：呼叫发起单元、第二发送单元、第三验证单元、第四验证单元、第二协商单元和第二通信单元，其中，
所述呼叫发起单元，配置为向被叫终端发起呼叫；
所述第二发送单元，配置为所述被叫终端接通呼叫后，向所述被叫终端发送第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用于所 述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
所述第三验证单元，配置为根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；
所述第四验证单元，配置为通过所述被叫终端的号码验证所述被叫终端的身份合法性；
所述第二协商单元，配置为与所述被叫终端协商出通信密码；
所述第二通信单元，配置为通过所述通信密码与所述被叫终端进行加密通信。
基于上述方案，所述第四验证单元，还配置为：通过自身的号码使所述被叫终端验证所述主叫终端的身份合法性。
基于上述方案，所述第三验证单元，配置为接收所述被叫终端发送的第二数字证书的标识，并根据所述第二数字证书的标识从认证中心获取所述第二数字证书；
以及，通过所述第二数字证书获取所述被叫终端的号码，并将所述被叫终端的号码与所述主叫终端的呼叫号码进行匹配；
以及，当所述被叫终端的号码与所述呼叫号码一致时，确定所述呼叫号码为所述被叫终端的号码。
基于上述方案，所述第四验证单元，配置为：
向所述被叫终端发送原始第一验证数组；其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号码；
以及，接收所述被叫终端返回的签名后的第一验证数组，其中，所述签名后的第一验证数组由所述被叫终端根据自身的私钥对所述原始第一验证数组进行加密得到；
以及，根据从所述认证中心获取的被叫终端的公钥对所述签名后的第一验证数组进行验证，得到验证后的第一验证数组；
以及，当所述验证后的第一验证数组与所述原始第一验证数组匹配时，确定所述被叫终端的身份合法；
基于上述方案，所述第四验证单元，配置为：
接收由所述被叫终端发送的原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
以及，通过所述主叫终端自身的私钥对所述原始第二验证数组进行签名，并将签名后的第二验证数组发送至所述被叫终端，其中，所述签名后的第二验证数组用于所述被叫终端根据获取的主叫终端的公钥和所述签名后的第二验证数组验证所述主叫终端的身份合法性。
基于上述方案，所述第二协商单元，配置为：
随机生成通信密码，并通过所述被叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
以及，将所述加密后的通信密码发送至所述被叫终端，所述加密后的通信密码用于所述被叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
基于上述方案，所述第二协商单元，配置为：
接收由所述被叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述被叫终端随机生成通信密码后，根据所述主叫终端的公钥进行加密得到；
以及，根据所述主叫终端自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
基于上述方案，所述第二通信单元，配置为：
根据所述通信密码将第一语音数据进行加密，得到第一加密语音数据；并通过电话网络将所述第一加密语音数据发送至所述被叫终端；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
以及，通过所述电话网络接收所述被叫终端发送的第二加密语音数据后，根据所述通信密码对所述第二加密语音数据进行解密，得到第二语音数据；其中，所述第二语音数据为所述被叫终端采集的原始语音数据。
第五方面，本发明实施例提供了一种安全通话的系统，所述系统包括被叫终端和主叫终端，其中，
所述被叫终端，配置为：接通主叫终端的来电呼叫后，接收所述主叫终端发送的第一数字证书的标识，并根据所述第一数字证书标识验证所述主叫终端的号码合法性；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；
以及，确定所述主叫终端的号码合法后，通过所述主叫终端的号码验证所述主叫终端的身份合法性；
以及，确定所述主叫终端的身份合法后，所述被叫终端与所述主叫终端协商出通信密码；
以及，通过所述通信密码与所述主叫终端进行加密通信；
所述主叫终端，配置为：
向被叫终端发起呼叫且所述被叫终端接通呼叫后，向所述被叫终端发送第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
以及，根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，其中，所述第二数字证书为所述被叫终端的数字证书，与所 述被叫终端的号码对应；
以及，确定所述被叫终端的号码合法之后，通过所述被叫终端的号码验证所述被叫终端的身份合法性；
以及，确定所述被叫终端的身份合法之后，所述主叫终端与所述被叫终端协商出通信密码；
以及，通过所述通信密码与所述被叫终端进行加密通信。
第七方面，本实施例还提供一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行第一方面至第三方面所述方法的至少其中之一。
本发明实施例提供了一种安全通话的方法，主叫终端、被叫终端和系统及计算机存储介质，主被叫双方通过第三方认证中心对各自下发的数字证书进行相互的认证以及协商通信密码对通话语音进行加密，能够防止主叫号码伪装以及通话内容被窃听的情况发生，提高通话的安全性。
附图说明
图1为本发明实施例提供的一种应用场景示意图；
图2为本发明实施例提供的一种安全通话的方法流程示意图；
图3为本发明实施例提供的另一种安全通话的方法流程示意图；
图4为本发明实施例提供的主被叫终端安全通话的方法的详细流程示意图；
图5为本发明实施例提供的主叫终端向CA请求数字证书的流程示意图；
图6为本发明实施例提供的被叫终端验证主叫终端号码合法性的流程示意图；
图7为本发明实施例提供的主叫终端验证被叫终端号码合法性的流程示意图；
图8为本发明实施例提供的主叫终端确认被叫终端的身份合法性的流程示意图；
图9为本发明实施例提供的被叫终端确认主叫终端的身份合法性的流程示意图；
图10为本发明实施例提供的一种协商通信密码的流程示意图；
图11为本发明实施例提供的另一种协商通信密码的流程示意图；
图12为本发明实施例提供的一种被叫终端的结构示意图；
图13为本发明实施例提供的另一种被叫终端的结构示意图；
图14为本发明实施例提供的一种主叫终端的结构示意图；
图15为本发明实施例提供的一种安全通话的系统结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，应当理解，以下所说明的优选实施例仅用于说明和解释本发明，并不用于限定本发明。
参见图1，其示出了本发明实施例提供的一种应用场景，可以理解的，该应用场景仅用于说明本发明实施例的技术方案，并非对本发明进行的任何限定，在该场景中，包括主叫终端1、认证中心2和被叫终端3，可以理解的，在本实施例中，认证中心2可以是一个可信任的第三方证书授权中心(CA，Certificate Authority)，负责数字证书的生成、签发、下载和注销。认证中心2与主叫终端1和被叫终端3之间分别可以由数据网络4进行连接；而主叫终端1与被叫终端3之间可以由语音网络5进行连接，例如电话网络。本发明实施例对此不作具体限定。
以图1所示的应用场景为例，参见图2，其示出了本发明实施例提供的一种安全通话的方法流程，该方法可以应用于被叫终端，可以包括：
S201：被叫终端接通主叫终端的来电呼叫后，接收主叫终端发送的第一数字证书的标识，并根据第一数字证书标识验证主叫终端的号码合法性；
需要说明的是，第一数字证书为主叫终端的数字证书，与主叫终端的号码对应。示例性地，根据第一数字证书标识验证主叫终端的号码合法性，具体过程可以包括：
被叫终端根据第一数字证书的标识从认证中心获取第一数字证书及主叫终端的公钥；
以及，被叫终端通过第一数字证书获取主叫终端的号码，并将主叫终端的号码与来电号码进行匹配；
以及，当主叫终端的号码与来电号码一致时，被叫终端确定来电号码为主叫终端的号码。
需要说明的是，本发明实施例中，认证中心可以是一个可信任的第三方CA，负责数字证书的生成、签发、下载和注销，具体可以根据终端的请求根据终端的号码和CA自身的私钥为终端生成数字证书，并且为终端生成对应的密钥对，将该终端的公钥进行保存，将该终端的私钥发送至相应地终端。
基于上述方案，由于本实施例中安全通话是建立在相互验证的基础之上的，因此，除了被叫终端确定主叫终端的号码合法性以外，本流程还可以包括：
被叫终端向主叫终端发送第二数字证书的标识，其中，第二数字证书为被叫终端的数字证书，与被叫终端的号码对应；第二数字证书的标识用于使主叫终端获取第二数字证书和被叫终端的公钥，并根据第二数字证书确定主叫终端的呼叫号码为被叫终端的号码。
可以理解的，被叫终端和主叫终端双方就完成了对方的号码合法性验证。
S202：被叫终端确定主叫终端的号码合法后，通过主叫终端的号码验证主叫终端的身份合法性；
示例性地，由于本实施例中安全通话是建立在相互验证的基础之上的，因此，除了被叫终端确定主叫终端的身份合法性以外，本流程还可以包括：被叫终端通过自身的号码使主叫终端验证被叫终端的身份合法性。
具体地，被叫终端通过自身的号码使主叫终端验证被叫终端的身份合法性，可以包括以下过程：
被叫终端接收由主叫终端发送的原始第一验证数组，其中，原始第一验证数组包括主叫终端随机生成的第一随机数和被叫终端的号码；
以及，被叫终端通过自身的私钥对原始第一验证数组进行签名，并将签名后的第一验证数组发送至主叫终端，其中，签名后的第一验证数组用于主叫终端根据获取的被叫终端的公钥和签名后的第一验证数组验证被叫终端的身份合法性。
具体地，被叫终端通过主叫终端的号码验证主叫终端的身份合法性，可以包括以下过程：
被叫终端向主叫终端发送原始第二验证数组，其中，原始第二验证数组包括被叫终端随机生成的第二随机数和主叫终端的号码；
以及，被叫终端接收由主叫终端发送的签名后的第二验证数组，其中，签名后的第二验证数组由主叫终端通过自身的私钥对原始第二验证数组进行签名得到；
以及，被叫终端根据获取的主叫终端公钥对签名后的第二验证数组进行验证，得到验证后的第二验证数组；
以及，当验证后的第二验证数组与原始第二验证数组匹配时，被叫终端确定主叫终端的身份合法。
S203：被叫终端确定主叫终端的身份合法后，被叫终端与主叫终端协 商出通信密码；
需要说明的是，根据协商的发起者的不同，被叫终端与主叫终端协商出通信密码的具体过程也有区别。
可选地，被叫终端与主叫终端协商出通信密码，具体可以包括：
被叫终端随机生成通信密码，并通过主叫终端的公钥对通信密码进行加密，得到加密后的通信密码；
以及，被叫终端将加密后的通信密码发送至主叫终端，加密后的通信密码用于主叫终端根据自身的私钥对加密后的通信密码进行解密后，得到通信密码。
可选地，被叫终端与主叫终端协商出通信密码，具体可以包括：
被叫终端接收由主叫终端发送的加密后的通信密码，其中，加密后的通信密码由主叫终端随机生成通信密码后，根据被叫终端的公钥进行加密得到；
以及，被叫终端根据自身的私钥对加密后的通信密码进行解密，得到通信密码。
S204：被叫终端通过通信密码与主叫终端进行加密通信。
示例性地，被叫终端通过通信密码与主叫终端进行加密通信，包括：
被叫终端通过电话网络接收主叫终端发送的第一加密语音数据后，根据通信密码对第一加密语音数据进行解密，得到第一语音数据；其中，第一语音数据为主叫终端采集的原始语音数据；
以及，被叫终端根据通信密码将第二语音数据进行加密，得到第二加密语音数据；并通过电话网络将第二加密语音数据发送至主叫终端；其中，第二加密语音数据为被叫终端采集的原始语音数据。
本发明实施例提供了一种安全通话的方法，应用于被叫终端一侧，主被叫双方通过第三方认证中心对各自下发的数字证书进行相互的认证以及 协商通信密码对通话语音进行加密，能够防止主叫号码伪装以及通话内容被窃听的情况发生，提高通话的安全性。
以图1所示的应用场景为例，参见图3，其示出了本发明实施例提供的一种安全通话的方法流程，该方法可以应用于主叫终端，可以包括：
S301：主叫终端向被叫终端发起呼叫且被叫终端接通呼叫后，向被叫终端发送第一数字证书的标识；
需要说明的是，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码。
S302：主叫终端根据被叫终端的第二数字证书的标识验证被叫终端的号码合法性；
需要说明的是，第二数字证书为被叫终端的数字证书，与被叫终端的号码对应。示例性地，主叫终端根据被叫终端的第二数字证书的标识验证被叫终端的号码合法性，具体过程可以包括：
主叫终端接收被叫终端发送的第二数字证书的标识，并根据第二数字证书的标识从认证中心获取第二数字证书及被叫终端的公钥；
以及，主叫终端通过第二数字证书获取被叫终端的号码，并将被叫终端的号码与主叫终端的呼叫号码进行匹配；
以及，当被叫终端的号码与呼叫号码一致时，主叫终端确定呼叫号码为被叫终端的号码。
S303：主叫终端确定被叫终端的号码合法之后，主叫终端通过被叫终端的号码验证被叫终端的身份合法性；
示例性地，由于本实施例中安全通话是建立在相互验证的基础之上的，因此，除了主叫终端通过被叫终端的号码验证被叫终端的身份合法性以外， 本流程还可以包括：主叫终端通过自身的号码使被叫终端验证主叫终端的身份合法性。
具体地，对于主叫终端通过被叫终端的号码验证被叫终端的身份合法性，可以包括以下过程：
主叫终端向被叫终端发送原始第一验证数组；其中，原始第一验证数组包括主叫终端随机生成的第一随机数和被叫终端的号码；
以及，主叫终端接收被叫终端返回的签名后的第一验证数组，其中，签名后的第一验证数组由被叫终端根据自身的私钥对原始第一验证数组进行加密得到；
以及，主叫终端根据被叫终端的公钥对签名后的第一验证数组进行验证，得到验证后的第一验证数组；
以及，当验证后的第一验证数组与原始第一验证数组匹配时，主叫终端确定被叫终端的身份合法。
具体地，对于主叫终端通过自身的号码使被叫终端验证主叫终端的身份合法性，可以包括以下过程：
主叫终端接收由被叫终端发送的原始第二验证数组，其中，原始第二验证数组包括被叫终端随机生成的第二随机数和主叫终端的号码；
以及，主叫终端通过自身的私钥对原始第二验证数组进行签名，并将签名后的第二验证数组发送至被叫终端，其中，签名后的第二验证数组用于被叫终端根据获取的主叫终端的公钥和签名后的第二验证数组验证主叫终端的身份合法性。
S304：主叫终端与被叫终端互相验证对方的身份合法之后，主叫终端与被叫终端协商出通信密码；
需要说明的是，根据协商的发起者的不同，主叫终端与被叫终端协商出通信密码的具体过程也有区别。
可选地，主叫终端与被叫终端协商出通信密码，具体可以包括：
主叫终端随机生成通信密码，并通过被叫终端的公钥对通信密码进行加密，得到加密后的通信密码；
以及，主叫终端将加密后的通信密码发送至被叫终端，加密后的通信密码用于被叫终端根据自身的私钥对加密后的通信密码进行解密后，得到通信密码。
可选地，主叫终端与被叫终端协商出通信密码，具体可以包括：
主叫终端接收由被叫终端发送的加密后的通信密码，其中，加密后的通信密码由被叫终端随机生成通信密码后，根据主叫终端的公钥进行加密得到；
以及，主叫终端根据自身的私钥对加密后的通信密码进行解密，得到通信密码。
S305：主叫终端通过通信密码与被叫终端进行加密通信。
示例性地，主叫终端通过通信密码与被叫终端进行加密通信，包括：
主叫终端根据通信密码将第一语音数据进行加密，得到第一加密语音数据；并通过电话网络将第一加密语音数据发送至被叫终端；其中，第一语音数据为主叫终端采集的原始语音数据；
以及，主叫终端通过电话网络接收被叫终端发送的第二加密语音数据后，根据通信密码对第二加密语音数据进行解密，得到第二语音数据；其中，第二语音数据为被叫终端采集的原始语音数据。
本发明实施例提供了一种安全通话的方法，应用于主叫终端一侧，主被叫双方通过第三方认证中心对各自下发的数字证书进行相互的认证以及协商通信密码对通话语音进行加密，能够防止主叫号码伪装以及通话内容被窃听的情况发生，提高通话的安全性
结合前述实施例相同的技术构思，以图1所示的应用场景为例，参见 图4，其示出了本发明实施例提供的主被叫终端安全通话的方法的详细流程，在该流程中，本实施例以主、被叫终端为智能手机，认证中心为第三方CA为例进行说明，可以理解的，本实施例对此不作具体限定，该详细流程可以包括：
S401：主、被叫终端均向CA请求数字证书；
可以理解的，由于主、被叫终端向CA发起证书请求的过程一致，所以，本实施例以主叫终端为例来说明，参见图5，主叫终端向CA请求数字证书的过程可以包括S501至S504：
S501：主叫终端向CA发送证书请求消息；
需要说明的是，证书请求消息可以包括主叫终端的号码以及主叫终端的用户信息。
S502：CA根据证书请求消息为主叫终端生成符合预设标准格式的证书，并通过自身的私钥加密后，得到主叫终端对应的数字证书；
其中，预设标准格式可以是标准的X.509证书格式，而数字证书中包括了主叫终端的号码及主叫终端的用户信息。
S503：CA为主叫终端生成对应的密钥对；并且将密钥对中的私钥和主叫终端对应的数字证书发送至主叫终端；
需要说明的是，S502与S503中所述的“CA为主叫终端生成对应的密钥对”之间的先后顺序，本发明实施例不作具体限定。
S504：CA将自身的公钥、主叫终端对应的数字证书和密钥对中的公钥进行公开。
需要说明的是，上述S501至504的步骤可以是主叫终端与CA之间通过因特网internet连接，或者采用无线保真(Wi-Fi，WIreless-FIdelity)连接，或者通过第三代或第四代移动通信数据业务作为主叫终端与CA之间的通信链路，本发明实施例对此不做具体限定；
可以理解的，通过S501至S504，主叫终端完成了向CA请求数字证书的过程；相应地，被叫终端也可以按照上述过程向CA请求自身的数字证书，本发明实施例对此不再赘述。
S402：主叫终端向被叫终端发起来电呼叫；
S403：被叫终端接通呼叫；
需要说明的是，由于本实施例提供的安全通话的基本思想是通过对于主被叫终端双方的号码和身份合法性进行验证完毕后，再通过协商密码的方式进行通信加密和解密，所以S402和S403的过程可以为后续主被叫终端双方的号码和身份合法性验证以及通信密码协商建立了双向的脉冲编码调制(PCM，Pulse Code Modulation)发送和接收通道。
S404：主被叫终端通过对方的数字证书验证对方的号码合法性；
具体的，步骤S404可以包括被叫终端验证主叫终端的号码合法性以及主叫终端验证被叫终端的号码合法性两个过程。
对于被叫终端验证主叫终端号码合法性的过程，参见图6，可以包括：
S601：主叫终端向被叫终端发送第一数字证书的标识；
S602：被叫终端根据第一数字证书的标识向CA发送第一数字证书的获取请求；
S603：CA将第一数字证书、自身的公钥以及主叫终端的公钥发送至被叫终端；
S604：被叫终端根据CA的公钥对第一数字证书进行验证，当第一数字证书通过验证后，被叫终端从第一数字证书中获取主叫终端的号码；
S605：被叫终端将第一数字证书中获取的主叫终端的号码与来电号码进行匹配；可以理解的，匹配之后的结果包括一致和不一致两种，那么：
S606：当第一数字证书中获取的主叫终端的号码与来电号码一致时，被叫终端确定来电号码为主叫终端的号码；
S607：当第一数字证书中获取的主叫终端的号码与来电号码不一致时，被叫终端结束通话。
可以理解的，除了步骤S601至S607所描述的被叫终端验证主叫终端的号码合法性之外，参见图7，主叫终端也相应地对被叫终端的号码合法性进行验证，具体过程为：
S701：被叫终端向主叫终端发送第二数字证书的标识；
S702：主叫终端根据第二数字证书的标识向CA发送第二数字证书的获取请求；
S703：CA将第二数字证书、自身的公钥及被叫终端的公钥发送至主叫终端；
S704：主叫终端根据CA的公钥对第二数字证书进行验证，当第二数字证书通过验证后，主叫终端从第二数字证书中获取被叫终端的号码；
S705：主叫终端将第二数字证书中获取的被叫终端的号码与自身呼叫号码进行匹配；可以理解的，匹配之后的结果包括一致和不一致两种，那么：
S706：当第二数字证书中获取的被叫终端的号码与呼叫号码一致时，主叫终端确定呼叫号码为被叫终端的号码；
S707：当第二数字证书中获取的被叫终端的号码与呼叫号码一致时，主叫终端结束通话。
可以理解的，图6与图7所示的是步骤S404所述的通过对方的数字证书验证对方的号码合法性的过程，上述两个验证过程可以是先后进行，也可以同时进行；本实施例不对这两个验证过程的顺序进行具体限定。
需要说明的是，当主被叫终端双方对彼此的号码合法性验证完毕后，那么：
S405：主被叫双方根据彼此的号码相互验证对方的身份合法性；
需要具体说明的是，身份合法性的验证过程也包括主叫终端确认被叫终端的身份合法性以及被叫终端确定主叫终端的身份合法性两种情况：
对于第一种情况，参见图8，其示出了本发明实施例提供的一种主叫终端确认被叫终端的身份合法性的流程，具体可以包括：S801至S807：
S801：主叫终端随机生成一组随机数，并与被叫终端的号码组成原始第一验证数组；
需要说明的是，在本发明实施例中，主叫终端随机生成的一组随机数称为第一随机数。优选地，原始第一验证数组具体可以通过“第一随机数+被叫终端号码”的方式组成。
S802：主叫终端将原始第一验证数组发送至被叫终端；
S803：被叫终端通过自身的私钥对原始第一验证数组进行签名，并将签名后的第一验证数组发送至主叫终端；
S804：主叫终端根据被叫终端的公钥对签名后的第一验证数组进行验证，得到验证后的第一验证数组；
S805：主叫终端将验证后的第一验证数组与原始第一验证数组进行匹配；可以理解的，匹配会产生两种结果：
S806：当验证后的第一验证数组与原始第一验证数组匹配时，主叫终端确定被叫终端的身份合法；
S807：当验证后的第一验证数组与原始第一验证数组不匹配时，主叫终端结束通话。
对于第二种情况，参见图9，其示出了本发明实施例提供的一种被叫终端确认主叫终端的身份合法性的流程，具体可以包括：S901至S907：
S901：被叫终端随机生成一组随机数，并与主叫终端的号码组成原始第二验证数组；
需要说明的是，在本发明实施例中，被叫终端随机生成的一组随机数 称为第二随机数。优选地，原始第二验证数组具体可以通过“第二随机数+主叫终端号码”的方式组成。
S902：被叫终端将原始第二验证数组发送至主叫终端；
S903：主叫终端通过自身的私钥对原始第二验证数组进行签名，并将签名后的第二验证数组发送至被叫终端；
S904：被叫终端根据主叫终端的公钥对签名后的第二验证数组进行验证，得到验证后的第二验证数组；
S905：被叫终端将验证后的第二验证数组与原始第二验证数组进行匹配；可以理解的，匹配会产生两种结果：
S906：当验证后的第二验证数组与原始第二验证数组匹配时，被叫终端确定主叫终端的身份合法；
S907：当验证后的第二验证数组与原始第二验证数组不匹配时，被叫终端结束通话。
通过图8和图9所示的两种情况示例，主被叫终端完成了步骤S405，主被叫双方根据彼此的号码相互验证对方的身份合法性的过程，可以理解的，图8和图9之间的进行顺序也可以是先后顺序或者同时进行，本实施例对此也不做具体限定。
在完成了步骤S405之后，S406：主叫终端与被叫终端协商出通信密码；
需要说明的是，根据协商的发起者的不同，主叫终端与被叫终端协商出通信密码的具体过程也有区别。
可选地，当协商的发起者是主叫终端时，参见图10，协商通信密码的过程可以包括S1001至S1003：
S1001：主叫终端随机生成通信密码，并通过被叫终端的公钥对通信密码进行加密，得到加密后的通信密码；
S1002：主叫终端将加密后的通信密码发送至被叫终端；
S1003：被叫终端根据自身的私钥对加密后的通信密码进行解密后，得到通信密码。
可选地，当协商的发起者是被叫终端时，参见图11，协商通信密码的过程可以包括S1101至S1103：
S1101：被叫终端随机生成通信密码，并通过主叫终端的公钥对通信密码进行加密，得到加密后的通信密码；
S1102：被叫终端将加密后的通信密码发送至主叫终端；
S1103：主叫终端根据自身的私钥对加密后的通信密码进行解密后，得到通信密码。
需要说明的是，在实际应用时，图10和图11所示的协商过程中可以只选一种进行实施。
当通信密码协商完毕之后，S407：主被叫终端通过通信密码进行加密通信；
具体的加密通信过程可以包括以下两个过程：
A、对于主叫终端向被叫终端发送语音数据的加密通信过程可以包括：
主叫终端可以根据通信密码将第一语音数据进行加密，得到第一加密语音数据；并通过电话网络将第一加密语音数据发送至被叫终端；其中，第一语音数据为主叫终端采集的原始语音数据；
随后，被叫终端通过电话网络接收主叫终端发送的第一加密语音数据后，根据通信密码对第一加密语音数据进行解密，得到第一语音数据。
B、对于被叫终端向主叫终端发送语音数据的加密通信过程可以包括：
被叫终端根据通信密码将第二语音数据进行加密，得到第二加密语音数据；并通过电话网络将第二加密语音数据发送至主叫终端；其中，第二加密语音数据为被叫终端采集的原始语音数据；
随后，主叫终端通过电话网络接收被叫终端发送的第二加密语音数据 后，根据通信密码对第二加密语音数据进行解密，得到第二语音数据。
以上则是主被叫终端进行安全通话的详细过程，通过主被叫终端双方对对方的号码和身份合法性进行验证完毕后，再通过协商密码的方式进行通信加密和解密，能够防止主叫号码伪装以及通话内容被窃听的情况发生，提高通话的安全性。
基于前述实施例相同的技术构思，参见图12，其示出了本发明实施例提供的一种被叫终端120的结构，包括：接通单元1201、接收单元1202、第一验证单元1203、第二验证单元1204、第一协商单元1205和第一通信单元1206，其中，
接通单元1201，配置为接通主叫终端的来电呼叫；
接收单元1202，配置为接通单元1201接通主叫终端的来电呼叫之后，接收主叫终端发送的第一数字证书的标识；其中，第一数字证书为主叫终端的数字证书，与主叫终端的号码对应；
第一验证单元1203，配置为根据第一数字证书标识验证主叫终端的号码合法性；
第二验证单元1204，配置为通过主叫终端的号码验证主叫终端的身份合法性；
第一协商单元1205，配置为与主叫终端协商出通信密码；
第一通信单元1206，配置为通过第一协商单元1205协商出的通信密码与主叫终端进行加密通信。
本实施例中所述的被叫终端可为手机、平板电脑或数字通信终端或模拟通信终端等具有通信功能的通信终端设备。
所述接通单元1201、接收单元1202及第一通信单元1206对应的硬件结构可包括被叫终端的通信接口，如通信天线等结构。
所述第一验证单元1203、第二验证单元1204以及所述第一协商单元 1205对应的硬件结构都可包括具有信息处理的处理器。所述处理器通过对可执行代码的执行能够完成上述所述第一验证单元1203、第二验证单元1204以及所述第一协商单元1205对应的功能。
所述处理器可包括应用处理器AP、中央处理器CPU、微处理器MCU、中央处理器CPU、数字信号处理器DSP、可编程阵列PLC等具有信息处理功能的处理结构或处理芯片。
所述第一验证单元1203、第二验证单元1204以及所述第一协商单元1205可分别对应不同的处理器，也可以其中的任意两个对应相同的处理器。
示例性地，参见图13，被叫终端120还包括：第一发送单元1207，配置为向主叫终端发送第二数字证书标识；其中，第二数字证书为被叫终端120的数字证书，与被叫终端120的号码对应；第二数字证书标识用于使主叫终端获取第二数字证书和被叫终端120的公钥，并根据第二数字证书确定主叫终端的呼叫号码为被叫终端120的号码；
第二验证单元1204，还配置为通过被叫终端120自身的号码使主叫终端验证被叫终端120的身份合法性。
示例性地，第一验证单元1203，配置为：
根据第一数字证书的标识从认证中心获取第一数字证书；
以及，通过第一数字证书获取主叫终端的号码，并将主叫终端的号码与来电号码进行匹配；
以及，当主叫终端的号码与来电号码一致时，确定来电号码为主叫终端的号码。
基于上述方案，第二验证单元1204，配置为：
接收由主叫终端发送的原始第一验证数组，其中，原始第一验证数组包括主叫终端随机生成的第一随机数和被叫终端120的号码；
以及，通过被叫终端120自身的私钥对原始第一验证数组进行签名， 并将签名后的第一验证数组发送至主叫终端，其中，签名后的第一验证数组用于主叫终端根据获取的被叫终端120的公钥和签名后的第一验证数组验证被叫终端120的身份合法性；
基于上述方案，第二验证单元1204，配置为：
向主叫终端发送原始第二验证数组，其中，原始第二验证数组包括被叫终端120随机生成的第二随机数和主叫终端的号码；
以及，接收由主叫终端发送的签名后的第二验证数组，其中，签名后的第二验证数组由主叫终端通过自身的私钥对原始第二验证数组进行签名得到；
以及，根据从认证中心获取的主叫终端公钥对签名后的第二验证数组进行验证，得到验证后的第二验证数组；
以及，当验证后的第二验证数组与原始第二验证数组匹配时，确定主叫终端的身份合法。
可选地，第一协商单元1205，配置为：
随机生成通信密码，并通过主叫终端的公钥对通信密码进行加密，得到加密后的通信密码；
以及，将加密后的通信密码发送至主叫终端，加密后的通信密码用于主叫终端根据自身的私钥对加密后的通信密码进行解密后，得到通信密码。
可选地，第一协商单元1205，配置为：
接收由主叫终端发送的加密后的通信密码，其中，加密后的通信密码由主叫终端随机生成通信密码后，根据被叫终端120的公钥进行加密得到；
以及，根据被叫终端120自身的私钥对加密后的通信密码进行解密，得到通信密码。
示例性地，第一通信单元1206，配置为：
通过电话网络接收主叫终端发送的第一加密语音数据后，根据通信密 码对第一加密语音数据进行解密，得到第一语音数据；其中，第一语音数据为主叫终端采集的原始语音数据；
以及，根据通信密码将第二语音数据进行加密，得到第二加密语音数据；并通过电话网络将第二加密语音数据发送至主叫终端；其中，第二加密语音数据为被叫终端120采集的原始语音数据。
本实施例提供的被叫终端120，与主叫终端对对方的号码和身份合法性进行验证完毕后，再通过协商密码的方式进行通信加密和解密，能够防止主叫号码伪装以及通话内容被窃听的情况发生，提高通话的安全性。
基于前述实施例相同的技术构思，参见图14、其示出了本发明实施例提供的一种主叫终端140的结构，包括：呼叫发起单元1401、第二发送单元1402、第三验证单元1403、第四验证单元1404、第二协商单元1405和第二通信单元1406，其中，
呼叫发起单元1401，配置为向被叫终端发起呼叫；
第二发送单元1402，配置为于被叫终端接通呼叫后，向被叫终端发送第一数字证书的标识；其中，第一数字证书为主叫终端140的数字证书，与主叫终端140的号码对应；所述第一数字证书的标识用于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
第三验证单元1403，配置为根据被叫终端的第二数字证书的标识验证被叫终端的号码合法性；其中，第二数字证书为被叫终端的数字证书，与被叫终端的号码对应；
第四验证单元1404，配置为通过被叫终端的号码验证被叫终端的身份合法性；
第二协商单元1405，配置为与被叫终端协商出通信密码；
第二通信单元1406，配置为通过通信密码与被叫终端进行加密通信。
本实施例中所述的主叫终端可为手机、平板电脑或数字通信终端或模拟通信终端等具有通信功能的通信终端设备。
所述呼叫发起单元1401、第二发送单元1402及第二通信单元1406对应的硬件结构可包括被叫终端的通信接口，如通信天线等结构。
所述第三验证单元1403、第四验证单元1404以及第二协商单元1405对应的硬件结构都可包括具有信息处理的处理器。所述处理器通过对可执行代码的执行能够完成上述所述第一验证单元1203、第二验证单元1204以及所述第一协商单元1205对应的功能。
所述处理器可包括应用处理器AP、中央处理器CPU、微处理器MCU、中央处理器CPU、数字信号处理器DSP、可编程阵列PLC等具有信息处理功能的处理结构或处理芯片。
所述第三验证单元1403、第四验证单元1404以及第二协商单元1405以及所述第一协商单元1205可分别对应不同的处理器，也可以其中的任意两个对应相同的处理器。
示例性地，第四验证单元1404，还配置为通过主叫终端140自身的号码使被叫终端验证主叫终端140的身份合法性。
基于上述方案，第三验证单元1403，配置为：接收被叫终端发送的第二数字证书的标识，并根据第二数字证书的标识从认证中心获取第二数字证书；
以及，通过第二数字证书获取被叫终端的号码，并将被叫终端的号码与主叫终端140的呼叫号码进行匹配；
以及，当被叫终端的号码与呼叫号码一致时，确定呼叫号码为被叫终端的号码。
基于上述方案，第四验证单元1404，配置为：
向被叫终端发送原始第一验证数组；其中，原始第一验证数组包括主 叫终端140随机生成的第一随机数和被叫终端的号码；
以及，接收被叫终端返回的签名后的第一验证数组，其中，签名后的第一验证数组由被叫终端根据自身的私钥对原始第一验证数组进行加密得到；
以及，根据从认证中心获取的被叫终端的公钥对签名后的第一验证数组进行验证，得到验证后的第一验证数组；
以及，当验证后的第一验证数组与原始第一验证数组匹配时，确定被叫终端的身份合法；
基于上述方案，第四验证单元1404，还配置为：
接收由被叫终端发送的原始第二验证数组，其中，原始第二验证数组包括被叫终端随机生成的第二随机数和主叫终端140的号码；
以及，通过主叫终端140自身的私钥对原始第二验证数组进行签名，并将签名后的第二验证数组发送至被叫终端，其中，签名后的第二验证数组用于被叫终端根据获取的主叫终端140的公钥和签名后的第二验证数组验证主叫终端140的身份合法性。
可选地，第二协商单元1405，配置为：
随机生成通信密码，并通过被叫终端的公钥对通信密码进行加密，得到加密后的通信密码；
以及，将加密后的通信密码发送至被叫终端，加密后的通信密码用于被叫终端根据自身的私钥对加密后的通信密码进行解密后，得到通信密码。
可选地，第二协商单元1405，配置为：
接收由被叫终端发送的加密后的通信密码，其中，加密后的通信密码由被叫终端随机生成通信密码后，根据主叫终端140的公钥进行加密得到；
以及，根据主叫终端140自身的私钥对加密后的通信密码进行解密，得到通信密码。
示例性地，第二通信单元1406，配置为：
根据通信密码将第一语音数据进行加密，得到第一加密语音数据；并通过电话网络将第一加密语音数据发送至被叫终端；其中，第一语音数据为主叫终端140采集的原始语音数据；
以及，通过电话网络接收被叫终端发送的第二加密语音数据后，根据通信密码对第二加密语音数据进行解密，得到第二语音数据；其中，第二语音数据为被叫终端采集的原始语音数据。
本实施例提供的主叫终端140，与被叫终端对对方的号码和身份合法性进行验证完毕后，再通过协商密码的方式进行通信加密和解密，能够防止主叫号码伪装以及通话内容被窃听的情况发生，提高通话的安全性。
基于前述实施例相同的技术构思，参见图15，其示出了本发明实施例提供的一种安全通话的系统150结构，该系统150可以包括：被叫终端120和主叫终端140，其中，
被叫终端120，配置为：
接通主叫终端140的来电呼叫后，接收主叫终端140发送的第一数字证书的标识，并根据第一数字证书标识验证主叫终端140的号码合法性；其中，第一数字证书为主叫终端140的数字证书，与主叫终端140的号码对应；
以及，通过主叫终端140的号码验证主叫终端140的身份合法性；
以及，与主叫终端140协商出通信密码；
以及，通过通信密码与主叫终端140进行加密通信；
主叫终端140，配置为：
向被叫终端120发起来电呼叫且被叫终端120接通呼叫后，向被叫终端120发送第一数字证书的标识，其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用 于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
以及，根据被叫终端120的第二数字证书的标识和验证被叫终端120的号码合法性；其中，第二数字证书为被叫终端120的数字证书，与被叫终端120的号码对应；
以及，通过被叫终端120的号码验证被叫终端120的身份合法性；
以及，与被叫终端120协商出通信密码；
以及，通过通信密码与被叫终端120进行加密通信。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。
本发明实施例还提供一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行前述所述方法的至少其中之一。具体如，通过运行本实施例所述计算机存储介质中的可执行指令，能够实现图2至图11所示方法中至少一个。
本实施例所述的计算机存储介质可包括移动存储设备、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。在一些实施例中所述计算机存储介质为非瞬间存储介质，如ROM。
因此，本发明可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方 框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上，仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。凡按照本发明原理所作的修改，都应当理解为落入本发明的保护范围。

Claims (34)

  1. 一种安全通话的方法，所述方法应用于通话中的被叫终端，所述方法包括：
    所述被叫终端接通主叫终端的来电呼叫后，接收所述主叫终端发送的第一数字证书的标识，并根据所述第一数字证书标识验证所述主叫终端的号码合法性；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；
    所述被叫终端确定所述主叫终端的号码合法后，通过所述主叫终端的号码验证所述主叫终端的身份合法性；
    所述被叫终端确定所述主叫终端的身份合法后，所述被叫终端与所述主叫终端协商出通信密码；
    所述被叫终端通过所述通信密码与所述主叫终端进行加密通信。
  2. 根据权利要求1所述的方法，其中，所述方法还包括：
    所述被叫终端向所述主叫终端发送第二数字证书标识；其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；所述第二数字证书标识用于使所述主叫终端获取所述第二数字证书，并根据所述第二数字证书确定所述主叫终端的呼叫号码为所述被叫终端的号码；
    所述被叫终端通过自身的号码使所述主叫终端验证所述被叫终端的身份合法性。
  3. 根据权利要求1或2所述的方法，其中，所述被叫终端根据所述第一数字证书标识验证所述主叫终端的号码合法性，包括：
    所述被叫终端根据所述第一数字证书的标识从认证中心获取所述第一数字证书；
    所述被叫终端通过所述第一数字证书获取所述主叫终端的号码，并将所述主叫终端的号码与来电号码进行匹配；
    当所述主叫终端的号码与所述来电号码一致时，所述被叫终端确定所述来电号码为所述主叫终端的号码。
  4. 根据权利要求2所述的方法，其中，所述被叫终端通过自身的号码使所述主叫终端验证所述被叫终端的身份合法性，包括：
    所述被叫终端接收由所述主叫终端发送的原始第一验证数组，其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号码；
    所述被叫终端通过自身的私钥对所述原始第一验证数组进行签名，并将签名后的第一验证数组发送至所述主叫终端，其中，所述签名后的第一验证数组用于所述主叫终端根据获取的被叫终端的公钥和所述签名后的第一验证数组验证所述被叫终端的身份合法性。
  5. 根据权利要求3所述的方法，其中，所述被叫终端通过所述主叫终端的号码验证所述主叫终端的身份合法性，包括：
    所述被叫终端向所述主叫终端发送原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
    所述被叫终端接收由所述主叫终端发送的签名后的第二验证数组，其中，所述签名后的第二验证数组由所述主叫终端通过自身的私钥对所述原始第二验证数组进行签名得到；
    所述被叫终端根据从所述认证中心获取的主叫终端公钥对所述签名后的第二验证数组进行验证，得到验证后的第二验证数组；
    当所述验证后的第二验证数组与所述原始第二验证数组匹配时，所述被叫终端确定所述主叫终端的身份合法。
  6. 根据权利要求3所述的方法，其中，所述被叫终端与所述主叫终端协商出通信密码，包括：
    所述被叫终端随机生成通信密码，并通过所述主叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
    所述被叫终端将所述加密后的通信密码发送至所述主叫终端，所述加密后的通信密码用于所述主叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
  7. 根据权利要求3所述的方法，其中，所述被叫终端与所述主叫终端协商出通信密码，包括：
    所述被叫终端接收由所述主叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述主叫终端随机生成通信密码后，根据所述被叫终端的公钥进行加密得到；
    所述被叫终端根据自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
  8. 根据权利要求1或2所述的方法，其中，所述被叫终端通过所述通信密码与所述主叫终端进行加密通信，包括：
    所述被叫终端通过电话网络接收所述主叫终端发送的第一加密语音数据后，根据所述通信密码对所述第一加密语音数据进行解密，得到第一语音数据；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
    以及，所述被叫终端根据所述通信密码将第二语音数据进行加密，得到第二加密语音数据；并通过所述电话网络将所述第二加密语音数据发送至所述主叫终端；其中，所述第二加密语音数据为所述被叫终端采集的原始语音数据。
  9. 一种安全通话的方法，所述方法应用于通话中的主叫终端，所述方法包括：
    所述主叫终端向被叫终端发起呼叫且所述被叫终端接通呼叫后，向所述被叫终端发送第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
    所述主叫终端根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；
    所述主叫终端确定所述被叫终端的号码合法之后，所述主叫终端通过所述被叫终端的号码验证所述被叫终端的身份合法性；
    所述主叫终端确定所述被叫终端的身份合法之后，所述主叫终端与所述被叫终端协商出通信密码；
    所述主叫终端通过所述通信密码与所述被叫终端进行加密通信。
  10. 根据权利要求9所述的方法，其中，所述方法还包括：所述主叫终端通过自身的号码使所述被叫终端验证所述主叫终端的身份合法性。
  11. 根据权利要求9或10所述的方法，其中，所述主叫终端根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，包括：
    所述主叫终端接收所述被叫终端发送的第二数字证书的标识，并根据所述第二数字证书的标识从认证中心获取所述第二数字证书；
    所述主叫终端通过所述第二数字证书获取所述被叫终端的号码，并将所述被叫终端的号码与所述主叫终端的呼叫号码进行匹配；
    当所述被叫终端的号码与所述呼叫号码一致时，所述主叫终端确定所述呼叫号码为所述被叫终端的号码。
  12. 根据权利要求11所述的方法，其中，所述主叫终端通过所述被叫 终端的号码验证所述被叫终端的身份合法性，包括：
    所述主叫终端向所述被叫终端发送原始第一验证数组；其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号码；
    所述主叫终端接收所述被叫终端返回的签名后的第一验证数组，其中，所述签名后的第一验证数组由所述被叫终端根据自身的私钥对所述原始第一验证数组进行加密得到；
    所述主叫终端根据从所述认证中心获取的被叫终端的公钥对所述签名后的第一验证数组进行验证，得到验证后的第一验证数组；
    当所述验证后的第一验证数组与所述原始第一验证数组匹配时，所述主叫终端确定所述被叫终端的身份合法。
  13. 根据权利要求11所述的方法，其中，所述主叫终端通过自身的号码使所述被叫终端验证所述主叫终端的身份合法性，包括：
    所述主叫终端接收由所述被叫终端发送的原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
    所述主叫终端通过自身的私钥对所述原始第二验证数组进行签名，并将签名后的第二验证数组发送至所述被叫终端，其中，所述签名后的第二验证数组用于所述被叫终端根据获取的主叫终端的公钥和所述签名后的第二验证数组验证所述主叫终端的身份合法性。
  14. 根据权利要求11所述的方法，其中，所述主叫终端与所述被叫终端协商出通信密码，包括：
    所述主叫终端随机生成通信密码，并通过所述被叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
    所述主叫终端将所述加密后的通信密码发送至所述被叫终端，所述加 密后的通信密码用于所述被叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
  15. 根据权利要求11所述的方法，其中，所述主叫终端与所述被叫终端协商出通信密码，包括：
    所述主叫终端接收由所述被叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述被叫终端随机生成通信密码后，根据所述主叫终端的公钥进行加密得到；
    所述主叫终端根据自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
  16. 根据权利要求9所述的方法，其中，所述主叫终端通过所述通信密码与所述被叫终端进行加密通信，包括：
    所述主叫终端根据所述通信密码将第一语音数据进行加密，得到第一加密语音数据；并通过电话网络将所述第一加密语音数据发送至所述被叫终端；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
    以及，所述主叫终端通过所述电话网络接收所述被叫终端发送的第二加密语音数据后，根据所述通信密码对所述第二加密语音数据进行解密，得到第二语音数据；其中，所述第二语音数据为所述被叫终端采集的原始语音数据。
  17. 一种被叫终端，所述被叫终端包括：接通单元、接收单元、第一验证单元、第二验证单元、第一协商单元和第一通信单元，其中，
    所述接通单元，配置为接通主叫终端的来电呼叫；
    所述接收单元，配置为所述接通单元接通所述主叫终端的来电呼叫之后，接收所述主叫终端发送的第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；
    所述第一验证单元，配置为根据所述第一数字证书标识验证所述主叫 终端的号码合法性；
    所述第二验证单元，配置为通过所述主叫终端的号码验证所述主叫终端的身份合法性；
    所述第一协商单元，配置为与所述主叫终端协商出通信密码；
    所述第一通信单元，配置为通过所述第一协商单元协商出的通信密码与所述主叫终端进行加密通信。
  18. 根据权利要求17所述的被叫终端，其中，所述被叫终端还包括第一发送单元，配置为向所述主叫终端发送第二数字证书标识；其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；所述第二数字证书标识用于使所述主叫终端获取所述第二数字证书，并根据所述第二数字证书确定所述主叫终端的呼叫号码为所述被叫终端的号码；
    所述第二验证单元，还配置为于通过所述被叫终端自身的号码使所述主叫终端验证所述被叫终端的身份合法性。
  19. 根据权利要求17或18所述的被叫终端，其中，所述第一验证单元，配置为：
    根据所述第一数字证书的标识从认证中心获取所述第一数字证书；
    以及，通过所述第一数字证书获取所述主叫终端的号码，并将所述主叫终端的号码与所述来电号码进行匹配；
    以及，当所述主叫终端的号码与所述来电号码一致时，确定所述来电号码为所述主叫终端的号码。
  20. 根据权利要求18所述的被叫终端，其中，所述第二验证单元，配置为：
    接收由所述主叫终端发送的原始第一验证数组，其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号 码；
    以及，通过所述被叫终端自身的私钥对所述原始第一验证数组进行签名，并将签名后的第一验证数组发送至所述主叫终端，其中，所述签名后的第一验证数组用于所述主叫终端根据获取的被叫终端的公钥和所述签名后的第一验证数组验证所述被叫终端的身份合法性。
  21. 根据权利要求19所述的被叫终端，其中，所述第二验证单元，配置为：
    向所述主叫终端发送原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
    以及，接收由所述主叫终端发送的签名后的第二验证数组，其中，所述签名后的第二验证数组由所述主叫终端通过自身的私钥对所述原始第二验证数组进行签名得到；
    以及，根据从所述认证中心获取的主叫终端公钥对所述签名后的第二验证数组进行验证，得到验证后的第二验证数组；
    以及，当所述验证后的第二验证数组与所述原始第二验证数组匹配时，确定所述主叫终端的身份合法。
  22. 根据权利要求19所述的被叫终端，其中，所述第一协商单元，配置为：
    随机生成通信密码，并通过所述主叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
    以及，将所述加密后的通信密码发送至所述主叫终端，所述加密后的通信密码用于所述主叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
  23. 根据权利要求19所述的被叫终端，其中，所述第一协商单元，配置为：
    接收由所述主叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述主叫终端随机生成通信密码后，根据所述被叫终端的公钥进行加密得到；
    以及，根据所述被叫终端自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
  24. 根据权利要求17或18所述的被叫终端，其中，所述第一通信单元，配置为：
    通过电话网络接收所述主叫终端发送的第一加密语音数据后，根据所述通信密码对所述第一加密语音数据进行解密，得到第一语音数据；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
    以及，根据所述通信密码将第二语音数据进行加密，得到第二加密语音数据；并通过所述电话网络将所述第二加密语音数据发送至所述主叫终端；其中，所述第二加密语音数据为所述被叫终端采集的原始语音数据。
  25. 一种主叫终端，所述主叫终端，包括：呼叫发起单元、第二发送单元、第三验证单元、第四验证单元、第二协商单元和第二通信单元，其中，
    所述呼叫发起单元，配置为向被叫终端发起呼叫；
    所述第二发送单元，配置为所述被叫终端接通呼叫后，向所述被叫终端发送第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
    所述第三验证单元，配置为根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，其中，所述第二数字证书为所述被叫终端的数字证书，与所述被叫终端的号码对应；
    所述第四验证单元，配置为通过所述被叫终端的号码验证所述被叫终端的身份合法性；
    所述第二协商单元，配置为与所述被叫终端协商出通信密码；
    所述第二通信单元，配置为通过所述通信密码与所述被叫终端进行加密通信。
  26. 根据权利要求25所述的主叫终端，其中，所述第四验证单元，还用于：通过自身的号码使所述被叫终端验证所述主叫终端的身份合法性。
  27. 根据权利要求25或26所述的主叫终端，其中，所述第三验证单元，配置为接收所述被叫终端发送的第二数字证书的标识，并根据所述第二数字证书的标识从认证中心获取所述第二数字证书；
    以及，通过所述第二数字证书获取所述被叫终端的号码，并将所述被叫终端的号码与所述主叫终端的呼叫号码进行匹配；
    以及，当所述被叫终端的号码与所述呼叫号码一致时，确定所述呼叫号码为所述被叫终端的号码。
  28. 根据权利要求27所述的主叫终端，其中，所述第四验证单元，配置为：
    向所述被叫终端发送原始第一验证数组；其中，所述原始第一验证数组包括所述主叫终端随机生成的第一随机数和所述被叫终端的号码；
    以及，接收所述被叫终端返回的签名后的第一验证数组，其中，所述签名后的第一验证数组由所述被叫终端根据自身的私钥对所述原始第一验证数组进行加密得到；
    以及，根据从所述认证中心获取的被叫终端的公钥对所述签名后的第一验证数组进行验证，得到验证后的第一验证数组；
    以及，当所述验证后的第一验证数组与所述原始第一验证数组匹配时，确定所述被叫终端的身份合法。
  29. 根据权利要求27所述的主叫终端，其中，所述第四验证单元，配置为：
    接收由所述被叫终端发送的原始第二验证数组，其中，所述原始第二验证数组包括所述被叫终端随机生成的第二随机数和所述主叫终端的号码；
    以及，通过所述主叫终端自身的私钥对所述原始第二验证数组进行签名，并将签名后的第二验证数组发送至所述被叫终端，其中，所述签名后的第二验证数组用于所述被叫终端根据获取的主叫终端的公钥和所述签名后的第二验证数组验证所述主叫终端的身份合法性。
  30. 根据权利要求27所述的主叫终端，其中，所述第二协商单元，配置为：
    随机生成通信密码，并通过所述被叫终端的公钥对所述通信密码进行加密，得到加密后的通信密码；
    以及，将所述加密后的通信密码发送至所述被叫终端，所述加密后的通信密码用于所述被叫终端根据自身的私钥对所述加密后的通信密码进行解密后，得到所述通信密码。
  31. 根据权利要求27所述的主叫终端，其中，所述第二协商单元，配置为：
    接收由所述被叫终端发送的加密后的通信密码，其中，所述加密后的通信密码由所述被叫终端随机生成通信密码后，根据所述主叫终端的公钥进行加密得到；
    以及，根据所述主叫终端自身的私钥对所述加密后的通信密码进行解密，得到所述通信密码。
  32. 根据权利要求25所述的主叫终端，其中，所述第二通信单元，配置为：
    根据所述通信密码将第一语音数据进行加密，得到第一加密语音数据；并通过电话网络将所述第一加密语音数据发送至所述被叫终端；其中，所述第一语音数据为所述主叫终端采集的原始语音数据；
    以及，通过所述电话网络接收所述被叫终端发送的第二加密语音数据后，根据所述通信密码对所述第二加密语音数据进行解密，得到第二语音数据；其中，所述第二语音数据为所述被叫终端采集的原始语音数据。
  33. 一种安全通话的系统，其中，所述系统包括被叫终端和主叫终端，其中，
    所述被叫终端，配置为：接通主叫终端的来电呼叫后，接收所述主叫终端发送的第一数字证书的标识，并根据所述第一数字证书标识验证所述主叫终端的号码合法性；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；
    以及，确定所述主叫终端的号码合法后，通过所述主叫终端的号码验证所述主叫终端的身份合法性；
    以及，确定所述主叫终端的身份合法后，所述被叫终端与所述主叫终端协商出通信密码；
    以及，通过所述通信密码与所述主叫终端进行加密通信；
    所述主叫终端，配置为：
    向被叫终端发起呼叫且所述被叫终端接通呼叫后，向所述被叫终端发送第一数字证书的标识；其中，所述第一数字证书为所述主叫终端的数字证书，与所述主叫终端的号码对应；所述第一数字证书的标识用于所述被叫终端获取所述第一数字证书和所述主叫终端的公钥，并根据所述第一数字证书确定所述被叫终端的来电号码为所述主叫终端的号码；
    以及，根据所述被叫终端的第二数字证书的标识验证所述被叫终端的号码合法性，其中，所述第二数字证书为所述被叫终端的数字证书，与所 述被叫终端的号码对应；
    以及，确定所述被叫终端的号码合法之后，通过所述被叫终端的号码验证所述被叫终端的身份合法性；
    以及，确定所述被叫终端的身份合法之后，所述主叫终端与所述被叫终端协商出通信密码；
    以及，通过所述通信密码与所述被叫终端进行加密通信。
  34. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1至16所述方法的至少其中之一。
PCT/CN2015/082404 2014-12-17 2015-06-25 安全通话的方法、终端、系统和计算机存储介质 WO2016095473A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410789787.4A CN105790942A (zh) 2014-12-17 2014-12-17 一种安全通话的方法、终端和系统
CN201410789787.4 2014-12-17

Publications (1)

Publication Number Publication Date
WO2016095473A1 true WO2016095473A1 (zh) 2016-06-23

Family

ID=56125798

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/082404 WO2016095473A1 (zh) 2014-12-17 2015-06-25 安全通话的方法、终端、系统和计算机存储介质

Country Status (2)

Country Link
CN (1) CN105790942A (zh)
WO (1) WO2016095473A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113395392A (zh) * 2021-06-11 2021-09-14 哈尔滨海能达科技有限公司 一种呼叫接入控制的方法、系统、同播系统及终端

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109861946B (zh) * 2017-11-30 2021-07-23 中国电信股份有限公司 主叫号码验真的方法、系统以及呼叫接收设备
CN108966213A (zh) * 2018-07-18 2018-12-07 中国联合网络通信集团有限公司 加密通话方法、加密通话终端、加密通话平台及系统
CN111064692B (zh) * 2018-10-16 2022-06-14 中兴通讯股份有限公司 一种数据通信方法、终端及存储介质
CN110536001A (zh) * 2019-09-30 2019-12-03 维沃移动通信有限公司 一种通话方法及电子设备
CN111970407A (zh) * 2020-08-28 2020-11-20 深圳鑫想科技有限责任公司 一种有效预防电信诈骗的方法及系统
CN115037470A (zh) * 2021-03-03 2022-09-09 中国电信股份有限公司 主叫信息认证方法、装置和系统
CN114845301A (zh) * 2022-04-28 2022-08-02 微位（深圳）网络科技有限公司 基于超级sim卡的号码验证方法、终端及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090217039A1 (en) * 2008-02-05 2009-08-27 Sipera Systems, Inc. System, Method and Apparatus for Authenticating Calls
CN101569166A (zh) * 2006-12-29 2009-10-28 朗讯科技公司 验证主叫id信息以免遭主叫id欺骗
CN102802150A (zh) * 2012-07-23 2012-11-28 中国联合网络通信集团有限公司 手机号码验证方法、系统以及终端

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI108327B (fi) * 1996-12-23 2001-12-31 Nokia Corp Menetelmä yhteyden muodostamiseksi matkaviestinverkossa
JP2009253967A (ja) * 2008-04-10 2009-10-29 Tsutomu Tatsuzawa 共通キー暗号と公開キー暗号と認証との組み合わせにより電話機種に縛られない・設定の必要がない・つけるだけですぐに使える電話音声セキュリティ保護を実現する電話音声セキュリティ保護装置のアイディアと音声保護の方法。
CN103974241B (zh) * 2013-02-05 2018-01-16 东南大学常州研究院 一种面向Android系统移动终端的语音端到端加密方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101569166A (zh) * 2006-12-29 2009-10-28 朗讯科技公司 验证主叫id信息以免遭主叫id欺骗
US20090217039A1 (en) * 2008-02-05 2009-08-27 Sipera Systems, Inc. System, Method and Apparatus for Authenticating Calls
CN102802150A (zh) * 2012-07-23 2012-11-28 中国联合网络通信集团有限公司 手机号码验证方法、系统以及终端

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113395392A (zh) * 2021-06-11 2021-09-14 哈尔滨海能达科技有限公司 一种呼叫接入控制的方法、系统、同播系统及终端
CN113395392B (zh) * 2021-06-11 2022-08-05 哈尔滨海能达科技有限公司 一种呼叫接入控制的方法、系统、同播系统及终端

Also Published As

Publication number Publication date
CN105790942A (zh) 2016-07-20

Similar Documents

Publication Publication Date Title
WO2016095473A1 (zh) 安全通话的方法、终端、系统和计算机存储介质
CN110380852B (zh) 双向认证方法及通信系统
EP3723399A1 (en) Identity verification method and apparatus
WO2017114123A1 (zh) 一种密钥配置方法及密钥管理中心、网元
CN107358441B (zh) 支付验证的方法、系统及移动设备和安全认证设备
CN109302412B (zh) 基于CPK的VoIP通信处理方法、终端、服务器及存储介质
WO2018040758A1 (zh) 认证方法、认证装置和认证系统
CN108429620B (zh) 安全连接的建立方法、系统、以及客户端和服务端
CN105634737B (zh) 一种数据传输方法、终端及其系统
WO2019041802A1 (zh) 基于服务化架构的发现方法及装置
CN110635901B (zh) 用于物联网设备的本地蓝牙动态认证方法和系统
JP2018038068A (ja) 通信端末および関連システムのユーザーの識別情報を確認するための方法
CN112737774B (zh) 网络会议中的数据传输方法、装置及存储介质
CN112543166B (zh) 实名登录的方法及装置
KR20100061228A (ko) 영상 통화 수행 방법 및 장치
JP7497438B2 (ja) 証明書申請方法およびデバイス
CN112602290B (zh) 一种身份验证方法、装置和可读存储介质
CN112766962A (zh) 证书的接收、发送方法及交易系统、存储介质、电子装置
KR20110083886A (ko) 휴대용 단말기에서 다른 휴대용 단말기를 인증하는 장치 및 방법
US10671717B2 (en) Communication device, communication method and computer program
WO2016082401A1 (zh) 通话方法、装置、用户终端及计算机存储介质
US20210044968A1 (en) Trust extension in a secure communication framework
RU2016149497A (ru) Обеспечение безопасности связи с расширенными мультимедийными платформами
CN112311543A (zh) Gba的密钥生成方法、终端和naf网元
CN104243452A (zh) 一种云计算访问控制方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15868985

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15868985

Country of ref document: EP

Kind code of ref document: A1