WO2016179923A1 - 一种加密通话的处理方法、装置、终端及kmc - Google Patents

一种加密通话的处理方法、装置、终端及kmc Download PDF

Info

Publication number
WO2016179923A1
WO2016179923A1 PCT/CN2015/088147 CN2015088147W WO2016179923A1 WO 2016179923 A1 WO2016179923 A1 WO 2016179923A1 CN 2015088147 W CN2015088147 W CN 2015088147W WO 2016179923 A1 WO2016179923 A1 WO 2016179923A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
kmc
encrypted
key
negotiation
Prior art date
Application number
PCT/CN2015/088147
Other languages
English (en)
French (fr)
Inventor
闫海清
薛涛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016179923A1 publication Critical patent/WO2016179923A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a method, an apparatus, a terminal, and a KMC for processing an encrypted call.
  • the secret key (hard key or screen soft key) is usually used to initiate key negotiation to the Key Management Center (KMC). After the key negotiation is completed, both the calling party and the called party enter.
  • KMC Key Management Center
  • the voice encrypts the call process, but this process cannot prevent malicious use of the owner's phone and simulates the owner's voice to perform an encrypted call, which causes the owner's privacy to leak.
  • An object of the present invention is to provide a method, a device, a terminal, and a KMC for processing an encrypted call, which can prevent malicious use of the owner's phone and simulate the voice of the owner to perform an encrypted call to ensure the security of the call.
  • the present invention provides a method for processing an encrypted call, including:
  • the first terminal When detecting that the user initiates an encrypted call request by using the first terminal, the first terminal collects biometric information for identifying the identity of the user and performs encryption;
  • the KMC Receiving, by the KMC, a first negotiation success response message that is returned after the biometric information that is decrypted by the KMC and is compared with the pre-stored first biometric information, the first negotiation success response message carries
  • the KMC is a session key allocated by the session between the first terminal and the second terminal;
  • the receiving, by the KMC, the negotiation failure response message returned after the decryption of the encrypted biometric information and the biometric information corresponding to the pre-stored first terminal fails, further comprising: according to the negotiation A failure response message rejects the encrypted call request.
  • the method further includes:
  • the first terminal receives the encrypted call notification message sent by the KMC, so that the user initiates the encrypted call request according to the encrypted call notification message; wherein the encrypted call notification message is that the KMC is receiving the After the second key negotiation signaling sent by the second terminal is sent to the first terminal according to the called number information in the second key negotiation signaling, the first terminal is the same as the Call the terminal corresponding to the number information.
  • the step of performing an encrypted call according to the session key carried in the first negotiation success response message includes:
  • the first terminal performs signature verification on the first negotiation success response message by using a public key of the KMC;
  • the first negotiation success response message is decrypted by using the private key of the first terminal to obtain the session key, where the private key of the first terminal is the first terminal. Generating after detecting that the user initiates an encrypted call request by using the first terminal;
  • the biometric information is fingerprint information.
  • the present invention also provides an apparatus for processing an encrypted call, comprising:
  • the first processing module is configured to: when detecting that the user initiates an encrypted call request by using the first terminal, collecting, by the first terminal, biometric information for identifying an identity of the user, and performing encryption to obtain encrypted biometric information;
  • the first sending module is configured to send, to the key management center KMC, the first key agreement signaling that carries the encrypted biometric information;
  • a second processing module configured to receive a first negotiation success response message that is returned after the KMC decrypts the encrypted biometric information and compares the biometric information corresponding to the pre-stored first terminal, a negotiation success response message carries a session key assigned by the KMC to a session between the first terminal and the second terminal;
  • the encrypted call module is configured to perform an encrypted call according to the session key carried in the first negotiation success response message.
  • the foregoing processing device for the encrypted call further includes:
  • a third processing module configured to receive, after the step of transmitting the key agreement signaling carrying the encrypted biometric information to the KMC, the KMC to decrypt the encrypted biometric information and save the pre-saved
  • the biometric information corresponding to a terminal compares the negotiation failure response message returned after the failure
  • the fourth processing module is configured to reject the encrypted call request according to the negotiation failure response message.
  • the foregoing processing device for the encrypted call further includes:
  • the receiving module is configured to receive the encryption sent by the KMC before the step of collecting the biometric information of the user and encrypting the biometric information to obtain the encrypted biometric information after detecting that the user initiates the encrypted call request by using the first terminal a call notification message, so that the user initiates the encrypted call request according to the encrypted call notification message, where the encrypted call notification message is a second key negotiation message sent by the KMC to the second terminal.
  • the first terminal is a terminal corresponding to the called number information.
  • the encrypted call module includes:
  • An authentication module configured to perform signature verification on the first negotiation success response message by using a public key of the KMC
  • a decryption module configured to decrypt the first negotiation success response message by using a private key of the first terminal to obtain the session key, where the private key of the first terminal is The first terminal is generated after detecting that the user initiates an encrypted call request by using the first terminal;
  • the second sending module is configured to send, to the KMC, a first request message that is sent to the KMC and that is sent by the second terminal, and is sent by the KMC according to the first request message and the second terminal.
  • the second request message of the session key to enter the encrypted call, the first terminal and the second terminal are controlled to perform an encrypted call, where the second request message is that the second terminal receives the KMC
  • the biometric information is fingerprint information.
  • the present invention also provides a terminal comprising a processing device for an encrypted call as described above.
  • the present invention also provides a method for processing an encrypted call, which is applied to a key management center KMC, and includes:
  • the first key negotiation signaling carries the encrypted biometric information
  • the encrypted biometric information is that the first terminal detects that the user initiates When the call request is encrypted, the biometric information of the user is collected and encrypted
  • the comparison result is successful, returning a first negotiation success response message to the first terminal, where the first negotiation success message carries the KMC as a session between the first terminal and the second terminal.
  • the assigned session key causes the first terminal to perform an encrypted call according to the session key.
  • the foregoing processing method of the encrypted call further includes:
  • the comparison result is a failure, returning a negotiation failure response message to the first terminal, so that the first terminal rejects the encrypted call request according to the negotiation failure response message.
  • the method before the step of acquiring the first key agreement signaling sent by the first terminal, the method further includes:
  • the encrypted call notification message initiates the encrypted call request, wherein the first terminal is a terminal corresponding to the called number information.
  • the comparison result is successful, returning a first negotiation success response message to the first terminal, where the first negotiation success message carries the KMC as the first terminal and the first
  • the session key allocated by the session between the two terminals, so that the first terminal performs an encrypted call according to the session key includes:
  • the message is sent to the KMC.
  • the present invention also provides an apparatus for processing an encrypted call, which is applied to a key management center KMC, and includes:
  • An acquiring module configured to acquire first key agreement signaling sent by the first terminal, where the first key negotiation signaling carries encrypted biometric information, where the encrypted biometric information is the first
  • the terminal detects that the user initiates the encrypted call request, the terminal collects the biometric information of the user and performs encryption;
  • the comparison module is configured to decrypt the encrypted biometric information and compare the biometric information corresponding to the pre-stored first terminal to obtain a comparison result;
  • a fifth processing module configured to: when the comparison result is successful, return a first negotiation success response message to the first terminal, where the first negotiation success message carries the KMC as the first terminal and The session key assigned by the session between the second terminals causes the first terminal to perform an encrypted call according to the session key.
  • the foregoing processing device for the encrypted call further includes:
  • the sixth processing module is configured to: if the comparison result is a failure, return a negotiation failure response message to the first terminal, so that the first terminal rejects the encrypted call request according to the negotiation failure response message.
  • the foregoing processing device for the encrypted call further includes:
  • the seventh processing module is configured to acquire, after acquiring the first key negotiation signaling sent by the first terminal, the second key negotiation signaling sent by the second terminal, and according to the second key negotiation signaling
  • the called number information is sent to the first terminal to send an encrypted call notification message, so that the user initiates the encrypted call request according to the encrypted call notification message, where the first terminal is the called number
  • the terminal corresponding to the information.
  • the fifth processing module includes:
  • the first receiving unit is configured to receive a first request message that is sent by the first terminal according to the first negotiation success response message and that is sent to the encrypted call that carries the session key;
  • control unit configured to carry according to the first request message and the second terminal a second request message of the session key to enter an encrypted call, the first terminal is controlled to perform an encrypted call with the second terminal, where the second request message is received by the second terminal And sending, by the KMC, the second negotiation success response message returned by the second key negotiation signaling to the KMC.
  • the present invention also provides a key management center KMC comprising the processing device for the encrypted call applied to the KMC as described above.
  • the first terminal encrypts the collected biometric information to obtain encrypted biometric information, and sends a first key negotiation letter carrying the encrypted biometric information to the KMC.
  • the KMC compares the biometric information with the biometric information corresponding to the first terminal, and after the comparison succeeds, the first negotiation success response message is sent, and the terminal acquires the session key according to the first negotiation success response message. And encrypting the call according to the session key, preventing the illegal user from using the first terminal to perform an encrypted call, causing the privacy of the owner to leak, and ensuring the security of the call.
  • FIG. 1 is a flowchart of a first embodiment of a method for processing an encrypted call according to the present invention
  • FIG. 2 is an interaction flowchart of a second embodiment of a method for processing an encrypted call according to the present invention
  • FIG. 3 is a structural block diagram of a first embodiment of a processing apparatus for an encrypted call according to the present invention.
  • FIG. 4 is a flowchart of a third embodiment of a method for processing an encrypted call according to the present invention.
  • FIG. 5 is a structural block diagram of a second embodiment of a processing apparatus for an encrypted call according to the present invention.
  • FIG. 1 is a flowchart of a first embodiment of a method for processing an encrypted call according to the present invention. As shown in FIG. 1, the method includes:
  • Step 11 When detecting that the user initiates an encrypted call request by itself, the first terminal collects biometric information for identifying the identity of the user and performs encryption.
  • Step 12 Send the first key agreement signaling carrying the encrypted biometric information to the key management center KMC.
  • Step 13 Receive a first negotiation success response message that is returned after the KMC decrypts the encrypted biometric information and compares the biometric information corresponding to the pre-stored first terminal, and carries the KMC in the first negotiation success response message.
  • Step 14 Perform an encrypted call according to the session key carried in the first negotiation success response message.
  • the first terminal after detecting that the user initiates an encrypted call request by using the first terminal, the first terminal generates a pair of temporary public-private key pairs, and the first key negotiation signaling carries the temporary public key. , called number information, mobile device identification code, etc.
  • the first terminal encrypts the collected biometric information to obtain the encrypted biometric information, and sends the first key agreement signaling that carries the encrypted biometric information to the KMC.
  • the biometric information is compared with the biometric information corresponding to the first terminal by the KMC. After the comparison is successful, the first key negotiation success response message is sent, and the terminal negotiates the first key by using the temporary private key.
  • the successful response message is decrypted to obtain the session key, and the encrypted session is performed according to the session key, which effectively solves the problem that the illegal user uses the first terminal to perform an encrypted call, causing the owner to leak the privacy.
  • step 12 the method further includes:
  • the encrypted call request is rejected according to the negotiation failure response message.
  • step 11 the method further includes:
  • the first terminal receives the encrypted call notification message sent by the KMC, and the user is notified according to the encrypted call.
  • the message initiates the encrypted call request; wherein the encrypted call notification message is sent by the KMC according to the second key negotiation signaling after receiving the second key negotiation signaling sent by the second terminal.
  • the number information is sent to the first terminal, and the first terminal is a terminal corresponding to the called number information.
  • an encrypted call can be established during a plaintext call, and an encrypted call can be first established before the plaintext call is established, and the biometric information sent by the first terminal and the second terminal are verified by the KMC. After that, the KMC controls the first terminal and the second terminal to perform an encrypted call.
  • the biometric information may specifically be fingerprint information.
  • other biometric information such as facial image information, palm print information, and sound information may also be used. Do not give an example.
  • step 14 includes:
  • the first terminal performs signature verification on the first negotiation success response message by using a public key of the KMC;
  • the first negotiation success response message is decrypted by using the private key of the first terminal to obtain the session key, where the private key of the first terminal is the first terminal. Generating after detecting that the user initiates an encrypted call request by using the first terminal;
  • the biometric information as the fingerprint information
  • the first terminal is the calling party
  • the second terminal is the called party.
  • FIG. 2 is an interaction flowchart of a second embodiment of a method for processing an encrypted call according to the present invention. As shown in FIG. 2, the method includes:
  • Step 20 The first terminal and the second terminal establish a plaintext (ordinary) call
  • Step 21 After the user presses the encrypted call button on the first terminal, the first terminal generates a pair of Pro Public-private key pair;
  • Step 22 The first terminal collects the fingerprint information of the user, and encrypts the fingerprint information, the temporary public key, the mobile device identification code, and the like by using the public key K0 of the KMC, and adds the encrypted information to the first key negotiation letter. Order and send it to KMC;
  • Step 23 The KMC decrypts the first key agreement signaling by using K0, and obtains the temporary public key of the first terminal, the mobile device identification code, the called number information, and the fingerprint information and the like;
  • Step 24 Send an encrypted call notification message to the second terminal according to the called number information, so that the second terminal sends a second key negotiation signaling to the KMC to perform key agreement with the KMC according to the encrypted call notification message.
  • Step 25 The KMC compares the decrypted fingerprint information with the fingerprint information bound to the mobile device identification code. If the fingerprint information is successfully matched, the first negotiation success response message is sent; if not, the negotiation failure response is sent. Message
  • Step 26 It is assumed that the first terminal receives the first negotiation success response message sent by the KMC.
  • Step 27 The first terminal performs signature verification by using the KMC public key K0. After the verification is passed, the session key is decrypted by using the temporary private key, and the temporary public-private key pair and the fingerprint information are destroyed.
  • Step 28 The second terminal receives a second negotiation success response message sent after the KMC compares successfully.
  • Step 29 The second terminal obtains the session key according to the second negotiation success response message, wherein the process of performing key agreement between the second terminal and the KMC is the same as the process of performing key agreement between the first terminal and the KMC. ;
  • Step 210 The first terminal and the second terminal respectively send, to the KMC, a request message for entering an encrypted call that carries the session key.
  • Step 211 The KMC controls the first terminal and the second terminal to enter an encrypted call, and initiates an encrypted call establishment success prompt.
  • the method for processing an encrypted call in the embodiment of the present invention introduces a scheme for fingerprint encryption key negotiation in a mobile terminal device having a fingerprint sensor, which solves the defect that the current encrypted call cannot prevent the malicious host from performing an encrypted call, and greatly improves the defect. user experience.
  • FIG. 3 is a structural block diagram of a first embodiment of an apparatus for processing an encrypted call according to the present invention. As shown in FIG. 3, the method includes:
  • the first processing module 31 is configured to: when the first terminal detects that the user initiates by using the first terminal Encrypting the call request, collecting biometric information for identifying the identity of the user, and performing encryption to obtain encrypted biometric information;
  • the first sending module 32 is configured to send, to the key management center KMC, first key negotiation signaling that carries the encrypted biometric information;
  • the second processing module 33 is configured to receive a first negotiation success response message that is returned after the KMC decrypts the encrypted biometric information and compares the biometric information corresponding to the pre-saved first terminal,
  • the first negotiation success response message carries the session key assigned by the KMC to the session between the first terminal and the second terminal;
  • the encrypted call module 34 is configured to perform an encrypted call according to the session key carried in the first negotiation success response message.
  • a third processing module configured to receive, after the step of transmitting the key agreement signaling carrying the encrypted biometric information to the KMC, the KMC to decrypt the encrypted biometric information and save the pre-saved
  • the biometric information corresponding to a terminal compares the negotiation failure response message returned after the failure
  • the fourth processing module is configured to reject the encrypted call request according to the negotiation failure response message.
  • the receiving module is configured to receive the encryption sent by the KMC before the step of collecting the biometric information of the user and encrypting the biometric information to obtain the encrypted biometric information after detecting that the user initiates the encrypted call request by using the first terminal a call notification message, so that the user initiates the encrypted call request according to the encrypted call notification message, where the encrypted call notification message is a second key negotiation message sent by the KMC to the second terminal.
  • the first terminal is a terminal corresponding to the called number information.
  • the encrypted call module 34 specifically includes:
  • An authentication module configured to perform signature verification on the first negotiation success response message by using a public key of the KMC
  • Decrypting module configured to use the private key of the first terminal to use the first
  • the negotiation success response message is decrypted to obtain the session key, wherein the private key of the first terminal is generated by the first terminal after detecting that the user initiates an encrypted call request by using the first terminal;
  • the second sending module is configured to send, to the KMC, a first request message that is sent to the KMC and that is sent by the second terminal, and is sent by the KMC according to the first request message and the second terminal.
  • the second request message of the session key to enter the encrypted call, the first terminal and the second terminal are controlled to perform an encrypted call, where the second request message is that the second terminal receives the KMC And sending, according to the second negotiation success response message returned by the second key negotiation signaling, to the KMC.
  • the biometric information is fingerprint information.
  • Embodiments of the present invention also provide a terminal, including the processing device for an encrypted call as described above.
  • terminal and the device are the terminals and devices corresponding to the foregoing method embodiments. All the implementation manners in the foregoing method embodiments are applicable to the device and the terminal embodiment, and the same technical effects can be achieved.
  • FIG. 4 is a flowchart of a third embodiment of a method for processing an encrypted call according to the present invention.
  • the method is applied to a key management center KMC. As shown in FIG. 4, the method includes:
  • Step 41 Acquire first key negotiation signaling sent by the first terminal, where the first key negotiation signaling carries encrypted biometric information, where the encrypted biometric information is detected by the first terminal.
  • the biometric information of the user is collected and encrypted;
  • Step 42 Decrypt the encrypted biometric information and compare with the biometric information corresponding to the first terminal saved in advance to obtain a comparison result;
  • Step 43 If the comparison result is successful, return a first negotiation success response message to the first terminal, where the first negotiation success message carries the KMC as the first terminal and the second terminal.
  • the session key assigned by the session is such that the first terminal performs an encrypted call according to the session key.
  • the KMC compares the fingerprint information of the owner fingerprint information with the mobile device identification code, thereby effectively solving the problem that the current encrypted call cannot prevent the evil.
  • the deficiencies of the main charger for encrypted calls greatly enhance the user experience.
  • the comparison result is a failure, returning a negotiation failure response message to the first terminal, so that the first terminal rejects the encrypted call request according to the negotiation failure response message.
  • the method for processing the encrypted call in the embodiment of the present invention, before the step of acquiring the first key negotiation signaling sent by the first terminal, further includes:
  • the encrypted call notification message initiates the encrypted call request, wherein the first terminal is a terminal corresponding to the called number information.
  • the method for processing an encrypted call according to the embodiment of the present invention if the comparison result is successful, returning a first negotiation success response message to the first terminal, where the first negotiation success message carries the KMC as
  • the step of the session key allocated by the session between the first terminal and the second terminal, so that the first terminal performs an encrypted call according to the session key includes:
  • the first terminal controlling the first terminal to perform an encrypted call with the second terminal according to the first request message and the second request message that is sent by the second terminal and that is configured to enter the encrypted call.
  • the second request message is sent by the second terminal to the KMC after receiving the second negotiation success response message returned by the KMC according to the second key negotiation signaling.
  • FIG. 5 is a structural block diagram of a second embodiment of an apparatus for processing an encrypted call according to the present invention. The method is applied to a key management center KMC. As shown in FIG. 5, the method includes:
  • the obtaining module 51 is configured to acquire the first key negotiation signaling sent by the first terminal, where the first key negotiation signaling carries the encrypted biometric information, where the encrypted biometric information is the When the terminal detects that the user initiates the encrypted call request, the terminal collects the biometric information of the user and performs encryption;
  • the comparison module 52 is configured to decrypt the encrypted biometric information and compare the biometric information corresponding to the pre-stored first terminal to obtain a comparison result;
  • the fifth processing module 53 is configured to: if the comparison result is successful, return to the first terminal Returning to the first negotiation success response message, where the first negotiation success message carries the session key assigned by the KMC to the session between the first terminal and the second terminal, so that the first terminal is dense according to the session The key is used to encrypt the call.
  • the sixth processing module is configured to: if the comparison result is a failure, return a negotiation failure response message to the first terminal, so that the first terminal rejects the encrypted call request according to the negotiation failure response message.
  • the seventh processing module is configured to acquire, after acquiring the first key negotiation signaling sent by the first terminal, the second key negotiation signaling sent by the second terminal, and according to the second key negotiation signaling
  • the called number information is sent to the first terminal to send an encrypted call notification message, so that the user initiates the encrypted call request according to the encrypted call notification message, where the first terminal is the called number
  • the terminal corresponding to the information.
  • the fifth processing module 53 includes:
  • the first receiving unit is configured to receive a first request message that is sent by the first terminal according to the first negotiation success response message and that is sent to the encrypted call that carries the session key;
  • control unit configured to control the first terminal and the second terminal according to the first request message and a second request message that is sent by the second terminal to enter an encrypted call that carries the session key And the second request message is sent by the second terminal to the KMC after receiving the second negotiation success response message returned by the KMC according to the second key negotiation signaling.
  • Embodiments of the present invention also provide a key management center including a processing device for an encrypted call applied to a KMC as described above.
  • the method, device, terminal and KMC for processing the encrypted call use the fingerprint sensor to input the main fingerprint of the machine, and add the fingerprint information of the owner's fingerprint information to the key agreement signaling, and the fingerprint information is encrypted by using the public key K0 of the KMC.
  • the cipher text is sent to the KMC for key encryption negotiation.
  • the KMC uses the K0 decryption to obtain the plaintext information of the fingerprint information in the key request, and compares the fingerprint information bound by the user mobile device identification code to determine the legitimacy of the user.
  • the terminal receives the key negotiation success response message sent by the KMC, and then uses the KMC public key K0.
  • the session key Ks is decrypted by using the temporary private key, and the encrypted call request is initiated (the message content includes the session key), thereby completing the encryption process of the key negotiation through the fingerprint information, and entering a more private The call process.
  • the method, device, terminal and KMC for processing an encrypted call include: when the first terminal detects that the user initiates an encrypted call request, the first terminal collects biometric information for identifying the identity of the user and performs encryption. Obtaining the encrypted biometric information; transmitting, to the key management center KMC, the first key agreement signaling carrying the encrypted biometric information; the receiving KMC decrypting the encrypted biometric information and corresponding to the pre-saved first terminal.
  • the biometric information is compared with the first negotiation success response message returned after the success, the first negotiation success response message carries the session key allocated by the KMC as the session between the first terminal and the second terminal; and the response is successfully responded according to the first negotiation.
  • the session key carried in the message is used to encrypt the call.
  • the technical solution provided by the embodiment of the present invention prevents an illegal user from using the first terminal to perform an encrypted call, which causes a problem of leakage of the owner's privacy, and ensures the security of the call.

Abstract

一种加密通话的处理方法、装置、终端及KMC，本发明实施例包括：第一终端在检测到用户发起加密通话请求时，采集用于标识用户身份的生物特征信息并进行加密，得到加密的生物特征信息；向密钥管理中心KMC发送携带有加密的生物特征信息的第一密钥协商信令；接收KMC在对加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，第一协商成功响应消息携带有KMC为第一终端和第二终端之间的会话分配的会话密钥；根据第一协商成功响应消息中携带的会话密钥进行加密通话。本发明实施例提供的技术方案，防止了非法用户使用第一终端进行加密通话，造成机主隐私泄露的问题，保证了通话的安全性。

Description

一种加密通话的处理方法、装置、终端及KMC 技术领域
本发明实施例涉及通信技术领域，尤指一种加密通话的处理方法、装置、终端及KMC。
背景技术
移动终端需要进行加密通话时，通常使用密话按键(硬键或屏幕软键)发起向密钥管理中心(KMC，Key Mangerment center)的密钥协商，完成密钥协商后，主被叫双方进入语音加密通话过程，但此过程无法防止恶意使用机主电话，模仿机主声音进行加密通话，造成了机主隐私泄漏的问题。
发明内容
本发明的目的在于提供一种加密通话的处理方法、装置、终端及KMC，能够防止恶意使用机主电话，模仿机主声音进行加密通话，保证通话的安全性。
为了实现上述目的，本发明提供了一种加密通话的处理方法，包括：
第一终端在检测到用户通过所述第一终端发起加密通话请求时，采集用于标识所述用户的身份的生物特征信息并进行加密；
向密钥管理中心KMC发送携带有所述加密的生物特征信息的第一密钥协商信令；
接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，所述第一协商成功响应消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥；
根据所述第一协商成功响应消息中携带的所述会话密钥进行加密通话。
可选地，如果接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对失败后返回的协商失败响应消息；还包括：根据所述协商失败响应消息，拒绝所述加密通话请求。
可选地，该方法之前还包括：
所述第一终端接收所述KMC发送的加密通话通知消息，使得所述用户根据所述加密通话通知消息发起所述加密通话请求；其中，所述加密通话通知消息为所述KMC在接收到所述第二终端发送的第二密钥协商信令后，根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送的，所述第一终端为与所述被叫号码信息对应的终端。
可选地，所述根据所述第一协商成功响应消息中携带的所述会话密钥进行加密通话的步骤包括：
所述第一终端通过所述KMC的公钥对所述第一协商成功响应消息进行签名认证；
若认证通过，则利用所述第一终端的私钥对所述第一协商成功响应消息进行解密处理，得到所述会话密钥，其中，所述第一终端的私钥为所述第一终端在检测到用户通过所述第一终端发起加密通话请求后生成的；
向所述KMC发送携带有所述会话密钥的进入加密通话的第一请求消息，由所述KMC根据所述第一请求消息和所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端和所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
可选地，所述生物特征信息为指纹信息。
本发明还提供了一种加密通话的处理装置，包括：
第一处理模块，设置为第一终端在检测到用户通过所述第一终端发起加密通话请求时，采集用于标识所述用户的身份的生物特征信息并进行加密，得到加密的生物特征信息；
第一发送模块，设置为向密钥管理中心KMC发送携带有所述加密的生物特征信息的第一密钥协商信令；
第二处理模块，设置为接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，所述第一协商成功响应消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥；
加密通话模块，设置为根据所述第一协商成功响应消息中携带的所述会话密钥进行加密通话。
可选地，上述的加密通话的处理装置，还包括：
第三处理模块，设置为在向KMC发送携带有所述加密的生物特征信息的密钥协商信令的步骤之后，接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对失败后返回的协商失败响应消息；
第四处理模块，设置为根据所述协商失败响应消息，拒绝所述加密通话请求。
可选地，上述的加密通话的处理装置，还包括：
接收模块，设置为在检测到用户通过所述第一终端发起加密通话请求时，采集所述用户的生物特征信息并进行加密，得到加密的生物特征信息的步骤之前，接收所述KMC发送的加密通话通知消息，使得所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述加密通话通知消息为所述KMC在接收到所述第二终端发送的第二密钥协商信令后，根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送的，所述第一终端为与所述被叫号码信息对应的终端。
可选地，所述加密通话模块包括：
认证模块，设置为通过所述KMC的公钥对所述第一协商成功响应消息进行签名认证；
解密模块，设置为若认证通过，则利用所述第一终端的私钥对所述第一协商成功响应消息进行解密处理，得到所述会话密钥，其中，所述第一终端的私钥为所述第一终端在检测到用户通过所述第一终端发起加密通话请求后生成的；
第二发送模块，设置为向所述KMC发送携带有所述会话密钥的进入加密通话的第一请求消息，由所述KMC根据所述第一请求消息和所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端和所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消 息后，向所述KMC发送的。
可选地，所述生物特征信息为指纹信息。
本发明还提供了一种终端，包括如上所述的加密通话的处理装置。
本发明还提供了一种加密通话的处理方法，应用于密钥管理中心KMC，包括：
获取第一终端发送的第一密钥协商信令，所述第一密钥协商信令携带有加密的生物特征信息，其中，所述加密的生物特征信息为所述第一终端检测到用户发起加密通话请求时，采集所述用户的生物特征信息并进行加密得到的；
对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息进行比对，得出一比对结果；
若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话。
可选地，上述的加密通话的处理方法，还包括：
若所述比对结果为失败，则向所述第一终端返回协商失败响应消息，使所述第一终端根据所述协商失败响应消息，拒绝所述加密通话请求。
可选地，在获取第一终端发送的第一密钥协商信令的步骤之前还包括：
获取第二终端发送的第二密钥协商信令，并根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送加密通话通知消息，使所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述第一终端为与所述被叫号码信息对应的终端。
可选地，所述若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话的步骤包括：
接收所述第一终端根据所述第一协商成功响应消息返回的携带有所述会话密钥的进入加密通话的第一请求消息；
根据所述第一请求消息以及所述第二终端发送的携带有所述会话密钥的 进入加密通话的第二请求消息，控制所述第一终端与所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
本发明还提供了一种加密通话的处理装置，应用于密钥管理中心KMC，包括：
获取模块，设置为获取第一终端发送的第一密钥协商信令，所述第一密钥协商信令携带有加密的生物特征信息，其中，所述加密的生物特征信息为所述第一终端检测到用户发起加密通话请求时，采集所述用户的生物特征信息并进行加密得到的；
比对模块，设置为对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息进行比对，得出一比对结果；
第五处理模块，设置为若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话。
可选地，上述的加密通话的处理装置，还包括：
第六处理模块，设置为若所述比对结果为失败，则向所述第一终端返回协商失败响应消息，使所述第一终端根据所述协商失败响应消息，拒绝所述加密通话请求。
可选地，上述的加密通话的处理装置，还包括：
第七处理模块，设置为在获取第一终端发送的第一密钥协商信令的步骤之前，获取第二终端发送的第二密钥协商信令，并根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送加密通话通知消息，使所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述第一终端为与所述被叫号码信息对应的终端。
可选地，所述第五处理模块包括：
第一接收单元，设置为接收所述第一终端根据所述第一协商成功响应消息返回的携带有所述会话密钥的进入加密通话的第一请求消息；
控制单元，设置为根据所述第一请求消息以及所述第二终端发送的携带 有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端与所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
本发明还提供了一种密钥管理中心KMC，包括如上所述的应用于KMC的加密通话的处理装置。
本发明实施例具有以下有益效果：
本发明实施例的加密通话的处理方法，首先第一终端将采集到的生物特征信息进行加密，得到加密的生物特征信息；向KMC发送携带所述加密的生物特征信息的第一密钥协商信令，由KMC将所述生物特征信息与第一终端对应的生物特征信息进行比对，比对成功后，发送第一协商成功响应消息，终端根据所述第一协商成功响应消息获取会话密钥，并根据会话密钥进行加密通话，防止了非法用户使用第一终端进行加密通话，造成机主隐私泄露的问题，保证了通话的安全性。
附图概述
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为本发明加密通话的处理方法的第一实施例的流程图；
图2为本发明加密通话的处理方法的第二实施例的交互流程图；
图3为本发明加密通话的处理装置的第一实施例的结构框图；
图4为本发明加密通话的处理方法的第三实施例的工作流程图；
图5为本发明加密通话的处理装置的第二实施例的结构框图。
本发明的较佳实施方式
为使本发明实施例的目的、技术方案和优点更加清楚明白，下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
以下结合附图对本发明进行详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不限定本发明。
图1为本发明加密通话的处理方法的第一实施例的流程图，如图1所示，包括：
步骤11：第一终端在检测到用户通过自身发起加密通话请求时，采集用于标识该用户的身份的生物特征信息并进行加密。
步骤12：向密钥管理中心KMC发送携带有加密的生物特征信息的第一密钥协商信令。
步骤13：接收KMC在对加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，在第一协商成功响应消息中携带有KMC为第一终端和第二终端之间的会话所分配的会话密钥。
步骤14：根据第一协商成功响应消息中携带的会话密钥进行加密通话。
在本发明的具体实施例中，在检测到用户通过第一终端发起加密通话请求后，第一终端产生一对临时公私钥对，且所述第一密钥协商信令中携带有临时公钥，被叫号码信息以及移动设备识别码等。
本发明实施例的加密通话的处理方法，第一终端将采集到的生物特征信息进行加密，得到加密的生物特征信息；向KMC发送携带所述加密的生物特征信息的第一密钥协商信令，由KMC将所述生物特征信息与第一终端对应的生物特征信息进行比对，比对成功后，发送第一密钥协商成功响应消息，终端使用临时私钥对所述第一密钥协商成功响应消息进行解密获取会话密钥，并根据会话密钥进行加密通话，有效解决了非法用户使用第一终端进行加密通话，造成机主隐私泄露的问题。
进一步地，在步骤12之后，还包括：
接收KMC在对加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对失败后返回的协商失败响应消息；
根据所述协商失败响应消息，拒绝加密通话请求。
进一步地，在步骤11之前还包括：
第一终端接收KMC发送的加密通话通知消息，用户根据加密通话通知 消息发起所述加密通话请求；其中，加密通话通知消息为所述KMC在接收到所述第二终端发送的第二密钥协商信令后，根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送的，所述第一终端为与所述被叫号码信息对应的终端。
在本发明的具体实施例中，即可在明文通话过程中建立加密通话，也可在建立明文通话之前首先建立加密通话，当第一终端和第二终端发送的生物特征信息均通过KMC的验证后，KMC控制第一终端和第二终端进行加密通话。
在本发明的具体实施例中，所述生物特征信息具体可以为指纹信息，当然在本发明的具体实施例中也可为面像信息、掌纹信息、声音信息等其他生物特征信息，在此不一一举例说明。
进一步地，所述步骤14包括：
所述第一终端通过所述KMC的公钥对所述第一协商成功响应消息进行签名认证；
若认证通过，则利用所述第一终端的私钥对所述第一协商成功响应消息进行解密处理，得到所述会话密钥，其中，所述第一终端的私钥为所述第一终端在检测到用户通过所述第一终端发起加密通话请求后生成的；
向所述KMC发送携带有所述会话密钥的进入加密通话的第一请求消息，由所述KMC根据所述第一请求消息和所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端和所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
下面以所述生物特征信息为指纹信息，所述第一终端为主叫，所述第二终端为被叫为例，来说明本发明实施例的具体实现过程。
图2为本发明加密通话的处理方法的第二实施例的交互流程图，如图2所示，包括：
步骤20：第一终端和第二终端建立明文(普通)通话；
步骤21：用户在第一终端上按下加密通话按键后，第一终端产生一对临 时公私钥对；
步骤22：第一终端采集用户的指纹信息，并使用KMC的公钥K0对所述指纹信息、临时公钥、移动设备识别码等进行加密，将加密后的信息添加到第一密钥协商信令中，并发送给KMC；
步骤23：KMC使用K0对第一密钥协商信令进行解密，得到第一终端的临时公钥，移动设备识别码、被叫号码信息以及指纹信息等明文；
步骤24：根据被叫号码信息向第二终端发送加密通话通知消息，使得第二终端根据所述加密通话通知消息向所述KMC发送第二密钥协商信令与KMC进行密钥协商；
步骤25：KMC将解密得到的指纹信息与所述移动设备识别码绑定的指纹信息进行比对，如果指纹信息比对成功，则发送第一协商成功响应消息；如果不成功，发送协商失败响应消息；
步骤26：假设第一终端收到KMC发送的第一协商成功响应消息；
步骤27：第一终端用KMC的公钥K0进行签名验证，验证通过后，再利用临时私钥解密得到会话密钥，同时销毁临时公私钥对和指纹信息；
步骤28：第二终端收到KMC比对成功后发送的第二协商成功响应消息；
步骤29：第二终端根据所述第二协商成功响应消息得到所述会话密钥，其中，所述第二终端与KMC进行密钥协商的过程与第一终端和KMC进行密钥协商的过程相同；
步骤210：第一终端和第二终端分别向KMC发送携带有所述会话密钥的进入加密通话的请求消息；
步骤211：KMC控制第一终端和第二终端进入加密通话，并启动加密通话建立成功提示。
本发明实施例的加密通话的处理方法，在具备指纹传感器的移动终端设备中引入指纹加密密钥协商的方案，解决了当前加密通话无法防止恶意冒充机主进行加密通话的缺陷，极大地提升了用户体验。
图3为本发明加密通话的处理装置的第一实施例的结构框图，如图3所示，包括：
第一处理模块31，设置为第一终端在检测到用户通过所述第一终端发起 加密通话请求时，采集用于标识所述用户身份的生物特征信息并进行加密，得到加密的生物特征信息；
第一发送模块32，设置为向密钥管理中心KMC发送携带有所述加密的生物特征信息的第一密钥协商信令；
第二处理模块33，设置为接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，所述第一协商成功响应消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥；
加密通话模块34，设置为根据所述第一协商成功响应消息中携带的所述会话密钥进行加密通话。
本发明实施例的加密通话的处理装置，还包括：
第三处理模块，设置为在向KMC发送携带有所述加密的生物特征信息的密钥协商信令的步骤之后，接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对失败后返回的协商失败响应消息；
第四处理模块，设置为根据所述协商失败响应消息，拒绝所述加密通话请求。
本发明实施例的加密通话的处理装置，还包括：
接收模块，设置为在检测到用户通过所述第一终端发起加密通话请求时，采集所述用户的生物特征信息并进行加密，得到加密的生物特征信息的步骤之前，接收所述KMC发送的加密通话通知消息，使得所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述加密通话通知消息为所述KMC在接收到所述第二终端发送的第二密钥协商信令后，根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送的，所述第一终端为与所述被叫号码信息对应的终端。
本发明实施例的加密通话的处理装置，所述加密通话模块34具体包括：
认证模块，设置为通过所述KMC的公钥对所述第一协商成功响应消息进行签名认证；
解密模块，设置为若认证通过，则利用所述第一终端的私钥对所述第一 协商成功响应消息进行解密处理，得到所述会话密钥，其中，所述第一终端的私钥为所述第一终端在检测到用户通过所述第一终端发起加密通话请求后生成的；
第二发送模块，设置为向所述KMC发送携带有所述会话密钥的进入加密通话的第一请求消息，由所述KMC根据所述第一请求消息和所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端和所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
本发明实施例的加密通话的处理装置，所述生物特征信息为指纹信息。
本发明的实施例还提供了一种终端，包括如上所述的加密通话的处理装置。
需要说明的是该终端与装置是与上述方法实施例对应的终端和装置，上述方法实施例中所有实现方式均适用于该装置和终端的实施例中，也能达到相同的技术效果。
图4为本发明加密通话的处理方法的第三实施例的工作流程图，应用于密钥管理中心KMC，如图4所示，包括：
步骤41：获取第一终端发送的第一密钥协商信令，所述第一密钥协商信令携带有加密的生物特征信息，其中，所述加密的生物特征信息为所述第一终端检测到用户发起加密通话请求时，采集所述用户的生物特征信息并进行加密得到的；
步骤42：对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息进行比对，得出一比对结果；
步骤43：若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话。
本发明实施例的加密通话的处理方法，KMC通过将机主指纹信息与移动设备识别码绑定的指纹信息进行比对，有效解决了当前加密通话无法防止恶 意冒充机主进行加密通话的缺陷，极大地提升了用户体验。
本发明实施例的加密通话的处理方法，还包括：
若所述比对结果为失败，则向所述第一终端返回协商失败响应消息，使所述第一终端根据所述协商失败响应消息，拒绝所述加密通话请求。
本发明实施例的加密通话的处理方法，在获取第一终端发送的第一密钥协商信令的步骤之前还包括：
获取第二终端发送的第二密钥协商信令，并根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送加密通话通知消息，使所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述第一终端为与所述被叫号码信息对应的终端。
本发明实施例的加密通话的处理方法，所述若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话的步骤包括：
接收所述第一终端根据所述第一协商成功响应消息返回的携带有所述会话密钥的进入加密通话的第一请求消息；
根据所述第一请求消息以及所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端与所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
图5为本发明加密通话的处理装置的第二实施例的结构框图，应用于密钥管理中心KMC，如图5所示，包括：
获取模块51，设置为获取第一终端发送的第一密钥协商信令，所述第一密钥协商信令携带有加密的生物特征信息，其中，所述加密的生物特征信息为所述第一终端检测到用户发起加密通话请求时，采集所述用户的生物特征信息并进行加密得到的；
比对模块52，设置为对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息进行比对，得出一比对结果；
第五处理模块53，设置为若所述比对结果为成功，则向所述第一终端返 回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话。
本发明实施例的加密通话的处理装置，还包括：
第六处理模块，设置为若所述比对结果为失败，则向所述第一终端返回协商失败响应消息，使所述第一终端根据所述协商失败响应消息，拒绝所述加密通话请求。
本发明实施例的加密通话的处理装置，还包括：
第七处理模块，设置为在获取第一终端发送的第一密钥协商信令的步骤之前，获取第二终端发送的第二密钥协商信令，并根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送加密通话通知消息，使所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述第一终端为与所述被叫号码信息对应的终端。
本发明实施例的加密通话的处理装置，所述第五处理模块53包括：
第一接收单元，设置为接收所述第一终端根据所述第一协商成功响应消息返回的携带有所述会话密钥的进入加密通话的第一请求消息；
控制单元，设置为根据所述第一请求消息以及所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端与所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
本发明的实施例还提供了一种密钥管理中心，包括如上所述的应用于KMC的加密通话的处理装置。
本发明实施例的加密通话的处理方法、装置、终端及KMC，采用指纹传感器录入机主指纹，将机主指纹信息密文加入密钥协商信令中，指纹信息使用KMC的公钥K0进行加密成密文，发送至KMC进行密钥加密协商，KMC使用K0解密得到密钥请求中的指纹信息明文，和用户移动设备识别码绑定的指纹信息进行比对，判断用户的合法性，如果合法，发送密钥协商成功响应消息，终端收到KMC发送的密钥协商成功响应消息后，用KMC公钥K0进 行签名验证，验证通过后，再利用临时私钥解密得到会话密钥Ks，发起进入加密通话请求(消息内容包含会话密钥)，从而通过指纹信息完成密钥协商的加密过程，进入更加私密的通话过程。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
本发明实施例提出的加密通话的处理方法、装置、终端及KMC，本发明技术方案包括：第一终端在检测到用户发起加密通话请求时，采集用于标识用户身份的生物特征信息并进行加密，得到加密的生物特征信息；向密钥管理中心KMC发送携带有加密的生物特征信息的第一密钥协商信令；接收KMC在对加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，第一协商成功响应消息携带有KMC为第一终端和第二终端之间的会话分配的会话密钥；根据第一协商成功响应消息中携带的会话密钥进行加密通话。本发明实施例提供的技术方案，防止了非法用户使用第一终端进行加密通话，造成机主隐私泄露的问题，保证了通话的安全性。

Claims (21)

  1. 一种加密通话的处理方法，其特征在于，包括：
    第一终端在检测到用户通过所述第一终端发起加密通话请求时，采集用于标识所述用户的身份的生物特征信息并进行加密；
    向密钥管理中心KMC发送携带有所述加密的生物特征信息的第一密钥协商信令；
    接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，所述第一协商成功响应消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥；
    根据所述第一协商成功响应消息中携带的所述会话密钥进行加密通话。
  2. 根据权利要求1所述的处理方法，其特征在于，如果接收到所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对失败后返回的协商失败响应消息；该方法还包括：
    根据所述协商失败响应消息，拒绝所述加密通话请求。
  3. 根据权利要求1或2所述的处理方法，其特征在于，该方法之前还包括：
    所述第一终端接收所述KMC发送的加密通话通知消息，使得所述用户根据所述加密通话通知消息发起所述加密通话请求；其中，所述加密通话通知消息为所述KMC在接收到所述第二终端发送的第二密钥协商信令后，根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送的，所述第一终端为与所述被叫号码信息对应的终端。
  4. 根据权利要求3所述的处理方法，其特征在于，所述根据第一协商成功响应消息中携带的所述会话密钥进行加密通话包括：
    所述第一终端通过所述KMC的公钥对所述第一协商成功响应消息进行签名认证；
    若认证通过，则利用所述第一终端的私钥对所述第一协商成功响应消息进行解密处理，得到所述会话密钥，其中，所述第一终端的私钥为所述第一 终端在检测到用户通过所述第一终端发起加密通话请求后生成的；
    向所述KMC发送携带有所述会话密钥的进入加密通话的第一请求消息，由所述KMC根据所述第一请求消息和所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端和所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
  5. 根据权利要求1所述的处理方法，其特征在于，所述生物特征信息为指纹信息。
  6. 一种加密通话的处理装置，其特征在于，包括：
    第一处理模块，设置为在检测到用户发起加密通话请求时，采集用于标识所述用户的身份的生物特征信息并进行加密，得到加密的生物特征信息；
    第一发送模块，设置为向密钥管理中心KMC发送携带有所述加密的生物特征信息的第一密钥协商信令；
    第二处理模块，设置为接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对成功后返回的第一协商成功响应消息，所述第一协商成功响应消息携带有所述KMC为第一终端和第二终端之间的会话所分配的会话密钥；
    加密通话模块，设置为根据所述第一协商成功响应消息中携带的所述会话密钥进行加密通话。
  7. 根据权利要求6所述的处理装置，其特征在于，还包括：
    第三处理模块，设置为在向KMC发送携带有所述加密的生物特征信息的密钥协商信令的步骤之后，接收所述KMC在对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息比对失败后返回的协商失败响应消息；
    第四处理模块，设置为根据所述协商失败响应消息，拒绝所述加密通话请求。
  8. 根据权利要求6所述的处理装置，其特征在于，还包括：
    接收模块，设置为在检测到用户发起加密通话请求时，采集所述用户的 生物特征信息并进行加密，得到加密的生物特征信息的步骤之前，接收所述KMC发送的加密通话通知消息，使得所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述加密通话通知消息为所述KMC在接收到所述第二终端发送的第二密钥协商信令后，根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送的，所述第一终端为与所述被叫号码信息对应的终端。
  9. 根据权利要求8所述的处理装置，其特征在于，所述加密通话模块包括：
    认证模块，设置为通过所述KMC的公钥对所述第一协商成功响应消息进行签名认证；
    解密模块，设置为若认证通过，则利用所述第一终端的私钥对所述第一协商成功响应消息进行解密处理，得到所述会话密钥，其中，所述第一终端的私钥为所述第一终端在检测到用户通过所述第一终端发起加密通话请求后生成的；
    第二发送模块，设置为向所述KMC发送携带有所述会话密钥的进入加密通话的第一请求消息，由所述KMC根据所述第一请求消息和所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端和所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
  10. 根据权利要求1所述的处理装置，其特征在于，所述生物特征信息为指纹信息。
  11. 一种终端，其特征在于，包括如权利要求6－10任一项所述的加密通话的处理装置。
  12. 一种加密通话的处理方法，应用于密钥管理中心KMC，其特征在于，包括：
    获取第一终端发送的第一密钥协商信令，所述第一密钥协商信令携带有加密的生物特征信息，其中，所述加密的生物特征信息为所述第一终端检测到用户发起加密通话请求时，采集所述用户的生物特征信息并进行加密得到 的；
    对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息进行比对，得出一比对结果；
    若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话。
  13. 根据权利要求12所述的处理方法，其特征在于，所述方法还包括：
    若所述比对结果为失败，则向所述第一终端返回协商失败响应消息，使所述第一终端根据所述协商失败响应消息，拒绝所述加密通话请求。
  14. 根据权利要求12所述的处理方法，其特征在于，在获取第一终端发送的第一密钥协商信令的步骤之前还包括：
    获取第二终端发送的第二密钥协商信令，并根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送加密通话通知消息，使所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述第一终端为与所述被叫号码信息对应的终端。
  15. 根据权利要求14所述的处理方法，其特征在于，所述若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话的步骤包括：
    接收所述第一终端根据所述第一协商成功响应消息返回的携带有所述会话密钥的进入加密通话的第一请求消息；
    根据所述第一请求消息以及所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端与所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
  16. 一种加密通话的处理装置，应用于密钥管理中心KMC，其特征在于，包括：
    获取模块，设置为获取第一终端发送的第一密钥协商信令，所述第一密钥协商信令携带有加密的生物特征信息，其中，所述加密的生物特征信息为 所述第一终端检测到用户发起加密通话请求时，采集所述用户的生物特征信息并进行加密得到的；
    比对模块，设置为对所述加密的生物特征信息解密并与预先保存的第一终端对应的生物特征信息进行比对，得出一比对结果；
    第五处理模块，设置为若所述比对结果为成功，则向所述第一终端返回第一协商成功响应消息，所述第一协商成功消息携带有所述KMC为所述第一终端和第二终端之间的会话所分配的会话密钥，使第一终端根据所述会话密钥进行加密通话。
  17. 根据权利要求16所述的、处理装置，其特征在于，还包括：
    第六处理模块，设置为若所述比对结果为失败，则向所述第一终端返回协商失败响应消息，使所述第一终端根据所述协商失败响应消息，拒绝所述加密通话请求。
  18. 根据权利要求16所述的处理装置，其特征在于，还包括：
    第七处理模块，设置为在获取第一终端发送的第一密钥协商信令的步骤之前，获取第二终端发送的第二密钥协商信令，并根据所述第二密钥协商信令中的被叫号码信息向所述第一终端发送加密通话通知消息，使所述用户根据所述加密通话通知消息发起所述加密通话请求，其中，所述第一终端为与所述被叫号码信息对应的终端。
  19. 根据权利要求18所述的处理装置，其特征在于，所述第五处理模块包括：
    第一接收单元，设置为接收所述第一终端根据所述第一协商成功响应消息返回的携带有所述会话密钥的进入加密通话的第一请求消息；
    控制单元，设置为根据所述第一请求消息以及所述第二终端发送的携带有所述会话密钥的进入加密通话的第二请求消息，控制所述第一终端与所述第二终端进行加密通话，其中，所述第二请求消息为所述第二终端收到所述KMC根据所述第二密钥协商信令返回的第二协商成功响应消息后，向所述KMC发送的。
  20. 一种密钥管理中心KMC，其特征在于，包括如权利要求16－19任 一项所述的加密通话的处理装置。
  21. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-5任一项和/或权利要求12-15任一项的方法。
PCT/CN2015/088147 2015-05-13 2015-08-26 一种加密通话的处理方法、装置、终端及kmc WO2016179923A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510243281.8A CN106301767B (zh) 2015-05-13 2015-05-13 一种加密通话的处理方法、装置、终端及kmc
CN201510243281.8 2015-05-13

Publications (1)

Publication Number Publication Date
WO2016179923A1 true WO2016179923A1 (zh) 2016-11-17

Family

ID=57247685

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/088147 WO2016179923A1 (zh) 2015-05-13 2015-08-26 一种加密通话的处理方法、装置、终端及kmc

Country Status (2)

Country Link
CN (1) CN106301767B (zh)
WO (1) WO2016179923A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108989015A (zh) * 2017-05-31 2018-12-11 北京京东尚科信息技术有限公司 一种加密的方法和装置

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109101803B (zh) * 2018-07-25 2023-06-23 腾讯科技（深圳）有限公司 生物识别设备及方法
CN109635164B (zh) * 2018-11-12 2020-12-04 同盾控股有限公司 一种号码的检测方法和装置
CA3058012C (en) 2019-03-29 2021-05-11 Alibaba Group Holding Limited Cryptography chip with identity verification
CA3057398C (en) 2019-03-29 2021-07-06 Alibaba Group Holding Limited Securely performing cryptographic operations
CA3058242C (en) * 2019-03-29 2022-05-31 Alibaba Group Holding Limited Managing cryptographic keys based on identity information
EP3610607B1 (en) 2019-03-29 2021-08-25 Advanced New Technologies Co., Ltd. Cryptographic key management based on identity information
CN114745134A (zh) * 2022-03-30 2022-07-12 恒玄科技(上海)股份有限公司 媒体数据流的流转方法、系统、设备及计算机可读介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1925681A (zh) * 2006-09-20 2007-03-07 北京太极联合实验室科技有限公司 基于移动通信网络的端到端加密方法和加密系统
CN101714918A (zh) * 2009-10-23 2010-05-26 浙江维尔生物识别技术股份有限公司 一种登录vpn的安全系统以及登录vpn的安全方法
US20120170750A1 (en) * 2007-09-14 2012-07-05 Security First Corp. Systems and methods for managing cryptographic keys
CN103458400A (zh) * 2013-09-05 2013-12-18 中国科学院数据与通信保护研究教育中心 一种语音加密通信系统中的密钥管理方法
CN104333662A (zh) * 2014-11-14 2015-02-04 深圳市中兴移动通信有限公司 一种移动终端及其电话接听的加密方法和装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101340443B (zh) * 2008-08-28 2014-12-03 中国电信股份有限公司 一种通信网络中会话密钥协商方法、系统和服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1925681A (zh) * 2006-09-20 2007-03-07 北京太极联合实验室科技有限公司 基于移动通信网络的端到端加密方法和加密系统
US20120170750A1 (en) * 2007-09-14 2012-07-05 Security First Corp. Systems and methods for managing cryptographic keys
CN101714918A (zh) * 2009-10-23 2010-05-26 浙江维尔生物识别技术股份有限公司 一种登录vpn的安全系统以及登录vpn的安全方法
CN103458400A (zh) * 2013-09-05 2013-12-18 中国科学院数据与通信保护研究教育中心 一种语音加密通信系统中的密钥管理方法
CN104333662A (zh) * 2014-11-14 2015-02-04 深圳市中兴移动通信有限公司 一种移动终端及其电话接听的加密方法和装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108989015A (zh) * 2017-05-31 2018-12-11 北京京东尚科信息技术有限公司 一种加密的方法和装置

Also Published As

Publication number Publication date
CN106301767B (zh) 2020-01-03
CN106301767A (zh) 2017-01-04

Similar Documents

Publication Publication Date Title
WO2016179923A1 (zh) 一种加密通话的处理方法、装置、终端及kmc
US10601801B2 (en) Identity authentication method and apparatus
US7730309B2 (en) Method and system for key management in voice over internet protocol
JP5474969B2 (ja) 携帯機器の関連付け
WO2017201809A1 (zh) 终端通信方法及系统
JP5431479B2 (ja) 機器とステーションの関連付けのためのプロトコル
US10038676B2 (en) Call encryption systems and methods
CN107040513B (zh) 一种可信访问认证处理方法、用户终端和服务端
WO2018127081A1 (zh) 一种加密密钥获取方法及系统
CN105634737B (zh) 一种数据传输方法、终端及其系统
CN108111497B (zh) 摄像机与服务器相互认证方法和装置
CN110334503A (zh) 利用一个设备解锁另一个设备的方法
US11144621B2 (en) Authentication system
US20070239994A1 (en) Bio-metric encryption key generator
JP2016533694A (ja) ユーザアイデンティティ認証方法、端末及びサーバ
CN110659467A (zh) 一种远程用户身份认证方法、装置、系统、终端及服务器
CN108712382A (zh) 一种基于安全二维码的数字身份的认证方法以及系统
CN107454035B (zh) 一种身份认证的方法及装置
US10291588B2 (en) Secure registration to a service provided by a web server
CN107864124B (zh) 一种终端信息安全保护方法、终端及蓝牙锁
CN110933484A (zh) 一种无线投屏设备的管理方法及装置
CN102572817A (zh) 实现移动通信保密的方法和智能存储卡
US10091189B2 (en) Secured data channel authentication implying a shared secret
CN104065648A (zh) 一种语音通话的数据处理方法
Sathyan et al. Multi-layered collaborative approach to address enterprise mobile security challenges

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15891626

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15891626

Country of ref document: EP

Kind code of ref document: A1