WO2017045407A1

WO2017045407A1 - Method of implementing end-to-end conversation encryption, terminal and network element of network side

Info

Publication number: WO2017045407A1
Application number: PCT/CN2016/081313
Authority: WO
Inventors: 高扬
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-09-17
Filing date: 2016-05-06
Publication date: 2017-03-23
Also published as: CN106549906A

Abstract

A method of implementing end-to-end conversation encryption, terminal and network element of network side, the method comprising: exchanging a digital certificate and negotiating a key parameter in a reliable transmission mode during establishment of conversation; and performing the end-to-end encrypted conversation in a voice media channel by using the negotiated key parameter. An embodiment of the present invention ensures the security of VoLTE-based end-to-end conversation and at the same time guarantees the national security, by means of exchanging the digital certificate and negotiating the key parameter in the reliable transmission mode and then performing the end-to-end encrypted conversation in the existing media channel by using negotiated key parameter.

Description

Method, terminal and network side network element for implementing end-to-end call encryption

Technical field

Embodiments of the present invention relate to, but are not limited to, a method, a terminal, and a network side network element for implementing end-to-end call encryption.

Background technique

VoLTE, Voice over LTE, is an IP data transmission technology based on IP Multimedia Subsystem (IMS). VoLTE does not require a 2G/3G network, and all services are carried on a 4G network. Although IMS itself provides a complex and relatively secure authentication and authentication mechanism, with the increasing popularity of malicious interception, VoLTE's existing security mechanisms are not sufficient.

For the IMS media plane encryption technology (see 3GPP TS33.328), the current general deployment is to support the establishment of encryption between the terminal and the IMS access side device, such as the Session Border Controller (SBC), while on the network side. There is no encryption between them, so it is easy to be maliciously monitored.

With the promotion of VoLTE as the mainstream technology of voice, and the fact that VoLTE itself is based on IP technology, the problem of malicious monitoring of VoLTE voice will even rise to the level of national security.

At present, the commonly used VoLTE encryption means generally negotiates key parameters through a signaling plane, and then uses these negotiated key parameters to perform call encryption. However, from the perspective of national security, only using key parameter encryption, the security level is not enough, you need to use the country's own digital certificate. Information such as digital certificates cannot be carried on the signaling plane of VoLTE, which will be an intractable contradiction.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

An embodiment of the present invention provides a method for implementing end-to-end call encryption, which includes: exchanging digital certificates and performing key parameter negotiation in a reliable transmission mode during a call establishment process;

In the voice media channel, the negotiated key parameters are used for end-to-end encrypted calls.

Optionally, the method further includes establishing the reliable transmission manner, including:

Establishing a first media channel, where the first media channel is a dedicated media channel for encryption negotiation; or

Introducing, in the voice media channel, a media packet in the media channel, and retransmitting the lost packet, exchanging the digital certificate and performing the key parameter negotiation.

Optionally, the method for establishing the first media channel is an explicit manner, and specifically includes:

In the process of establishing a call, media negotiation is performed by adding a dedicated encrypted negotiation media line in the session initial description protocol SDP to establish the first media channel.

Optionally, the method for establishing the first media channel is an implicit manner, and specifically includes: establishing the first media channel as a dedicated default connection.

Optionally, before the digital certificate is exchanged and the key parameter negotiation is performed in the reliable transmission mode, the method further includes: turning on the dedicated default connection.

Optionally, when the reliable transmission mode is to introduce a media packet in the media channel in the voice media channel, and retransmit the packet loss manner,

In the voice media channel, before the end-to-end encrypted call is performed by using the negotiated key parameter, the method further includes: restoring normal media packet processing.

Optionally, the method further includes: during the establishing the call, the session initiator carries the first pre-condition in the media line of the voice media when the session request is initiated;

The first precondition is that when the digital certificate is exchanged in the reliable transmission mode and the key parameter negotiation is completed, a ringing prompt is sent to the answering party.

Optionally, the method further includes: during the establishing the call, the session initiator carries the second pre-condition in the media line of the voice media when the session request is initiated;

The second precondition is: completing the resource reservation, and performing a ringing prompt to the answering party.

The embodiment of the invention further provides a terminal, which includes at least a first processing module and a second processing module, where

The first processing module is configured to exchange in a reliable transmission mode during a call setup Digital certificate and key parameter negotiation;

The second processing module is configured to perform an end-to-end encrypted call by using the negotiated key parameter in the voice media channel.

Optionally, the method further includes: a transceiver module configured to perform media negotiation by adding a dedicated encryption negotiation media line in the SDP to establish a first media channel; or establishing a first media channel, that is, a dedicated encryption negotiation media channel It is a dedicated default connection; or, the media packet in the media channel is analyzed, and the lost packet is retransmitted, and when the digital certificate is exchanged and the key parameter negotiation is performed, the normal media packet processing is resumed;

Correspondingly,

The first processing module is specifically configured to: during the establishing a call, exchange the digital certificate in the first media channel and perform the key parameter negotiation; or use the media packet in the media channel. The method of analyzing and retransmitting the lost packet completes the exchange of the digital certificate and performs key parameter negotiation.

Optionally, the transceiver module is further configured to:

During the establishment of the call, when the session request is initiated, the first pre-condition is carried in the media line of the voice media; wherein the first pre-condition is: completing the exchange of the digital certificate and the reliable transmission mode Key parameter negotiation; accordingly,

The terminal further includes a ringing processing module configured to initiate a ringing prompt to the answering party when the first precondition is met.

Optionally, the transceiver module is further configured to: when the session request is initiated, the second pre-condition is carried in the media line of the voice media; wherein the second pre-condition is: Complete resource reservation; accordingly,

The terminal further includes:

a resource reservation module, configured to complete resource reservation;

The ringing module is configured to initiate a ringing prompt to the answering party when the second precondition is met.

The embodiment of the invention further provides a network side network element, which includes at least a forwarding module and a media channel processing module;

The forwarding module is configured to forward a message during the establishment of the call;

The media channel processing module is configured to pre-establish a first media channel, where the first media channel is a dedicated media channel for encryption negotiation; and when the call establishment is completed, the pre-established first media channel is turned on.

Optionally, the network side network element is an IP multimedia subsystem IMS access side device.

Optionally, the IMS access side device is a session border controller SBC.

The embodiment of the invention further provides a computer readable storage medium storing computer executable instructions for performing any of the above methods for implementing end-to-end call encryption.

The technical solution of the present application includes: exchanging digital certificates and performing key parameter negotiation in a reliable transmission mode during the establishment of a call; and performing an end-to-end encrypted call by using the negotiated key parameters in the voice media channel. In the embodiment of the present invention, the digital certificate is exchanged by the reliability transmission mode, and the key parameters are negotiated, and then the end-to-end encrypted call is performed by using the negotiated key parameter in the existing media channel, thus ensuring the VoLTE-based. The security of end-to-end calls, while also ensuring national security.

Other features and advantages of the embodiments of the invention will be set forth in the description in the description which The objectives and other advantages of the invention may be realized and obtained by means of the structure particularly pointed in the appended claims.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

The drawings are intended to provide a further understanding of the embodiments of the present invention, and are intended to be a part of the present invention, and the description of the present invention is not intended to limit the invention. In the drawing:

FIG. 1 is a schematic flowchart of implementing end-to-end call encryption based on VoLTE in the related art;

2 is a flowchart of a method for implementing end-to-end call encryption according to an embodiment of the present invention;

3 is a schematic flowchart of a first embodiment for implementing end-to-end call encryption according to an embodiment of the present invention;

4 is a schematic flowchart of a second embodiment for implementing end-to-end call encryption according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a third embodiment for implementing end-to-end call encryption according to an embodiment of the present invention;

FIG. 6 is a schematic flowchart of a fourth embodiment for implementing end-to-end call encryption according to an embodiment of the present invention;

FIG. 7 is a schematic flowchart of a fifth embodiment for implementing end-to-end call encryption according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a terminal for implementing end-to-end call encryption according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a network side network element for implementing end-to-end call encryption according to an embodiment of the present invention.

Preferred embodiment of the invention

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

FIG. 1 is a schematic flowchart of implementing end-to-end call encryption based on VoLTE in the related art, as shown in FIG. 1 , including:

Step 100: The UE1 sends an invite INVITE call request to the SBC1, where the Session Description Protocol (SDP) is carried. From the perspective of media negotiation, the SDP is Offer, which is the INVITE SDP offer.

In this step, the SDP carries a media line (such as m lines) that identifies the voice media for the call.

Step 101: SBC1 forwards the INVITE SDP offer to the IMS.

Step 102: The IMS forwards the INVITE SDP offer to the SBC2 on the called user side.

Step 103: SBC2 forwards the INVITE SDP offer to UE2.

Step 104: UE2 processes the received INVITE SDP offer, and constructs an SDP and sends it to SBC2. From the perspective of media negotiation, the SDP is Answer, that is, UE2 returns a 200 OK SDP answer.

Step 105: SBC2 forwards the 200 OK SDP answer message to the IMS.

Step 106: The IMS forwards the 200 OK SDP answer message to SBC1.

Step 107: SBC1 forwards the 200 OK SDP answer message to UE1. At this point, the media channel for the voice call is established.

Step 108: UE1 and UE2 exchange digital certificates in the media channel. The media channels established in the related art are transmitted based on the Real-time Transport Protocol (RTP), and the transmission of the RTP itself is unreliable, so it is unreliable to exchange digital certificates in this channel.

This step is optional. If you do not need to use a digital certificate, such as identity authentication, you can omit this step.

Step 109: UE1 and UE2 negotiate key parameters in the media channel.

Step 110: UE1 and UE2 perform an end-to-end encrypted call by using the negotiated key parameters.

Those skilled in the art know that if there are 183 messages and the like in the above process, the SDP Answer can be carried in the called 183 message.

It should be noted that the digital certificate and the key parameter involved in the steps 108 and 109 are transmitted in the network. Since the digital certificate is in the form of text, the transmission should be reliable transmission from the perspective of data integrity. In the related related art, different RTP media are in a streaming media format, and a protocol for unreliable transmission may be used. That is to say, it is unreliable to exchange digital certificates directly in the RTP media channel in the related art.

It should be noted that the general IMS commercial deployment will have an SBC, but from the technical solution point of view, SBC1 and SBC2 are optional network elements.

From the implementation of the existing media-based end-to-end call encryption shown in Figure 1, in the end-to-end call based on the media plane, since the exchange of digital certificates in the normal RTP media channel may fail, this will bring The problem of encrypted calls cannot be used. That is to say, VoLTE calls are low in security, and the security of end-to-end calls based on VoLTE cannot be guaranteed, and even national security issues are brought about.

2 is a flowchart of a method for implementing end-to-end call encryption according to an embodiment of the present invention. As shown in FIG. 2, the method includes:

Step 200: During the establishment of the call, the digital certificate is exchanged in the reliable transmission mode and the key parameter negotiation is performed.

This step also includes: establishing a reliable transmission method, including but not limited to:

The first media channel is established. Since the first media channel is a dedicated media channel that is distinguished from the existing voice media channel for the end-to-end encrypted call, the first media channel can use a reliable transmission protocol. or,

A special mode is introduced in the voice media channel, that is, the media packets in the media channel are analyzed, and the lost packets are retransmitted, and the digital certificate is exchanged in this special mode and the key parameters are negotiated. In this way, the reliable transmission of digital certificates and key information is also guaranteed.

among them,

The method for establishing the first media channel may be an explicit manner, and specifically includes: performing media negotiation by adding a dedicated encrypted negotiation media line (such as m line) in the SDP to establish the first media. The channel is a dedicated media channel for cryptographic negotiation. The media channel of the dedicated encryption negotiation established by the display mode is normally established through media negotiation. Therefore, the current network side network element supports the network side additional requirement, and is convenient for rapid deployment and promotion in the network. And this explicit way is convenient for standardization and industrialization, and is convenient for promotion to government and enterprise users, and is not limited to internal use by national security agencies.

The method for establishing the first media channel may also be an implicit manner, and specifically includes: pre-establishing the first media channel, that is, the dedicated media channel for encryption negotiation as a dedicated default connection. The establishment of the dedicated default connection is not reflected in the SDP process, but is a dedicated default connection agreed by both parties, UE1 and UE2. The dedicated default connection may use a contracted fixed port such as a TCP connection of port 8080, or a TCP connection to a port associated with the actual media stream, such as audio port +2. The first media channel is established in an implicit manner. Because the media channel of the dedicated encryption negotiation does not have the channel media negotiation established, the network side network element, such as the SBC device, is required to perform the default connection of the dedicated default connection.

Step 201: Perform an end-to-end encrypted call in the voice media channel by using the negotiated key parameter. The voice media channel in this step is the media channel established for the voice call established in the existing method shown in FIG. The specific implementation of this step is consistent with the prior art, and details are not described herein again.

When the reliable transmission mode in the step 200 is to introduce the media packet in the media channel in the voice media channel and retransmit the packet, the step further includes: restoring the normal media packet processing.

In the method shown in FIG. 2, the digital certificate is exchanged by the reliability transmission method and the key parameters are negotiated, and then the end-to-end encrypted call is performed by using the negotiated key parameter in the existing media channel. It guarantees the security of end-to-end calls based on VoLTE, and also guarantees national security.

Further, the method of the embodiment of the present invention further includes:

During the establishment of the call, the session initiator, such as UE1, carries the first precondition in the media line of the voice media when the session request is initiated, for example, the first precondition is: when the digital certificate is exchanged in the reliable transmission mode, The key parameter negotiation is completed, and then the ringing prompt is sent to the receiving party such as UE2. In this way, if there is a problem in the authentication of the digital certificate, the negotiation of the key parameters, and the inability to establish an encrypted call, since the user is not in the off-hook state at this time, the influence on the user experience is avoided. The corresponding preconditions may be extended in the SDP to carry the first precondition.

Or, further, the method of the embodiment of the present invention further includes:

During the establishment of the call, the session initiator, such as UE1, carries the second pre-condition in the media line of the voice media when the session request is initiated. For example, the second pre-condition is: completing the resource reservation, and ringing to the receiving party. prompt. It should be noted that the extension of the corresponding attribute condition in the SDP to carry the first pre-condition is supported by each network element in the network. From the perspective of compatibility, if the purpose of the first pre-condition is reached, and the attribute descriptions are not required to be extended, the related network element upgrades in the network are not required, that is, the embodiments of the present invention are provided. Compatibility of technical solutions. Therefore, in the embodiment of the present invention, the existing second precondition, that is, the resource reservation mechanism is used only on the SDP. On the one hand, the related network elements in the network are not required to be upgraded, and the first precondition is also achieved. The compatibility of the technical solutions provided by the embodiments of the present invention is improved.

The technical solutions provided by the embodiments of the present invention are described in detail below with reference to specific embodiments.

FIG. 3 is a schematic flowchart of a first embodiment of an end-to-end call encryption according to an embodiment of the present invention. The first embodiment is a manner of establishing a first media channel in a display manner, as shown in FIG. 3, including:

Step 300: The UE1 sends an invite INVITE call request to the SBC1, where the Session Description Protocol (SDP) is carried. From the perspective of media negotiation, the SDP is Offer, which is the INVITE SDP offer.

In this step, in addition to the media line (m line) carrying the voice media for identifying the call, the SDP carries the media line (m line) of the encryption negotiation dedicated to the identification.

Step 301: SBC1 forwards the INVITE SDP offer to the IMS.

Step 302: The IMS forwards the INVITE SDP offer to the SBC2 on the called user side.

Step 303: SBC2 forwards the INVITE SDP offer to UE2.

Step 304: UE2 processes the received INVITE SDP offer, and constructs an SDP and sends it to SBC2. From the perspective of media negotiation, the SDP is Answer, that is, UE2 returns a 200 OK SDP answer. Similarly, in the SDP, in addition to the media line (m line) carrying the voice media for the call, the media line (m line) of the encryption-dedicated encryption for identification is carried.

Step 305: SBC2 forwards the 200 OK SDP answer message to the IMS.

Step 306: The IMS forwards the 200 OK SDP answer message to SBC1.

Step 307: SBC1 forwards the 200 OK SDP answer message to UE1. At this time, the call establishment is completed, and in addition to establishing a voice media channel for voice calls, a dedicated media channel for encryption negotiation is also established.

Step 308: UE1 and UE2 exchange digital certificates in the first media channel.

Step 309: UE1 and UE2 negotiate key parameters in the first media channel.

Step 310: UE1 and UE2 perform an end-to-end encrypted call on the voice media channel by using the negotiated key parameters.

Wherein, the digital certificate involved in steps 308 and 309 and the key parameter are transmitted in the network, and the transmission must be reliable transmission from the perspective of data integrity. Transmission protocols such as Transmission Control Protocol (TCP), Stream Control Transmission Protocol (SCTP), etc. may be employed herein.

Here is an example of the SDP format as follows:

V=0

o=originator 2890844526 2890842808 IN IP4 controller.example.com

s=-

c=IN IP4 controller.example.com

m=application 49153 TCP

a=setup:active

a=connection:new

m=audio 49170 RTP/AVP 0

For example, as shown in the bold italicized line, m=application 49153 TCP, which is used to indicate the first media channel corresponding to the dedicated encryption negotiation; m=audio, which is used to indicate the corresponding voice media channel that needs to be encrypted.

If there are multiple actual media lines, such as multiple audio and video, you need to associate the first media channel of the encryption negotiation with the voice media channel that needs to be encrypted. You can add an id index to the a line, for example:

m=application 49153 TCP cfw

a=setup:active

a=connection:new

a=id:H839quwhjdhegvdga

m=audio 49170 RTP/AVP 0

a=id:H839quwhjdhegvdga

As shown in the bold italicized line, the channel indicating the encryption negotiation (m=application 49153 TCP cfw) is the same as the id of the voice channel (m=audio 49170 RTP/AVP 0) (a=id:H839quwhjdhegvdga). That is, the channel for encryption negotiation (m=application 49153 TCP cfw) will provide negotiation of encryption parameters for the voice channel (m=audio 49170 RTP/AVP 0).

4 is a schematic flowchart of a second embodiment of implementing end-to-end call encryption according to an embodiment of the present invention. The second embodiment is a method for establishing a first media channel in an implicit manner. As shown in FIG. 4, the method includes:

Step 400: The UE1 sends an invite INVITE call request to the SBC1, where the Session Description Protocol (SDP) is carried. From the perspective of media negotiation, the SDP is Offer, which is the INVITE SDP offer.

In this step, the SDP carries a media line (m line) identifying the voice media for the call.

Step 401: SBC1 forwards the INVITE SDP offer to the IMS.

Step 402: The IMS forwards the INVITE SDP offer to the SBC2 of the called user side.

Step 403: SBC2 forwards the INVITE SDP offer to UE2.

Step 404: UE2 processes the received INVITE SDP offer, and constructs an SDP and sends it to SBC2. From the perspective of media negotiation, the SDP is Answer, that is, UE2 returns a 200 OK SDP answer.

Step 405: SBC2 forwards the 200 OK SDP answer message to the IMS.

Step 406: If the deployment has SBC2, SBC2 needs to conduct the first media channel of the encryption negotiation of the dedicated default connection.

Step 407: The IMS forwards the 200 OK SDP answer message to SBC1.

Step 408: SBC1 forwards the 200 OK SDP answer message to UE1.

Step 409: If the deployment has SBC1, SBC1 needs to conduct the first media channel of the encryption negotiation of the dedicated default connection.

At this time, the call establishment is completed, and in addition to establishing a voice media channel for voice calls, a dedicated media channel for encryption negotiation is also established.

Step 410: UE1 and UE2 exchange digital certificates in the first media channel.

Step 411: UE1 and UE2 negotiate key parameters in the first media channel.

Step 412: UE1 and UE2 perform an end-to-end encrypted call on the voice media channel by using the negotiated key parameters.

The establishment of the dedicated default connection is not reflected in the SDP process, but is a dedicated default connection agreed by both parties, UE1 and UE2. The dedicated default connection can use a contracted fixed port such as a TCP connection of port 8080, or a contracted port associated with the actual media stream such as audio. Port +2 TCP connection.

FIG. 5 is a schematic flowchart of a third embodiment of implementing end-to-end call encryption according to an embodiment of the present invention. In a third embodiment, a special mode is introduced in a voice media channel, that is, media packets in a media channel are analyzed. The method of retransmitting the lost packet, as shown in Figure 5, includes:

Step 500: The UE1 sends an invite INVITE call request to the SBC1, where the Session Description Protocol (SDP) is carried. From the perspective of media negotiation, the SDP is Offer, which is the INVITE SDP offer.

Step 501: SBC1 forwards the INVITE SDP offer to the IMS.

Step 502: The IMS forwards the INVITE SDP offer to the SBC2 on the called user side.

Step 503: SBC2 forwards the INVITE SDP offer to UE2.

Step 504: UE2 processes the received INVITE SDP offer, and constructs an SDP and sends it to SBC2. From the perspective of media negotiation, the SDP is Answer, that is, UE2 returns a 200 OK SDP answer.

Step 505: SBC2 forwards the 200 OK SDP answer message to the IMS.

Step 506: The IMS forwards the 200 OK SDP answer message to SBC1.

Step 507: SBC1 forwards the 200 OK SDP answer message to UE1. The call is now established.

Step 508: UE1 and UE2 enter a special mode, that is, analyze media packets in the media channel, such as a Real-Time Transport Protocol (RTP) packet, and retransmit the lost packets.

Step 509: UE1 and UE2 exchange digital certificates in the media channel in the special mode.

Step 510: UE1 and UE2 negotiate key parameters in the media channel in the special mode.

Step 511: The key parameter negotiation is completed, and UE1 and UE2 exit the special mode to resume normal RTP processing.

Step 512: UE1 and UE2 perform an end-to-end encrypted call on the voice media channel by using the negotiated key parameters.

FIG. 6 is a schematic flowchart of a fourth embodiment of implementing end-to-end call encryption according to an embodiment of the present invention. In the fourth embodiment, when a digital certificate is exchanged in a reliable transmission mode, key parameter negotiation is completed, and then the call is answered. For example, UE2 performs a ringing prompt as a precondition, as shown in FIG. 6, including:

Step 600: The UE1 sends an invite INVITE call request to the SBC1, where the Session Description Protocol (SDP) is carried. From the perspective of media negotiation, the SDP is Offer, which is the INVITE SDP offer.

In this step, the SDP carries a media line (m line) for identifying the voice media for the call, and a media line (m line) for identifying the dedicated encrypted negotiation, and carries a precondition, that is, when In the reliable transmission mode, the digital certificate is exchanged and the key parameter negotiation is completed, and then the ringing prompt is sent to the receiving party such as UE2.

Step 601: SBC1 forwards the INVITE SDP offer to the IMS.

Step 602: The IMS forwards the INVITE SDP offer to the SBC2 of the called user side.

Step 603: SBC2 forwards the INVITE SDP offer to UE2.

Step 604: UE2 processes the received INVITE SDP offer, and constructs an SDP and sends it to SBC2. From the perspective of media negotiation, the SDP is Answer, that is, UE2 returns a 200 OK SDP answer. Similarly, in the SDP, in addition to the media line (m line) carrying the voice media for identifying the call, and the media line (m line) for identifying the dedicated encryption negotiation, the pre-condition is also carried, that is, when in the reliable transmission mode. The digital certificate is exchanged and the key parameter negotiation is completed, and then the ringing prompt is sent to the receiving party such as UE2.

The precondition can further carry the conf attribute line. The Conf line indicates that the party that receives the Conf indication during the media negotiation needs to send a message to the other party that the precondition is satisfied when the precondition is satisfied.

Step 605: SBC2 forwards the 183 SDP answer message to the IMS.

Step 606: The IMS forwards the 183 SDP answer message to SBC1.

Step 607: SBC1 forwards 183 SDP answer message to UE1. At this time, the call establishment is completed, and in addition to establishing a voice media channel for voice calls, a dedicated media channel for encryption negotiation is also established.

Step 608: UE1 and UE2 exchange digital certificates in the first media channel.

Step 609: UE1 and UE2 negotiate key parameters in the first media channel.

Step 610: Because the key parameter negotiation is completed, the pre-condition of the voice media channel is satisfied, and the UE1 sends an UPDATE, carrying the state that the pre-condition is satisfied.

Step 611: SBC1 forwards the UPDATE request to the IMS.

Step 612: The IMS forwards the UPDATE request to the SBC2 on the called user side.

Step 613: SBC2 forwards the UPDATE request to UE2.

Step 614: UE2 accepts the UPDATE message and constructs a 200 OK response to send to SBC2.

Step 615: SBC2 forwards the 200 OK message to the IMS.

Step 616: The IMS forwards the 200 OK message to SBC1.

Step 617: SBC1 forwards the 200 OK message to UE1.

It should be noted that the above steps 610 to 617 may be omitted.

Step 618: Because the pre-condition is satisfied, the UE2 rings to prompt the user to receive the call, and simultaneously sends 180 to SBC2.

Step 619: SBC2 forwards 180 the message to the IMS.

Step 620: The IMS forwards 180 the message to SBC1.

Step 621: SBC1 forwards 180 the message to UE1.

Step 622: The called user (UE2) goes off-hook, and UE2 sends 200 OK to SBC2.

Step 623: SBC2 forwards the 200 OK message to the IMS.

Step 624: The IMS forwards the 200 OK message to SBC1.

Step 625: SBC1 forwards the 200 OK message to UE1.

Step 626: UE1 and UE2 perform an end-to-end encrypted call on the voice media channel by using the negotiated key parameters.

It should be noted that, since the key parameter negotiation is end-to-end, UE2 can know that the key negotiation is completed. Therefore, 183 in step 604 may not carry the conf line, and correspondingly, 610 to 617 may be omitted.

Here is an example of the format of the Precondition part of the SDP:

SDP in the INVITE request:

m=audio 20000 RTP/AVP 0

a=curr:encryption e2e none

a=des:encryption mandatory e2e sendrecv

The a=curr:encryption e2e none is used to identify that the current precondition is not met; a=des:encryption mandatory e2e sendrecv, which is used to indicate the precondition to be reached, that is, the key parameter negotiation is completed.

The SDP format in 183 is as follows:

m=audio 20000 RTP/AVP 0

a=curr:encryption e2e none

a=des:encryption mandatory e2e sendrecv

a=conf:encryption e2e sendrecv

A=conf:encryption e2e sendrecv, indicating that if the peer precondition reaches this state, the peer needs to send a status notification.

The SDP format in UPDATE or 200OK is as follows:

m=audio 20000 RTP/AVP 0

a=curr:encryption e2e sendrecv

a=des:encryption mandatory e2e sendrecv

Where a=curr:encryption e2e sendrecv is used to identify that the current precondition has been met.

FIG. 7 is a schematic flowchart of a fifth embodiment of implementing end-to-end call encryption according to an embodiment of the present invention. In the fifth embodiment, resource reservation is completed as a pre-condition, as shown in FIG. 7, including:

Step 700: The UE1 sends an invite INVITE call request to the SBC1, where the Session Description Protocol (SDP) is carried. From the perspective of media negotiation, the SDP is Offer, which is the INVITE SDP offer.

In this step, the SDP carries a media line (m line) for identifying the voice media for the call, and a media line (m line) for identifying the dedicated encryption negotiation, and carries the precondition (Precondition), that is, the resource is completed. Reserved.

Step 701: SBC1 forwards the INVITE SDP offer to the IMS.

Step 702: The IMS forwards the INVITE SDP offer to the SBC2 on the called user side.

Step 703: SBC2 forwards the INVITE SDP offer to UE2.

Step 704: UE2 processes the received INVITE SDP offer, and constructs an SDP and sends it to SBC2. From the perspective of media negotiation, the SDP is Answer, that is, UE2 returns a 200 OK SDP answer. Similarly, in the SDP, in addition to the media line (m line) carrying the voice media for identifying the call, and the media line (m line) identifying the dedicated encryption negotiation, the precondition is also carried, that is, the resource reservation is completed.

The precondition can further carry the conf attribute line. The Conf line is a prior art, and indicates that the party that receives the Conf indication during the media negotiation needs to send a message to the other party that the precondition is satisfied when the precondition is satisfied.

Step 705: SBC2 forwards the 183 SDP answer message to the IMS.

Step 706: The IMS forwards the 183 SDP answer message to SBC1.

Step 707: SBC1 forwards 183 SDP answer message to UE1. At this time, the call establishment is completed, and in addition to establishing a voice media channel for voice calls, a dedicated media channel for encryption negotiation is also established.

Step 708: UE1 and UE2 exchange digital certificates in the first media channel.

This step is an optional step, if you do not need to use a digital certificate, such as identification This step can be omitted.

Step 709: UE1 and UE2 negotiate key parameters in the first media channel.

Step 710: The UE1 resource reservation is completed, and the UE2 resource reservation is completed.

Step 711: The UE1 and the UE2 resource reservation are also completed, and the pre-conditions of the voice media channel are satisfied, and the UE1 sends an UPDATE, carrying the state that the pre-condition is satisfied.

Step 712: SBC1 forwards the UPDATE request to the IMS.

Step 713: The IMS forwards the UPDATE request to the SBC2 on the called user side.

Step 714: SBC2 forwards the UPDATE request to UE2.

Step 715: UE2 accepts the UPDATE message and constructs a 200 OK response to send to SBC2.

Step 716: SBC2 forwards the 200 OK message to the IMS.

Step 717: The IMS forwards the 200 OK message to SBC1.

Step 718: SBC1 forwards the 200 OK message to UE1.

Step 719: The resource reservation of the UE1 is completed, the resource reservation of the UE2 is also completed, and the key negotiation is also completed, that is, all the preconditions are satisfied, and the UE2 ringing prompts the user to receive the call and simultaneously sends 180 to the SBC2.

Step 720: SBC2 forwards 180 the message to the IMS.

Step 721: The IMS forwards 180 the message to SBC1.

Step 722: SBC1 forwards 180 the message to UE1.

Step 723: The called user (UE2) goes off-hook, and UE2 sends 200 OK to SBC2.

Step 724: SBC2 forwards the 200 OK message to the IMS.

Step 725: The IMS forwards the 200 OK message to SBC1.

Step 726: SBC1 forwards the 200 OK message to UE1.

Step 727: UE1 and UE2 perform an end-to-end encrypted call on the voice media channel by using the negotiated key parameters.

The specific implementation of this embodiment, from the signaling, only the attribute line of the pre-condition of resource reservation, does not need to embody the extended pre-condition for key agreement in the sixth embodiment as shown in FIG. 6 of Property line.

FIG. 8 is a schematic structural diagram of a terminal for implementing an end-to-end call encryption according to an embodiment of the present invention. As shown in FIG. 8, the method includes at least a first processing module 80 and a second processing module 81.

The first processing module 80 is configured to exchange digital certificates and perform key parameter negotiation in a reliable transmission mode during the establishment of the call;

The second processing module 81 is configured to perform an end-to-end encrypted call using the negotiated key parameters in the voice media channel.

specifically,

The terminal of the present invention further includes a transceiver module 82 configured to perform media negotiation by adding a dedicated encryption negotiation media line (m line) in the SDP to establish a first media channel; or pre-establishing a first media channel, that is, dedicated The media channel of the encryption negotiation is a dedicated default connection; or, the media packet in the media channel is analyzed, and the lost packet is retransmitted, and the normal media packet processing is resumed when the digital certificate is exchanged and the key parameter negotiation is performed;

at this time,

The first processing module 80 is specifically configured to: during the establishment of the call, exchange digital certificates in the first media channel and perform key parameter negotiation; or analyze the media packets in the media channel, and retransmit the lost packets. The way to complete the exchange of digital certificates and key parameter negotiation.

Further, the transceiver module 82 is further configured to:

The first precondition is carried in the media line of the voice media when the session request is initiated. The first precondition is: performing the exchange of the digital certificate and performing the key parameter negotiation in the reliable transmission mode. at this time,

The terminal of the present invention further includes a ringing processing module 83 configured to initiate a ringing prompt to the answering party when the first precondition is satisfied.

further,

The transceiver module 82 is further configured to: when the session request is initiated, the second pre-condition is carried in the media line of the voice media; wherein the second pre-condition is: completing the resource reservation. at this time,

The terminal of the present invention further includes a resource reservation module 84 configured to complete reservation of resources.

The ringing processing module 83 is configured to initiate a ringing prompt to the answering party when the second precondition is met.

FIG. 9 is a schematic structural diagram of a network side network element for implementing end-to-end call encryption according to an embodiment of the present invention. As shown in FIG. 9, the method includes at least a forwarding module 90 and a media channel processing module 91.

The forwarding module 90 is configured to forward the message during the establishment of the call;

The media channel processing module 91 is configured to pre-establish a first media channel, that is, a dedicated encryption negotiation media channel, as a dedicated default connection, and when the call establishment is completed, turn on the pre-established first media channel.

The network side network element may be an IMS access side device such as an SBC.

The above is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

The method for implementing the end-to-end call encryption, the terminal, and the network side network element, which are provided by the embodiment of the present invention, include: exchanging digital certificates and performing key parameter negotiation in a reliable transmission mode during the establishment of a call; in the voice media channel End-to-end encrypted calls using negotiated key parameters. In the embodiment of the present invention, the digital certificate is exchanged by the reliability transmission mode, and the key parameters are negotiated, and then the end-to-end encrypted call is performed by using the negotiated key parameter in the existing media channel, thus ensuring the VoLTE-based. The security of end-to-end calls, while also ensuring national security.

Claims

A method for implementing end-to-end call encryption includes: exchanging digital certificates and performing key parameter negotiation in a reliable transmission mode during a call establishment process;

In the voice media channel, the negotiated key parameters are used for end-to-end encrypted calls.
The method of claim 1 further comprising establishing the reliable transmission method, comprising:

Establishing a first media channel, where the first media channel is a dedicated media channel for encryption negotiation; or

Introducing, in the voice media channel, a media packet in the media channel, and retransmitting the lost packet, exchanging the digital certificate and performing the key parameter negotiation.
The method of claim 2, wherein the method of establishing the first media channel is an explicit manner, and specifically includes:

In the process of establishing a call, media negotiation is performed by adding a dedicated encrypted negotiation media line in the session initial description protocol SDP to establish the first media channel.
The method of claim 2, wherein the method of establishing the first media channel is an implicit manner, specifically comprising: establishing the first media channel as a dedicated default connection.
The method according to claim 4, before the exchanging the digital certificate in the reliable transmission mode and performing the key parameter negotiation, further comprising: turning on the dedicated default connection.
The method according to claim 2, wherein when the reliable transmission mode is to introduce a method for analyzing a media packet in a media channel in the voice media channel and retransmitting the lost packet,

In the voice media channel, before the end-to-end encrypted call is performed by using the negotiated key parameter, the method further includes: restoring normal media packet processing.
The method according to any one of claims 1 to 6, wherein, in the establishing a call, the method further comprises: the session initiator carrying the first precondition in the media line of the voice media when the session request is initiated;

Wherein the first precondition is: when the digital certificate is exchanged in the reliable transmission mode The key parameter negotiation is completed, and a ringing prompt is sent to the answering party.
The method according to any one of claims 1 to 6, wherein in the establishing a call, the method further comprises: the session initiator carrying the second precondition in the media line of the voice media when the session request is initiated;

The second precondition is: completing the resource reservation, and performing a ringing prompt to the answering party.
A terminal includes a first processing module and a second processing module, where

The first processing module is configured to exchange digital certificates and perform key parameter negotiation in a reliable transmission mode during the establishment of a call;

The second processing module is configured to perform an end-to-end encrypted call by using the negotiated key parameter in the voice media channel.
The terminal according to claim 9, further comprising a transceiver module configured to perform media negotiation to establish a first media channel by adding a dedicated encryption negotiation media line in the SDP; or establishing a first media channel, that is, dedicated The media channel of the encryption negotiation is a dedicated default connection; or, the media packet in the media channel is analyzed, and the packet is retransmitted, and the normal media packet processing is resumed when the digital certificate is exchanged and the key parameters are negotiated. ;

Correspondingly,

The first processing module is specifically configured to: during the establishing a call, exchange the digital certificate in the first media channel and perform the key parameter negotiation; or use the media packet in the media channel. The method of analyzing and retransmitting the lost packet completes the exchange of the digital certificate and performs key parameter negotiation.
The terminal according to claim 10, wherein the transceiver module is further configured to:

During the establishment of the call, when the session request is initiated, the first pre-condition is carried in the media line of the voice media; wherein the first pre-condition is: completing the exchange of the digital certificate and the reliable transmission mode Key parameter negotiation; accordingly,

The terminal further includes a ringing processing module configured to initiate a ringing prompt to the answering party when the first precondition is met.
The terminal according to claim 10, wherein the transceiver module is further configured to: carry a second pre-position in a media line of the voice media when the session request is initiated during the establishing a call a condition; wherein the second precondition is: completing resource reservation; correspondingly,

The terminal further includes:

a resource reservation module, configured to complete resource reservation;

The ringing module is configured to initiate a ringing prompt to the answering party when the second precondition is met.
A network side network element, including a forwarding module and a media channel processing module;

The forwarding module is configured to forward a message during the establishment of the call;

The media channel processing module is configured to pre-establish a first media channel, where the first media channel is a dedicated media channel for encryption negotiation; and when the call establishment is completed, the pre-established first media channel is turned on.
The network side network element according to claim 13, wherein the network side network element is an IP multimedia subsystem IMS access side device.
The network side network element according to claim 14, wherein the IMS access side device is a session border controller SBC.
A computer readable storage medium storing computer executable instructions for performing the method of implementing end-to-end call encryption according to any one of rights 1 to 8.