WO2017206247A1 - 语音加密方法、装置、终端、密钥管理平台和系统 - Google Patents

语音加密方法、装置、终端、密钥管理平台和系统 Download PDF

Info

Publication number
WO2017206247A1
WO2017206247A1 PCT/CN2016/087543 CN2016087543W WO2017206247A1 WO 2017206247 A1 WO2017206247 A1 WO 2017206247A1 CN 2016087543 W CN2016087543 W CN 2016087543W WO 2017206247 A1 WO2017206247 A1 WO 2017206247A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
terminal
key
encryption algorithm
management platform
Prior art date
Application number
PCT/CN2016/087543
Other languages
English (en)
French (fr)
Inventor
钟焰涛
傅文治
蒋罗
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2017206247A1 publication Critical patent/WO2017206247A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a voice encryption method, a voice encryption device, a terminal, a key management platform, and a communication system.
  • China Telecom provides a key for the terminal by using a key management platform, and the terminal uses the key to perform voice encrypted communication through a preset voice encryption and decryption algorithm.
  • the steps of performing voice encrypted communication between the terminal 1 and the terminal 2 include: (1) the terminal 1 and the terminal 2 respectively request a key from the key management platform, and (2) the key management platform respectively issues a key to Terminal 1 and terminal 2, (3) Terminal 1 and terminal 2 perform voice encrypted communication according to the issued key.
  • the drawback of this scheme is that the voice encryption service can only be provided within the scope of the China Telecom network. If the terminal 1 and the terminal 2 belong to different operators, the scheme architecture cannot be implemented.
  • China Mobile proposes a solution that can implement voice-encrypted communication between terminals of different operators.
  • the encryption algorithms and parameter specifications supported by the scheme are determined by the key management platform.
  • the key management platform undertakes the task of negotiating and distributing keys.
  • the platform load will be large, once the platform An error occurred and the user cannot perform voice encrypted communication.
  • the present invention is based on the above problems, and proposes a new technical solution, so that terminals belonging to different operators can perform voice encrypted communication, and the key management platform is prevented from undertaking the task of negotiating and distributing keys, thereby reducing the problem.
  • the burden of the key management platform is based on the above problems, and proposes a new technical solution, so that terminals belonging to different operators can perform voice encrypted communication, and the key management platform is prevented from undertaking the task of negotiating and distributing keys, thereby reducing the problem. The burden of the key management platform.
  • the first aspect of the present invention provides a voice encryption method, including: When receiving the signal negotiated with the second terminal, the terminal negotiates with the second terminal to determine a target encryption algorithm and a target key for encryption and decryption; and reports the target encryption algorithm and the target key to the location a key management platform corresponding to the first terminal, wherein the key management platform corresponding to the first terminal confirms whether the target encryption algorithm and the target key are valid; and determining the first terminal and the second Whether each terminal in the terminal receives the target encryption algorithm sent by its corresponding key management platform and the confirmation information that the target key is valid; if each terminal receives its corresponding key management The confirmation information sent by the platform performs voice encrypted communication with the second terminal according to the target encryption algorithm and the target key.
  • the first terminal when the first terminal performs voice communication with the second terminal, the first terminal negotiates with the second terminal to determine a target encryption algorithm and a target key, and reports the target encryption algorithm and the target key to the first terminal and
  • the key management platform corresponding to each terminal in the second terminal that is, the key management platform only confirms whether the target encryption algorithm and the target key are valid, thereby avoiding the task of the key management platform undertaking negotiation and distributing keys, in particular In the case that the key management platform is heavily loaded, the burden on the key management platform is greatly reduced.
  • the first terminal and the second terminal may belong to the same operator, for example, all terminals using the China Telecom network, It can belong to different operators, for example, one is a terminal using China Telecom network, and the other is a terminal using China Mobile network.
  • the step of negotiating with the second terminal to determine a target encryption algorithm and a target key includes: an encryption algorithm supported by the first terminal and the second terminal at the same time Selecting the highest priority encryption algorithm as the target encryption algorithm; and negotiating with the second terminal according to the key agreement protocol to determine the target key.
  • the first terminal and the second terminal can be normally operated. Voice encrypted communication.
  • the method further includes: when determining to perform a voice encrypted communication with the second terminal, if a negotiation request for negotiating an encryption algorithm and an encryption key is sent to the second terminal, Determining to receive a signal negotiated with the second terminal; or determining to receive if a negotiation request for negotiating an encryption algorithm and an encryption key sent by the second terminal is received To a signal negotiated with the second terminal.
  • the process of negotiating with the second terminal may be initiated by the first terminal, or may be initiated by the second terminal, and may be negotiated with the second terminal after the negotiation is initiated.
  • the executive body of any of the above technical solutions is the first terminal.
  • a second aspect of the present invention provides a voice encryption apparatus, including: a first determining unit, configured to negotiate with the second terminal to determine a target encryption algorithm when the first terminal receives a signal negotiated with the second terminal a target key for encryption and decryption; a sending unit, configured to report the target encryption algorithm and the target key to a key management platform corresponding to the first terminal, for the first terminal
  • the key management platform confirms whether the target encryption algorithm and the target key are valid
  • the determining unit is configured to determine whether each terminal of the first terminal and the second terminal receives the corresponding key management
  • the voice communication unit is configured to: if each terminal receives the confirmation information sent by the corresponding key management platform, Performing voice encrypted communication with the second terminal according to the target encryption algorithm and the target key.
  • the first terminal when the first terminal performs voice communication with the second terminal, the first terminal negotiates with the second terminal to determine a target encryption algorithm and a target key, and reports the target encryption algorithm and the target key to the first terminal and
  • the key management platform corresponding to each terminal in the second terminal that is, the key management platform only confirms whether the target encryption algorithm and the target key are valid, thereby avoiding the task of the key management platform undertaking negotiation and distributing keys, in particular In the case that the key management platform is heavily loaded, the burden on the key management platform is greatly reduced.
  • the first terminal and the second terminal may belong to the same operator, for example, all terminals using the China Telecom network, It can belong to different operators, for example, one is a terminal using China Telecom network, and the other is a terminal using China Mobile network.
  • the first determining unit is specifically configured to: select, in the encryption algorithm supported by the first terminal and the second terminal, an encryption algorithm with the highest priority as the target encryption algorithm. And negotiating with the second terminal according to a key agreement protocol to determine the target key.
  • the encryption algorithm supported by the first terminal and the second terminal is selected at the same time.
  • the target encryption algorithm when the target encryption algorithm is used for encryption, voice encryption communication can be normally performed between the first terminal and the second terminal.
  • the method further includes: a second determining unit, configured to send, when the voice communication is performed with the second terminal, a negotiation algorithm for encrypting and encrypting And determining, by the third party determining unit, a negotiation request for negotiating the encryption algorithm and the encryption key, if the negotiation request of the key is received; And determining to receive a signal negotiated with the second terminal.
  • a second determining unit configured to send, when the voice communication is performed with the second terminal, a negotiation algorithm for encrypting and encrypting And determining, by the third party determining unit, a negotiation request for negotiating the encryption algorithm and the encryption key, if the negotiation request of the key is received; And determining to receive a signal negotiated with the second terminal.
  • the process of negotiating with the second terminal may be initiated by the first terminal, or may be initiated by the second terminal, and may be negotiated with the second terminal after the negotiation is initiated.
  • a third aspect of the present invention provides a terminal, comprising the voice encryption device according to any one of the above aspects, wherein the terminal has the same technical effect as the voice encryption device according to any one of the above aspects. , will not repeat them here.
  • a fourth aspect of the present invention provides a voice encryption method, including: receiving a target encryption algorithm sent by a terminal and a target key for encryption and decryption; determining the target according to the target encryption algorithm and the target key Whether the encryption algorithm and the target key are valid; if both the target encryption algorithm and the target key are valid, sending the target encryption algorithm and the confirmation information that the target key are valid to the terminal.
  • the terminal when both the target encryption algorithm and the target key are valid, the terminal can perform the voice encrypted communication normally by transmitting the confirmation information that both the target encryption algorithm and the target key are valid to the terminal.
  • the voice encryption method is used in a key management platform, and the key management platform only confirms whether the target encryption algorithm and the target key are valid, thereby avoiding the task of the key management platform to undertake negotiation and distribution of keys, especially in the secret.
  • the key management platform is heavily loaded, the burden on the key management platform is greatly reduced.
  • the step of determining whether the target encryption algorithm and the target key are valid in the case that the voice encryption method is used in a key management platform, specifically includes: determining the key Whether the management platform supports the target encryption algorithm; if the key management platform supports the target encryption algorithm, determining that the target encryption algorithm is valid, and if the key management platform does not support the target encryption algorithm, determining The target encryption algorithm is invalid; and determining whether the attribute of the target key meets a preset condition; if the attribute of the target key is And determining the target key to be valid according to the preset condition, and determining that the target key is invalid if the attribute of the target key does not meet the preset condition.
  • the terminal determines whether the negotiated target encryption algorithm is supported by the key management platform, and whether the attribute of the target key meets a preset condition, for example, whether the length of the target key is a preset length, Whether the format of the target key is consistent with the preset format, so that the terminal can perform voice encrypted communication according to the target encryption algorithm and the target key, thereby ensuring the reliability of communication between the terminals.
  • a fifth aspect of the present invention provides a key management platform, including: a receiving unit, configured to receive a target encryption algorithm sent by a terminal and a target key used for encryption and decryption; and a determining unit, configured to use the target encryption algorithm And determining, by the target key, whether the target encryption algorithm and the target key are valid; and sending unit, configured to send, when the target encryption algorithm and the target key are valid, to the terminal The target encryption algorithm and the target key are valid confirmation information.
  • the terminal when both the target encryption algorithm and the target key are valid, the terminal can perform the voice encrypted communication normally by transmitting the confirmation information that both the target encryption algorithm and the target key are valid to the terminal.
  • the voice encryption method is used in a key management platform, and the key management platform only confirms whether the target encryption algorithm and the target key are valid, thereby avoiding the task of the key management platform to undertake negotiation and distribution of keys, especially in the secret.
  • the key management platform is heavily loaded, the burden on the key management platform is greatly reduced.
  • the determining unit includes: a first determining subunit, configured to determine whether the key management platform supports the target encryption algorithm, if the key management platform supports the target encryption The algorithm determines that the target encryption algorithm is valid, if the key management platform does not support the target encryption algorithm, determines that the target encryption algorithm is invalid; and the second determining sub-unit is configured to determine the target key Whether the attribute meets the preset condition, if the attribute of the target key meets the preset condition, determining that the target key is valid, and if the attribute of the target key does not meet the preset condition, determining The target key is invalid.
  • the voice encryption communication can be normally performed between the terminals according to the target encryption algorithm and the target key, thereby ensuring the reliability of communication between the terminals.
  • a sixth aspect of the present invention provides a communication system, comprising: a plurality of terminals as described in the above technical solution; at least one key management platform as described in the above technical solution, and therefore, the communication system has the above The same technical effects of the terminal and the key management platform described in the technical solution are not described herein.
  • voice encryption communication can be performed between terminals belonging to different operators, and the key management platform is prevented from undertaking the task of negotiating and distributing keys, thereby reducing the burden of the key management platform.
  • FIG. 1 is a schematic diagram showing the principle of a communication system in the related art
  • FIG. 2 is a flow chart showing a voice encryption method according to an embodiment of the present invention.
  • FIG. 3 is a flow chart showing a voice encryption method according to another embodiment of the present invention.
  • FIG. 4 is a block diagram showing the structure of a voice encryption apparatus according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 6 is a flow chart showing a voice encryption method according to still another embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a key management platform according to an embodiment of the present invention.
  • FIG. 8 is a block diagram showing the structure of a communication system according to an embodiment of the present invention.
  • Figure 9 shows a schematic diagram of the principle of a communication system in accordance with one embodiment of the present invention.
  • FIG. 2 is a flow chart showing a voice encryption method according to an embodiment of the present invention.
  • a voice encryption method includes:
  • Step 202 When receiving the signal negotiated with the second terminal, the first terminal negotiates with the second terminal to determine a target encryption algorithm and a target key for encryption and decryption.
  • the method further includes: when determining to perform voice encrypted communication with the second terminal, if a negotiation request for negotiating an encryption algorithm and an encryption key is sent to the second terminal, determining to receive the second a signal negotiated by the terminal; or if a negotiation request for negotiating the encryption algorithm and the encryption key sent by the second terminal is received, determining to receive the signal negotiated with the second terminal.
  • the process of negotiating with the second terminal may be initiated by the first terminal, or may be initiated by the second terminal, and may be negotiated with the second terminal after the negotiation is initiated.
  • the step of negotiating with the second terminal to determine a target encryption algorithm and a target key comprises: selecting a highest priority among encryption algorithms supported by the first terminal and the second terminal simultaneously An encryption algorithm is used as the target encryption algorithm; and the second terminal is negotiated according to a key agreement protocol to determine the target key.
  • the voice encrypted communication can be normally performed between the first terminal and the second terminal.
  • the key agreement protocol when negotiating with the second terminal includes, but is not limited to, a Diffie-Hellman key agreement protocol.
  • Step 204 The target encryption algorithm and the target key are reported to the key management platform corresponding to the first terminal, so that the key management platform corresponding to the first terminal confirms the target encryption algorithm and the Whether the target key is valid.
  • Step 206 Determine whether each of the first terminal and the second terminal receives the target encryption algorithm sent by the corresponding key management platform and the confirmation information that the target key is valid. When it is determined that each terminal receives the confirmation information sent by its corresponding key management platform, the process proceeds to step 208, otherwise the process ends.
  • Step 208 Perform voice encrypted communication with the second terminal according to the target encryption algorithm and the target key.
  • the execution entities are all the first terminals.
  • the first terminal negotiates with the second terminal to determine the target encryption algorithm and the target key, and reports the target encryption algorithm and the target key to the key management platform corresponding to each terminal in the first terminal and the second terminal. That is, the key management platform only confirms whether the target encryption algorithm and the target key are valid, and avoids the task of the key management platform to undertake negotiation and distribution of keys, especially in the case where the key management platform is heavily loaded. Reduce the burden on the key management platform.
  • the first terminal and the second terminal may belong to the same operator, for example, all terminals using the China Telecom network, It can belong to different operators, for example, one is a terminal using China Telecom network, and the other is a terminal using China Mobile network.
  • FIG. 3 is a flow chart showing a voice encryption method according to another embodiment of the present invention.
  • a voice encryption method includes:
  • step 302 the terminal 1 and the terminal 2 confirm the voice encrypted communication.
  • step 304 the terminal 1 and the terminal 2 perform negotiation of the encryption algorithm and the key.
  • Step 306 is the negotiation successful? When the negotiation is successful, the process proceeds to step 308, otherwise to step 310.
  • the terminal 1 and the terminal 2 respectively report the negotiation result to their own key management platform.
  • the negotiation result includes: negotiating the finalized encryption algorithm and key.
  • the terminal 1 corresponds to the key management platform 1
  • the terminal 2 corresponds to the key management platform 2.
  • the terminal 1 reports the result of the negotiation to the key management platform 1, and the terminal 2 reports the result of the negotiation to the key management platform 2.
  • the negotiation failure may be caused by the following situations: (1) negotiation timeout; (2) algorithms that are not supported by the two parties; (3) failure of key agreement protocol execution.
  • the key management platform 1 and the key management platform 2 respectively confirm the negotiation result. For example, the key management platform 1 determines whether the negotiated encryption algorithm is supported by the key management platform 1, and determines whether the attributes such as the length and format of the negotiated key meet the requirements, and the key management platform 1 determines that the encryption algorithm is a key. When the management platform 1 supports and determines that the attributes such as the length and format of the key meet the requirements, the key management platform 1 transmits the confirmation information to the terminal 1 to confirm that the encryption algorithm and the key are valid. The scheme and secret of the key management platform 2 to send confirmation information The scheme of the key management platform 1 is the same and will not be described here.
  • step 314 the terminal 1 and the terminal 2 perform voice encrypted communication using the negotiated encryption algorithm and the key. Specifically, the terminal 1 receives the acknowledgment information sent by its corresponding key management platform 1, and the terminal 2 receives the acknowledgment information sent by its corresponding key management platform 2, and the terminal 1 and the terminal 2 use the negotiated encryption algorithm and The key is used for voice encrypted communication.
  • FIG. 4 is a block diagram showing the structure of a voice encrypting apparatus according to an embodiment of the present invention.
  • a speech encryption apparatus 400 includes a first determining unit 402, a transmitting unit 404, a judging unit 406, and a voice communication unit 408.
  • the first determining unit 402 is configured to negotiate with the second terminal to determine a target encryption algorithm and a target key for encryption and decryption when the first terminal receives the signal negotiated with the second terminal.
  • the first determining unit 402 is configured to: select, in the encryption algorithm supported by the first terminal and the second terminal, an encryption algorithm with the highest priority as the target encryption algorithm; and according to the key
  • the negotiation protocol negotiates with the second terminal to determine the target key.
  • the key agreement protocol when negotiating with the second terminal includes, but is not limited to, a Diffie-Hellman key agreement protocol.
  • the voice encryption device 400 further includes: a second determining unit 410, configured to send, to the second terminal, a negotiation algorithm for encrypting an encryption algorithm and an encryption key when determining to perform voice encrypted communication with the second terminal Negotiating the request, determining that the signal negotiated with the second terminal is received; or the third determining unit 412 is configured to: if receiving the negotiation request for negotiating the encryption algorithm and the encryption key sent by the second terminal, Determining that a signal negotiated with the second terminal is received.
  • a second determining unit 410 configured to send, to the second terminal, a negotiation algorithm for encrypting an encryption algorithm and an encryption key when determining to perform voice encrypted communication with the second terminal Negotiating the request, determining that the signal negotiated with the second terminal is received
  • the third determining unit 412 is configured to: if receiving the negotiation request for negotiating the encryption algorithm and the encryption key sent by the second terminal, Determining that a signal negotiated with the second terminal is received.
  • the sending unit 404 is configured to report the target encryption algorithm and the target key to a key management platform corresponding to the first terminal, so that the key management platform corresponding to the first terminal confirms the target encryption Whether the algorithm and the target key are valid.
  • the determining unit 406 is configured to determine whether each of the first terminal and the second terminal receives the confirmation that the target encryption algorithm and the target key sent by the corresponding key management platform are valid. information.
  • the voice communication unit 408 is configured to: if each of the terminals receives the confirmation information sent by the corresponding key management platform, according to the target encryption algorithm and the target key, Voice encrypted communication is performed between the second terminals.
  • the first terminal when the first terminal performs voice communication with the second terminal, the first terminal negotiates with the second terminal to determine a target encryption algorithm and a target key, and reports the target encryption algorithm and the target key to the first terminal and
  • the key management platform corresponding to each terminal in the second terminal that is, the key management platform only confirms whether the target encryption algorithm and the target key are valid, thereby avoiding the task of the key management platform undertaking negotiation and distributing keys, in particular In the case that the key management platform is heavily loaded, the burden on the key management platform is greatly reduced.
  • the first terminal and the second terminal may belong to the same operator, for example, all terminals using the China Telecom network, It can belong to different operators, for example, one is a terminal using China Telecom network, and the other is a terminal using China Mobile network.
  • FIG. 5 shows a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • a terminal 500 according to an embodiment of the present invention includes the voice encryption device 400 according to any one of the above aspects. Therefore, the terminal 500 has the above-described technical solution. The same technical effects of the voice encryption device 400 will not be described herein.
  • FIG. 6 is a flow chart showing a voice encryption method according to still another embodiment of the present invention.
  • a voice encryption method includes:
  • Step 602 Receive a target encryption algorithm sent by the terminal and a target key used for encryption and decryption.
  • Step 604 Determine, according to the target encryption algorithm and the target key, whether the target encryption algorithm and the target key are valid, and when determining that the target encryption algorithm and the target key are both valid, proceed to the step 606, otherwise, end this process.
  • the voice encryption method is used in a key management platform, and the step 604 specifically includes: determining whether the key management platform supports the target encryption algorithm; if the key management platform supports the target encryption algorithm, Determining that the target encryption algorithm is valid, if the key management platform does not support the target encryption algorithm, determining that the target encryption algorithm is invalid; and determining whether the attribute of the target key meets a preset condition; If the attribute of the target key meets the preset condition, it is determined that the target key is valid, and if the attribute of the target key does not meet the preset condition, it is determined that the target key is invalid.
  • the terminal Determine whether the negotiated target encryption algorithm is supported by the key management platform, and determine whether the attribute of the target key meets a preset condition, for example, whether the length of the target key is a preset length, and whether the format of the target key is It is consistent with the preset format, so that the terminal can perform voice encrypted communication according to the target encryption algorithm and the target key, and the reliability of communication between the terminals is ensured.
  • a preset condition for example, whether the length of the target key is a preset length, and whether the format of the target key is It is consistent with the preset format, so that the terminal can perform voice encrypted communication according to the target encryption algorithm and the target key, and the reliability of communication between the terminals is ensured.
  • Step 606 Send the target encryption algorithm and the confirmation information that the target key is valid to the terminal.
  • the terminal in a case where both the target encryption algorithm and the target key are valid, the terminal can perform the voice encrypted communication normally by transmitting the confirmation information that both the target encryption algorithm and the target key are valid to the terminal.
  • the voice encryption method is used in a key management platform, and the key management platform only confirms whether the target encryption algorithm and the target key are valid, thereby avoiding the task of the key management platform to undertake negotiation and distribution of keys, especially in the secret.
  • the burden on the key management platform is greatly reduced.
  • FIG. 7 shows a schematic structural diagram of a key management platform according to an embodiment of the present invention.
  • a key management platform 700 includes: a receiving unit 702, a determining unit 704, and a sending unit 706.
  • the receiving unit 702 is configured to receive a target encryption algorithm sent by the terminal and a target key used for encryption and decryption.
  • the determining unit 704 is configured to determine, according to the target encryption algorithm and the target key, whether the target encryption algorithm and the target key are valid.
  • the determining unit 704 includes: a first determining subunit 7042, configured to determine whether the key management platform 700 supports the target encryption algorithm, and if the key management platform 700 supports the target encryption algorithm, Determining that the target encryption algorithm is valid. If the key management platform 700 does not support the target encryption algorithm, determining that the target encryption algorithm is invalid; and the second determining subunit 7044 is configured to determine the target key. Whether the attribute meets the preset condition, if the attribute of the target key meets the preset condition, determining that the target key is valid, and if the attribute of the target key does not meet the preset condition, determining The target key is invalid.
  • the key management platform 700 By determining whether the negotiated target encryption algorithm is supported by the key management platform 700, And determining whether the attribute of the target key meets a preset condition, for example, whether the length of the target key is a preset length, and whether the format of the target key is consistent with the preset format, so that the terminal is encrypted according to the target encryption algorithm and the target.
  • the key can perform voice encrypted communication normally, which ensures the reliability of communication between terminals.
  • the sending unit 706 is configured to send, to the terminal, the acknowledgement information that both the target encryption algorithm and the target key are valid, if both the target encryption algorithm and the target key are valid.
  • the terminal in a case where both the target encryption algorithm and the target key are valid, the terminal can perform the voice encrypted communication normally by transmitting the confirmation information that both the target encryption algorithm and the target key are valid to the terminal.
  • the voice encryption method is used in the key management platform 700.
  • the key management platform 700 only confirms whether the target encryption algorithm and the target key are valid, and avoids the task of the key management platform 700 for negotiating and distributing keys. In the case where the key management platform 700 is heavily loaded, the burden on the key management platform 700 is greatly reduced.
  • FIG. 8 shows a block diagram of a communication system in accordance with one embodiment of the present invention.
  • a communication system 800 As shown in FIG. 8, a communication system 800 according to an embodiment of the present invention, a plurality of terminals 500 as described in the above technical solutions; at least one key management platform 700 as described in the above technical solution, therefore,
  • the communication system 800 has the same technical effects as the terminal 500 and the key management platform 700 described in the foregoing technical solutions, and details are not described herein again.
  • Figure 9 shows a schematic diagram of the principle of a communication system in accordance with one embodiment of the present invention.
  • the communication system includes: a terminal 1, a key management platform 1, a terminal 2, and a key management platform 2 corresponding to the terminal 2.
  • a terminal 1 As shown in FIG. 9, in this embodiment, the communication system includes: a terminal 1, a key management platform 1, a terminal 2, and a key management platform 2 corresponding to the terminal 2.
  • the scheme of performing voice encrypted communication between the terminal 1 and the terminal 2 in the communication system will be described in detail below.
  • the terminal 1 reports the negotiated encryption algorithm and the key to the key management platform 1, and the key management platform 1 confirms the encryption algorithm and the key to confirm whether the encryption algorithm is supported by the key management platform 1. And confirm whether the attributes such as the length and format of the key meet the requirements.
  • the terminal 2 reports the negotiated encryption algorithm and the key to the key management platform 2, and the key management platform 2 confirms the encryption algorithm and the key to confirm whether the encryption algorithm is supported by the key management platform 2, and confirms the confidentiality. Whether the attributes such as the length and format of the key meet the requirements.
  • the key management platform 1 confirms that the encryption algorithm is supported by the key management platform 1, and when the confirmation key meets the requirements, transmits the confirmation information that both the encryption algorithm and the key are valid to the terminal 1.
  • the key management platform 2 confirms that the encryption algorithm is supported by the key management platform 2, and when the confirmation key meets the requirements, transmits the confirmation information that both the encryption algorithm and the key are valid to the terminal 2.
  • the terminal 1 When the terminal 1 receives the acknowledgment information that both the encryption algorithm and the key are valid, and the terminal 2 receives the acknowledgment information that both the encryption algorithm and the key are valid, the terminal 1 and the terminal 2 perform the encryption algorithm and the key according to the negotiation. Voice encrypted communication.
  • the technical solution of the present invention enables voice encrypted communication between terminals belonging to different operators, and avoids the task of the key management platform undertaking negotiation and distribution of keys. , thereby reducing the burden on the key management platform.
  • the terms “first” and “second” are used for the purpose of description only, and are not to be construed as indicating or implying relative importance; the term “plurality” means two or more.
  • the specific meanings of the above terms in the present invention can be understood on a case-by-case basis.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明提出了一种语音加密方法、装置、终端、密钥管理平台和系统，其中，该语音加密方法包括：第一终端在接收到与第二终端协商的信号时，与第二终端协商以确定目标加密算法和用于加解密的目标密钥；将目标加密算法和目标密钥上报至第一终端对应的密钥管理平台；判断第一终端和第二终端中的每个终端是否接收到其对应的密钥管理平台发送的目标加密算法和目标密钥均有效的确认信息；若每个终端均接收到其对应的密钥管理平台发送的确认信息，则根据目标加密算法和目标密钥，与第二终端之间进行语音加密通信。通过本发明的技术方案，使得属于不同运营商的终端之间可以进行语音加密通信，同时避免了密钥管理平台承担协商、分发密钥的任务。

Description

语音加密方法、装置、终端、密钥管理平台和系统 技术领域
本发明涉及通信技术领域，具体而言，涉及一种语音加密方法、一种语音加密装置、一种终端、一种密钥管理平台和一种通信系统。
背景技术
目前，为实现语音加密通信，中国电信通过采用密钥管理平台为终端提供密钥，终端之间使用该密钥、通过预设的语音加解密算法进行语音加密通信。如图1所示，终端1和终端2进行语音加密通信的步骤包括：(1)终端1和终端2分别向密钥管理平台请求密钥，(2)密钥管理平台分别下发密钥至终端1和终端2，(3)终端1和终端2根据下发的密钥进行语音加密通信。但是，这种方案的缺陷是，只能在中国电信网络范围内提供语音加密服务，如果终端1和终端2属于不同的运营商，则这种方案架构无法实施。
中国移动提出一种可以在不同运营商的终端之间实现语音加密通信的方案。该方案所支持的加密算法、参数规格等均由密钥管理平台确定，换句话说，密钥管理平台承担协商、分发密钥的任务，在大规模系统中该平台负荷会很大，一旦平台出错，用户无法进行语音加密通信。
因此，如何使得属于不同运营商的终端之间可以进行语音加密通信，同时可以降低密钥管理平台的负担成为亟待解决的问题。
发明内容
本发明正是基于上述问题，提出了一种新的技术方案，使得属于不同运营商的终端之间可以进行语音加密通信，同时避免了密钥管理平台承担协商、分发密钥的任务，从而降低密钥管理平台的负担。
有鉴于此，本发明的第一方面提出了一种语音加密方法，包括：第一 终端在接收到与第二终端协商的信号时，与所述第二终端协商以确定目标加密算法和用于加解密的目标密钥；将所述目标加密算法和所述目标密钥上报至所述第一终端对应的密钥管理平台，以供所述第一终端对应的密钥管理平台确认所述目标加密算法和所述目标密钥是否有效；判断所述第一终端和所述第二终端中的每个终端是否接收到其对应的密钥管理平台发送的所述目标加密算法和所述目标密钥均有效的确认信息；若所述每个终端均接收到其对应的密钥管理平台发送的所述确认信息，则根据所述目标加密算法和所述目标密钥，与所述第二终端之间进行语音加密通信。
在该技术方案中，在第一终端与第二终端进行语音通信时，第一终端与第二终端协商确定目标加密算法和目标密钥，将目标加密算法和目标密钥上报至第一终端和第二终端中的每个终端对应的密钥管理平台，即密钥管理平台仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台承担协商、分发密钥的任务，特别是在密钥管理平台负荷很大的情况下，大大降低了密钥管理平台的负担。另外，由于是终端各自对应的密钥管理平台确认目标加密算法和目标密钥是否有效，则第一终端和第二终端可以属于同一个运营商，例如，都是使用中国电信网络的终端，也可以属于不同的运营商，例如，一个是使用中国电信网络的终端，另一个是使用中国移动网络的终端。
在上述技术方案中，优选地，所述与所述第二终端协商以确定目标加密算法和目标密钥的步骤，具体包括：在所述第一终端和所述第二终端同时支持的加密算法中选择优先级最高的加密算法作为所述目标加密算法；以及根据密钥协商协议与所述第二终端协商，以确定所述目标密钥。
在该技术方案中，通过选择第一终端和第二终端同时支持的加密算法作为目标加密算法，则在使用该目标加密算法进行加密时，可以保证第一终端与第二终端之间可以正常进行语音加密通信。
在上述任一技术方案中，优选地，还包括：在确定与所述第二终端进行语音加密通信时，若向所述第二终端发送用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号；或者若接收到所述第二终端发送的用于协商加密算法和加密密钥的协商请求，则确定接收 到与所述第二终端协商的信号。
在该技术方案中，与第二终端进行协商的过程可以由第一终端发起，还可以由第二终端发起，在发起协商后就可以与第二终端进行协商。
上述任一项技术方案的执行主体均是第一终端。
本发明的第二方面提出了一种语音加密装置，包括：第一确定单元，用于在第一终端接收到与第二终端协商的信号时，与所述第二终端协商以确定目标加密算法和用于加解密的目标密钥；发送单元，用于将所述目标加密算法和所述目标密钥上报至所述第一终端对应的密钥管理平台，以供所述第一终端对应的密钥管理平台确认所述目标加密算法和所述目标密钥是否有效；判断单元，用于判断所述第一终端和所述第二终端中的每个终端是否接收到其对应的密钥管理平台发送的所述目标加密算法和所述目标密钥均有效的确认信息；语音通信单元，用于若所述每个终端均接收到其对应的密钥管理平台发送的所述确认信息，则根据所述目标加密算法和所述目标密钥，与所述第二终端之间进行语音加密通信。
在该技术方案中，在第一终端与第二终端进行语音通信时，第一终端与第二终端协商确定目标加密算法和目标密钥，将目标加密算法和目标密钥上报至第一终端和第二终端中的每个终端对应的密钥管理平台，即密钥管理平台仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台承担协商、分发密钥的任务，特别是在密钥管理平台负荷很大的情况下，大大降低了密钥管理平台的负担。另外，由于是终端各自对应的密钥管理平台确认目标加密算法和目标密钥是否有效，则第一终端和第二终端可以属于同一个运营商，例如，都是使用中国电信网络的终端，也可以属于不同的运营商，例如，一个是使用中国电信网络的终端，另一个是使用中国移动网络的终端。
在上述技术方案中，优选地，所述第一确定单元具体用于，在所述第一终端和所述第二终端同时支持的加密算法中选择优先级最高的加密算法作为所述目标加密算法；以及根据密钥协商协议与所述第二终端协商，以确定所述目标密钥。
在该技术方案中，通过选择第一终端和第二终端同时支持的加密算法 作为目标加密算法，则在使用该目标加密算法进行加密时，可以保证第一终端与第二终端之间可以正常进行语音加密通信。
在上述任一技术方案中，优选地，还包括：第二确定单元，用于在确定与所述第二终端进行语音加密通信时，若向所述第二终端发送用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号；或者第三确定单元，用于若接收到所述第二终端发送的用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号。
在该技术方案中，与第二终端进行协商的过程可以由第一终端发起，还可以由第二终端发起，在发起协商后就可以与第二终端进行协商。
本发明的第三方面提出了一种终端，包括上述技术方案中任一项所述的语音加密装置，因此，该终端具有和上述技术方案中任一项所述的语音加密装置相同的技术效果，在此不再赘述。
本发明的第四方面提出了一种语音加密方法，包括：接收终端发送的目标加密算法和用于加解密的目标密钥；根据所述目标加密算法和所述目标密钥，判断所述目标加密算法和所述目标密钥是否有效；若所述目标加密算法和所述目标密钥均有效，则向所述终端发送所述目标加密算法和所述目标密钥均有效的确认信息。
在该技术方案中，在目标加密算法和目标密钥都有效的情况下，通过向终端发送目标加密算法和目标密钥均有效的确认信息，以使终端可以正常进行语音加密通信。优选地，语音加密方法用于密钥管理平台，密钥管理平台仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台承担协商、分发密钥的任务，特别是在密钥管理平台负荷很大的情况下，大大降低了密钥管理平台的负担。
在上述技术方案中，优选地，在所述语音加密方法用于密钥管理平台的情况下，判断所述目标加密算法和所述目标密钥是否有效的步骤，具体包括：判断所述密钥管理平台是否支持所述目标加密算法；若所述密钥管理平台支持所述目标加密算法，则判定所述目标加密算法有效，若所述密钥管理平台不支持所述目标加密算法，则判定所述目标加密算法无效；以及判断所述目标密钥的属性是否符合预设条件；若所述目标密钥的属性符 合所述预设条件，则判定所述目标密钥有效，若所述目标密钥的属性不符合所述预设条件，则判定所述目标密钥无效。
在该技术方案中，通过判断协商出的目标加密算法是否是密钥管理平台所支持的，以及判断目标密钥的属性是否符合预设条件，例如，目标密钥的长度是否是预设长度，目标密钥的格式是否与预设格式一致，以使终端之间根据目标加密算法和目标密钥可以正常进行语音加密通信，保证了终端之间进行通信的可靠性。
本发明的第五方面提出了一种密钥管理平台，包括：接收单元，用于接收终端发送的目标加密算法和用于加解密的目标密钥；判断单元，用于根据所述目标加密算法和所述目标密钥，判断所述目标加密算法和所述目标密钥是否有效；发送单元，用于若所述目标加密算法和所述目标密钥均有效，则向所述终端发送所述目标加密算法和所述目标密钥均有效的确认信息。
在该技术方案中，在目标加密算法和目标密钥都有效的情况下，通过向终端发送目标加密算法和目标密钥均有效的确认信息，以使终端可以正常进行语音加密通信。优选地，语音加密方法用于密钥管理平台，密钥管理平台仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台承担协商、分发密钥的任务，特别是在密钥管理平台负荷很大的情况下，大大降低了密钥管理平台的负担。
在上述技术方案中，优选地，所述判断单元包括：第一判断子单元，用于判断所述密钥管理平台是否支持所述目标加密算法，若所述密钥管理平台支持所述目标加密算法，则判定所述目标加密算法有效，若所述密钥管理平台不支持所述目标加密算法，则判定所述目标加密算法无效；以及第二判断子单元，用于判断所述目标密钥的属性是否符合预设条件，若所述目标密钥的属性符合所述预设条件，则判定所述目标密钥有效，若所述目标密钥的属性不符合所述预设条件，则判定所述目标密钥无效。
在该技术方案中，通过判断协商出的目标加密算法是否是密钥管理平台所支持的，以及判断目标密钥的属性是否符合预设条件，例如，目标密钥的长度是否是预设长度，目标密钥的格式是否与预设格式一致，以使终 端之间根据目标加密算法和目标密钥可以正常进行语音加密通信，保证了终端之间进行通信的可靠性。
本发明的第六方面提出了一种通信系统，包括：多个如上述技术方案中所述的终端；至少一个如上述技术方案中所述的密钥管理平台，因此，该通信系统具有和上述技术方案中所述的终端、密钥管理平台相同的技术效果，在此不再赘述。
通过本发明的技术方案，使得属于不同运营商的终端之间可以进行语音加密通信，同时避免了密钥管理平台承担协商、分发密钥的任务，从而降低密钥管理平台的负担。
附图说明
图1示出了相关技术中的通信系统的原理示意图；
图2示出了根据本发明的一个实施例的语音加密方法的流程示意图；
图3示出了根据本发明的另一个实施例的语音加密方法的流程示意图；
图4示出了根据本发明的一个实施例的语音加密装置的结构示意图；
图5示出了根据本发明的一个实施例的终端的结构示意图；
图6示出了根据本发明的又一个实施例的语音加密方法的流程示意图；
图7示出了根据本发明的一个实施例的密钥管理平台的结构示意图；
图8示出了根据本发明的一个实施例的通信系统的结构示意图；
图9示出了根据本发明的一个实施例的通信系统的原理示意图。
具体实施方式
为了可以更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用其他不同于在此描述的其他方式来实施，因此，本发明 的保护范围并不受下面公开的具体实施例的限制。
图2示出了根据本发明的一个实施例的语音加密方法的流程示意图。
如图2所示，根据本发明的一个实施例的语音加密方法，包括：
步骤202，第一终端在接收到与第二终端协商的信号时，与所述第二终端协商以确定目标加密算法和用于加解密的目标密钥。
优选地，还包括：在确定与所述第二终端进行语音加密通信时，若向所述第二终端发送用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号；或者若接收到所述第二终端发送的用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号。与第二终端进行协商的过程可以由第一终端发起，还可以由第二终端发起，在发起协商后就可以与第二终端进行协商。
优选地，所述与所述第二终端协商以确定目标加密算法和目标密钥的步骤，具体包括：在所述第一终端和所述第二终端同时支持的加密算法中选择优先级最高的加密算法作为所述目标加密算法；以及根据密钥协商协议与所述第二终端协商，以确定所述目标密钥。
通过选择第一终端和第二终端同时支持的加密算法作为目标加密算法，则在使用该目标加密算法进行加密时，可以保证第一终端与第二终端之间可以正常进行语音加密通信。另外，与第二终端协商时的密钥协商协议包括但不限于Diffie-Hellman密钥协商协议。
步骤204，将所述目标加密算法和所述目标密钥上报至所述第一终端对应的密钥管理平台，以供所述第一终端对应的密钥管理平台确认所述目标加密算法和所述目标密钥是否有效。
步骤206，判断所述第一终端和所述第二终端中的每个终端是否接收到其对应的密钥管理平台发送的所述目标加密算法和所述目标密钥均有效的确认信息，在判定所述每个终端均接收到其对应的密钥管理平台发送的所述确认信息时，进入步骤208，否则结束本次流程。
步骤208，根据所述目标加密算法和所述目标密钥，与所述第二终端之间进行语音加密通信。
在上述技术方案中，执行主体均是第一终端。在第一终端与第二终端 进行语音通信时，第一终端与第二终端协商确定目标加密算法和目标密钥，将目标加密算法和目标密钥上报至第一终端和第二终端中的每个终端对应的密钥管理平台，即密钥管理平台仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台承担协商、分发密钥的任务，特别是在密钥管理平台负荷很大的情况下，大大降低了密钥管理平台的负担。另外，由于是终端各自对应的密钥管理平台确认目标加密算法和目标密钥是否有效，则第一终端和第二终端可以属于同一个运营商，例如，都是使用中国电信网络的终端，也可以属于不同的运营商，例如，一个是使用中国电信网络的终端，另一个是使用中国移动网络的终端。
图3示出了根据本发明的另一个实施例的语音加密方法的流程示意图。
如图3所示，根据本发明的另一个实施例的语音加密方法，包括：
步骤302，终端1和终端2确认进行语音加密通信。
步骤304，终端1和终端2进行加密算法和密钥的协商。
步骤306，协商是否成功？在协商成功时，进入步骤308，否则进入步骤310。
步骤308，终端1和终端2各自将协商结果上报给自己的密钥管理平台。其中，协商结果包括：协商最终确定的加密算法和密钥。例如，终端1对应密钥管理平台1，终端2对应密钥管理平台2，终端1将协商结果上报至密钥管理平台1，终端2将协商结果上报至密钥管理平台2。
步骤310，失败退出。协商失败的情况可能由以下几种情况导致：(1)协商超时；(2)双方没有共同支持的算法；(3)密钥协商协议执行失败等情况。
步骤312，密钥管理平台1和密钥管理平台2分别对协商结果进行确认。例如，密钥管理平台1判断协商的加密算法是否密钥管理平台1所支持的，并判断协商的密钥的长度和格式等属性是否符合要求，在密钥管理平台1判定加密算法是密钥管理平台1所支持的，且判定密钥的长度和格式等属性符合要求的情况下，密钥管理平台1向终端1发送确认信息，以确认加密算法和密钥是有效的。密钥管理平台2发送确认信息的方案和密 钥管理平台1的方案相同，在此不再赘述。
步骤314，终端1和终端2使用所协商的加密算法和密钥进行语音加密通信。具体地，终端1接收到其对应的密钥管理平台1发送的确认信息，且终端2接收到其对应的密钥管理平台2发送的确认信息，终端1和终端2使用所协商的加密算法和密钥进行语音加密通信。
图4示出了根据本发明的一个实施例的语音加密装置的结构示意图。
如图4所示，根据本发明的一个实施例的语音加密装置400，包括：第一确定单元402、发送单元404、判断单元406和语音通信单元408。
第一确定单元402，用于在第一终端接收到与第二终端协商的信号时，与所述第二终端协商以确定目标加密算法和用于加解密的目标密钥。
优选地，所述第一确定单元402具体用于，在所述第一终端和所述第二终端同时支持的加密算法中选择优先级最高的加密算法作为所述目标加密算法；以及根据密钥协商协议与所述第二终端协商，以确定所述目标密钥。其中，与第二终端协商时的密钥协商协议包括但不限于Diffie-Hellman密钥协商协议。
优选地，语音加密装置400还包括：第二确定单元410，用于在确定与所述第二终端进行语音加密通信时，若向所述第二终端发送用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号；或者第三确定单元412，用于若接收到所述第二终端发送的用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号。
发送单元404，用于将所述目标加密算法和所述目标密钥上报至所述第一终端对应的密钥管理平台，以供所述第一终端对应的密钥管理平台确认所述目标加密算法和所述目标密钥是否有效。
判断单元406，用于判断所述第一终端和所述第二终端中的每个终端是否接收到其对应的密钥管理平台发送的所述目标加密算法和所述目标密钥均有效的确认信息。
语音通信单元408，用于若所述每个终端均接收到其对应的密钥管理平台发送的所述确认信息，则根据所述目标加密算法和所述目标密钥，与 所述第二终端之间进行语音加密通信。
在该技术方案中，在第一终端与第二终端进行语音通信时，第一终端与第二终端协商确定目标加密算法和目标密钥，将目标加密算法和目标密钥上报至第一终端和第二终端中的每个终端对应的密钥管理平台，即密钥管理平台仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台承担协商、分发密钥的任务，特别是在密钥管理平台负荷很大的情况下，大大降低了密钥管理平台的负担。另外，由于是终端各自对应的密钥管理平台确认目标加密算法和目标密钥是否有效，则第一终端和第二终端可以属于同一个运营商，例如，都是使用中国电信网络的终端，也可以属于不同的运营商，例如，一个是使用中国电信网络的终端，另一个是使用中国移动网络的终端。
图5示出了根据本发明的一个实施例的终端的结构示意图。
如图5所示，根据本发明的一个实施例的终端500，包括上述技术方案中任一项所述的语音加密装置400，因此，该终端500具有和上述技术方案中任一项所述的语音加密装置400相同的技术效果，在此不再赘述。
图6示出了根据本发明的又一个实施例的语音加密方法的流程示意图。
如图6所示，根据本发明的又一个实施例的语音加密方法，包括：
步骤602，接收终端发送的目标加密算法和用于加解密的目标密钥。
步骤604，根据所述目标加密算法和所述目标密钥，判断所述目标加密算法和所述目标密钥是否有效，在判定所述目标加密算法和所述目标密钥均有效时，进入步骤606，否则，结束本次流程。
优选地，所述语音加密方法用于密钥管理平台，步骤604具体包括：判断所述密钥管理平台是否支持所述目标加密算法；若所述密钥管理平台支持所述目标加密算法，则判定所述目标加密算法有效，若所述密钥管理平台不支持所述目标加密算法，则判定所述目标加密算法无效；以及判断所述目标密钥的属性是否符合预设条件；若所述目标密钥的属性符合所述预设条件，则判定所述目标密钥有效，若所述目标密钥的属性不符合所述预设条件，则判定所述目标密钥无效。
通过判断协商出的目标加密算法是否是密钥管理平台所支持的，以及判断目标密钥的属性是否符合预设条件，例如，目标密钥的长度是否是预设长度，目标密钥的格式是否与预设格式一致，以使终端之间根据目标加密算法和目标密钥可以正常进行语音加密通信，保证了终端之间进行通信的可靠性。
步骤606，向所述终端发送所述目标加密算法和所述目标密钥均有效的确认信息。
在上述技术方案中，在目标加密算法和目标密钥都有效的情况下，通过向终端发送目标加密算法和目标密钥均有效的确认信息，以使终端可以正常进行语音加密通信。优选地，语音加密方法用于密钥管理平台，密钥管理平台仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台承担协商、分发密钥的任务，特别是在密钥管理平台负荷很大的情况下，大大降低了密钥管理平台的负担。
图7示出了根据本发明的一个实施例的密钥管理平台的结构示意图。
如图7所示，根据本发明的一个实施例的密钥管理平台700，包括：接收单元702、判断单元704和发送单元706。
接收单元702，用于接收终端发送的目标加密算法和用于加解密的目标密钥。
判断单元704，用于根据所述目标加密算法和所述目标密钥，判断所述目标加密算法和所述目标密钥是否有效。
优选地，所述判断单元704包括：第一判断子单元7042，用于判断所述密钥管理平台700是否支持所述目标加密算法，若所述密钥管理平台700支持所述目标加密算法，则判定所述目标加密算法有效，若所述密钥管理平台700不支持所述目标加密算法，则判定所述目标加密算法无效；以及第二判断子单元7044，用于判断所述目标密钥的属性是否符合预设条件，若所述目标密钥的属性符合所述预设条件，则判定所述目标密钥有效，若所述目标密钥的属性不符合所述预设条件，则判定所述目标密钥无效。
通过判断协商出的目标加密算法是否是密钥管理平台700所支持的， 以及判断目标密钥的属性是否符合预设条件，例如，目标密钥的长度是否是预设长度，目标密钥的格式是否与预设格式一致，以使终端之间根据目标加密算法和目标密钥可以正常进行语音加密通信，保证了终端之间进行通信的可靠性。
发送单元706，用于若所述目标加密算法和所述目标密钥均有效，则向所述终端发送所述目标加密算法和所述目标密钥均有效的确认信息。
在上述技术方案中，在目标加密算法和目标密钥都有效的情况下，通过向终端发送目标加密算法和目标密钥均有效的确认信息，以使终端可以正常进行语音加密通信。优选地，语音加密方法用于密钥管理平台700，密钥管理平台700仅确认目标加密算法和目标密钥是否有效即可，避免了密钥管理平台700承担协商、分发密钥的任务，特别是在密钥管理平台700负荷很大的情况下，大大降低了密钥管理平台700的负担。
图8示出了根据本发明的一个实施例的通信系统的结构示意图。
如图8所示，根据本发明的一个实施例的通信系统800，多个如上述技术方案中所述的终端500；至少一个如上述技术方案中所述的密钥管理平台700，因此，该通信系统800具有和上述技术方案中所述的终端500、密钥管理平台700相同的技术效果，在此不再赘述。
图9示出了根据本发明的一个实施例的通信系统的原理示意图。
如图9所示，在该实施例中，通信系统包括：终端1、终端1对应的密钥管理平台1、终端2、终端2对应的密钥管理平台2。下面详细介绍该通信系统中终端1和终端2进行语音加密通信的方案。
(1)终端1和终端2之间确认进行语音加密通信。
(2)终端1和终端2之间协商加密算法、密钥。
(3)终端1将协商的加密算法和密钥上报至密钥管理平台1，密钥管理平台1对加密算法和密钥进行确认，以确认加密算法是否是密钥管理平台1所支持的，并确认密钥的长度和格式等属性是否符合要求。终端2将协商的加密算法和密钥上报至密钥管理平台2，密钥管理平台2对加密算法和密钥进行确认，以确认加密算法是否是密钥管理平台2所支持的，并确认密钥的长度和格式等属性是否符合要求。
(4)密钥管理平台1确认加密算法是密钥管理平台1所支持的，且确认密钥符合要求时，向终端1发送加密算法和密钥均有效的确认信息。密钥管理平台2确认加密算法是密钥管理平台2所支持的，且确认密钥符合要求时，向终端2发送加密算法和密钥均有效的确认信息。
(5)在终端1接收到加密算法和密钥均有效的确认信息，且终端2接收到加密算法和密钥均有效的确认信息时，终端1和终端2根据协商的加密算法和密钥进行语音加密通信。
以上结合附图详细说明了本发明的技术方案，通过本发明的技术方案，使得属于不同运营商的终端之间可以进行语音加密通信，同时避免了密钥管理平台承担协商、分发密钥的任务，从而降低密钥管理平台的负担。
在本发明中，术语“第一”、“第二”仅用于描述的目的，而不能理解为指示或暗示相对重要性；术语“多个”表示两个或两个以上。对于本领域的普通技术人员而言，可以根据具体情况理解上述术语在本发明中的具体含义。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (12)

  1. 一种语音加密方法，其特征在于，包括：
    第一终端在接收到与第二终端协商的信号时，与所述第二终端协商以确定目标加密算法和用于加解密的目标密钥；
    将所述目标加密算法和所述目标密钥上报至所述第一终端对应的密钥管理平台，以供所述第一终端对应的密钥管理平台确认所述目标加密算法和所述目标密钥是否有效；
    判断所述第一终端和所述第二终端中的每个终端是否接收到其对应的密钥管理平台发送的所述目标加密算法和所述目标密钥均有效的确认信息；
    若所述每个终端均接收到其对应的密钥管理平台发送的所述确认信息，则根据所述目标加密算法和所述目标密钥，与所述第二终端之间进行语音加密通信。
  2. 根据权利要求1所述的语音加密方法，其特征在于，所述与所述第二终端协商以确定目标加密算法和用于加解密的目标密钥的步骤，具体包括：
    在所述第一终端和所述第二终端同时支持的加密算法中选择优先级最高的加密算法作为所述目标加密算法；以及
    根据密钥协商协议与所述第二终端协商，以确定所述目标密钥。
  3. 根据权利要求1或2所述的语音加密方法，其特征在于，还包括：
    在确定与所述第二终端进行语音加密通信时，若向所述第二终端发送用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号；或者
    若接收到所述第二终端发送的用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号。
  4. 一种语音加密装置，其特征在于，包括：
    第一确定单元，用于在第一终端接收到与第二终端协商的信号时，与 所述第二终端协商以确定目标加密算法和用于加解密的目标密钥；
    发送单元，用于将所述目标加密算法和所述目标密钥上报至所述第一终端对应的密钥管理平台，以供所述第一终端对应的密钥管理平台确认所述目标加密算法和所述目标密钥是否有效；
    判断单元，用于判断所述第一终端和所述第二终端中的每个终端是否接收到其对应的密钥管理平台发送的所述目标加密算法和所述目标密钥均有效的确认信息；
    语音通信单元，用于若所述每个终端均接收到其对应的密钥管理平台发送的所述确认信息，则根据所述目标加密算法和所述目标密钥，与所述第二终端之间进行语音加密通信。
  5. 根据权利要求4所述的语音加密装置，其特征在于，所述第一确定单元具体用于，
    在所述第一终端和所述第二终端同时支持的加密算法中选择优先级最高的加密算法作为所述目标加密算法，以及根据密钥协商协议与所述第二终端协商，以确定所述目标密钥。
  6. 根据权利要求4或5所述的语音加密装置，其特征在于，还包括：
    第二确定单元，用于在确定与所述第二终端进行语音加密通信时，若向所述第二终端发送用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号；或者
    第三确定单元，用于若接收到所述第二终端发送的用于协商加密算法和加密密钥的协商请求，则确定接收到与所述第二终端协商的信号。
  7. 一种终端，其特征在于，包括：如权利要求4至6中任一项所述的语音加密装置。
  8. 一种语音加密方法，其特征在于，包括：
    接收终端发送的目标加密算法和用于加解密的目标密钥；
    根据所述目标加密算法和所述目标密钥，判断所述目标加密算法和所述目标密钥是否有效；
    若所述目标加密算法和所述目标密钥均有效，则向所述终端发送所述 目标加密算法和所述目标密钥均有效的确认信息。
  9. 根据权利要求8所述的语音加密方法，其特征在于，所述语音加密方法用于密钥管理平台，其中，判断所述目标加密算法和所述目标密钥是否有效的步骤，具体包括：
    判断所述密钥管理平台是否支持所述目标加密算法；
    若所述密钥管理平台支持所述目标加密算法，则判定所述目标加密算法有效，若所述密钥管理平台不支持所述目标加密算法，则判定所述目标加密算法无效；以及
    判断所述目标密钥的属性是否符合预设条件；
    若所述目标密钥的属性符合所述预设条件，则判定所述目标密钥有效，若所述目标密钥的属性不符合所述预设条件，则判定所述目标密钥无效。
  10. 一种密钥管理平台，其特征在于，包括：
    接收单元，用于接收终端发送的目标加密算法和用于加解密的目标密钥；
    判断单元，用于根据所述目标加密算法和所述目标密钥，判断所述目标加密算法和所述目标密钥是否有效；
    发送单元，用于若所述目标加密算法和所述目标密钥均有效，则向所述终端发送所述目标加密算法和所述目标密钥均有效的确认信息。
  11. 根据权利要求10所述的密钥管理平台，其特征在于，所述判断单元包括：
    第一判断子单元，用于判断所述密钥管理平台是否支持所述目标加密算法，若所述密钥管理平台支持所述目标加密算法，则判定所述目标加密算法有效，若所述密钥管理平台不支持所述目标加密算法，则判定所述目标加密算法无效；以及
    第二判断子单元，用于判断所述目标密钥的属性是否符合预设条件，若所述目标密钥的属性符合所述预设条件，则判定所述目标密钥有效，若所述目标密钥的属性不符合所述预设条件，则判定所述目标密钥无效。
  12. 一种通信系统，其特征在于，包括：
    多个如权利要求7所述的终端；
    至少一个如权利要求10或11所述的密钥管理平台。
PCT/CN2016/087543 2016-05-31 2016-06-29 语音加密方法、装置、终端、密钥管理平台和系统 WO2017206247A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610378602.XA CN106101081B (zh) 2016-05-31 2016-05-31 语音加密方法、装置、终端、密钥管理平台和系统
CN201610378602.X 2016-05-31

Publications (1)

Publication Number Publication Date
WO2017206247A1 true WO2017206247A1 (zh) 2017-12-07

Family

ID=57230662

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/087543 WO2017206247A1 (zh) 2016-05-31 2016-06-29 语音加密方法、装置、终端、密钥管理平台和系统

Country Status (2)

Country Link
CN (1) CN106101081B (zh)
WO (1) WO2017206247A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114040385A (zh) * 2021-11-17 2022-02-11 中国电信集团系统集成有限责任公司 一种基于VoLTE的加密通话系统及方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108718302A (zh) * 2018-05-09 2018-10-30 北京邦邦共赢网络科技有限公司 一种消息记录的同步方法、装置以及设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101345965A (zh) * 2008-08-29 2009-01-14 中国电信股份有限公司 基于语音码流的加密通话方法以及移动终端
CN101931949A (zh) * 2010-08-11 2010-12-29 中兴通讯股份有限公司 一种移动终端间明话和密话通信切换的方法及系统
CN102685746A (zh) * 2012-05-03 2012-09-19 中兴通讯股份有限公司 一种对移动设备验证的方法、装置及系统
US20120331298A1 (en) * 2010-03-11 2012-12-27 Huawei Technologies Co., Ltd. Security authentication method, apparatus, and system
CN105282734A (zh) * 2014-06-11 2016-01-27 中国移动通信集团公司 一种实现跨网络保密通话的方法、终端、无线网关及系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1601958B (zh) * 2003-09-26 2010-05-12 北京三星通信技术研究有限公司 基于cave算法的hrpd网络接入认证方法
CN100373991C (zh) * 2005-06-30 2008-03-05 中国科学院计算技术研究所 一种分组网络中语音通信的加密协商方法
CN101043323B (zh) * 2007-03-13 2010-05-26 宁波大学 一种面向无线移动终端的信息安全服务方法
CN101183935A (zh) * 2007-12-17 2008-05-21 华为技术有限公司 Rtp报文的密钥协商方法、装置及系统
CN102711100B (zh) * 2012-04-24 2015-04-15 中国联合网络通信集团有限公司 语音加解密处理方法、基站及网络系统
CN102833246A (zh) * 2012-08-24 2012-12-19 南京大学 一种社交视频信息安全方法与系统
CN103095696B (zh) * 2013-01-09 2015-08-05 中国电力科学研究院 一种适用于用电信息采集系统的身份认证和密钥协商方法
CN103974241B (zh) * 2013-02-05 2018-01-16 东南大学常州研究院 一种面向Android系统移动终端的语音端到端加密方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101345965A (zh) * 2008-08-29 2009-01-14 中国电信股份有限公司 基于语音码流的加密通话方法以及移动终端
US20120331298A1 (en) * 2010-03-11 2012-12-27 Huawei Technologies Co., Ltd. Security authentication method, apparatus, and system
CN101931949A (zh) * 2010-08-11 2010-12-29 中兴通讯股份有限公司 一种移动终端间明话和密话通信切换的方法及系统
CN102685746A (zh) * 2012-05-03 2012-09-19 中兴通讯股份有限公司 一种对移动设备验证的方法、装置及系统
CN105282734A (zh) * 2014-06-11 2016-01-27 中国移动通信集团公司 一种实现跨网络保密通话的方法、终端、无线网关及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114040385A (zh) * 2021-11-17 2022-02-11 中国电信集团系统集成有限责任公司 一种基于VoLTE的加密通话系统及方法

Also Published As

Publication number Publication date
CN106101081B (zh) 2020-02-21
CN106101081A (zh) 2016-11-09

Similar Documents

Publication Publication Date Title
US11218459B2 (en) Reoccuring keying system
CN110635901B (zh) 用于物联网设备的本地蓝牙动态认证方法和系统
WO2009117844A1 (en) Methods and entities using ipsec esp to support security functionality for udp-based oma enablers
CN109936529A (zh) 一种安全通信的方法、装置和系统
JP2020533853A (ja) デジタル証明書を管理するための方法および装置
WO2015164999A1 (zh) 虚拟卡下载方法、终端及中间设备
WO2012083828A1 (zh) 本地路由业务的实现方法、基站及系统
CN109104273B (zh) 报文处理方法以及接收端服务器
CN110650009B (zh) 一种移动网络及通信方法
TW202023227A (zh) 在用戶和可信計算群集之間建立可信通道的方法及裝置
CN111064738B (zh) 一种tls安全通信的方法及系统
US11258782B2 (en) Peer-to-peer notification system
WO2017206247A1 (zh) 语音加密方法、装置、终端、密钥管理平台和系统
EP1713210A1 (en) A method for the achievement of the message transmission in the h323 system
EP2922325A1 (en) Method and apparatus for communication security processing
WO2017024470A1 (zh) 变更mcptt用户与mcptt群组关联关系的方法、装置及系统
CN114173328B (zh) 密钥交换方法、装置、电子设备
CN111357305B (zh) 可移动平台的通信方法、设备、系统及存储介质
JPWO2016147382A1 (ja) 暗号通信システムの端末装置、暗号通信システムの中継装置、暗号通信システムの制御方法
JP5327896B2 (ja) 無線ｌａｎアクセスポイントおよび無線端末の接続維持方法
JP2013512631A (ja) サービスフローの暗号化処理方法及びシステム
US20190281033A1 (en) Communication apparatus, communication method, and program
CN115086951A (zh) 一种报文传输系统、方法及装置
WO2022021258A1 (zh) 一种通信方法及装置
CN115037504A (zh) 通信方法及装置

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16903629

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16903629

Country of ref document: EP

Kind code of ref document: A1