WO2017215443A1 - 报文传输方法、装置及系统 - Google Patents

报文传输方法、装置及系统 Download PDF

Info

Publication number
WO2017215443A1
WO2017215443A1 PCT/CN2017/086614 CN2017086614W WO2017215443A1 WO 2017215443 A1 WO2017215443 A1 WO 2017215443A1 CN 2017086614 W CN2017086614 W CN 2017086614W WO 2017215443 A1 WO2017215443 A1 WO 2017215443A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
end device
public key
receiving
sending end
Prior art date
Application number
PCT/CN2017/086614
Other languages
English (en)
French (fr)
Inventor
王一
张鹏刚
于飞
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017215443A1 publication Critical patent/WO2017215443A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network

Definitions

  • the present invention relates to the field of communications, and in particular, to a message transmission method, apparatus, and system.
  • VoIP voice over Internet Protocol
  • IP Internet Protocol
  • RTP Real-time Transport Protocol
  • the digital-to-analog is converted into an analog signal and sent to the receiver.
  • the terminal that is, complete the basic voice call.
  • Double Tone Multi-frequency (DTMF) and special fax and modem modem tone are used as voice signals.
  • DTMF Double Tone Multi-frequency
  • the out-of-band mode is generally RFC2833 (Request For Comments, RTP packet encapsulation and transmission in the form of RFC for short message, which not only reduces the burden of sound detection caused by in-band transmission of the network voice terminal system, but also avoids low bit rate codec errors such as G.723.1.
  • the traditional RFC2833 message encryption transmission uses a symmetric encryption algorithm, and both sender and receiver use the same key for encryption.
  • the key itself is written to the device or sent to the device through the protocol stream.
  • the key cannot be modified after being fixed, and the flexibility is poor. Once a device key is leaked, the encryption of the RFC2833 message sent by the entire network device will be invalid, which has a great impact.
  • the plaintext key is transmitted in the protocol stream, which is poor in security and can be easily cracked.
  • Other methods, such as ciphertext transmission of symmetric keys in the protocol stream are essentially symmetric encryption methods, and the same two problems exist.
  • the advantage of this encryption method is that the algorithm complexity is low and does not increase the CPU load of the terminal.
  • the embodiment of the invention provides a message transmission method, device and system, so as to at least solve the problem of poor security of message transmission in the related art.
  • a packet transmission method including: a transmitting end device transmitting a pre-generated asymmetrically encrypted public key to a receiving end device; and the transmitting end device receiving the first key, wherein the transmitting end device receives the first key, where The first key is obtained by the receiving end device using the public key to encrypt a symmetric encryption key; the sending end device decrypts the first key according to a locally stored private key to obtain the symmetric encryption. a key; the sender device encrypts the packet to be transmitted by using the symmetric encryption key, and sends the packet to the receiving device.
  • the sending end device transmits the randomly generated asymmetrically encrypted public key to the receiving end device, where the sending end device transmits the public key to the receiving end device in a clear text.
  • the sending end device receives the first key obtained by the receiving end device using the public key to encrypt a symmetric encryption key, and the method includes: the sending end device receiving the receiving end device in the form of a ciphertext The first key sent.
  • the transmitting device transmits the randomly generated asymmetrically encrypted public key to the receiving device
  • the sending device randomly generates the asymmetrically encrypted public key and the private key, and stores the private key. locally.
  • the message to be transmitted includes: requesting an annotation RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • a message transmission method including: a receiving end device receiving a public key sent by a sending end device, and using the public key to encrypt a symmetric encryption key to obtain a first key, where The public key is an asymmetrically encrypted public key generated by the sending end device; the first key is sent to the sending end device, where the sending end device is based on a private key corresponding to the public key Decrypting the first key to obtain the symmetric encryption key; receiving the message sent by the sending end device, where the message is a message encrypted by the sending end device by using the symmetric encryption key.
  • the receiving end device receives the public key sent by the sending end device, where the receiving end device receives the public key that is sent by the sending end device in the form of a plaintext.
  • the sending the first key to the sending end device comprises: the receiving end device transmitting the first key to the sending end device in the form of cipher text.
  • the packet includes: an RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • a message transmission apparatus which is applied to a source device, and includes: a first sending module, configured to transmit a pre-generated asymmetrically encrypted public key to a receiving end device; a receiving module, configured to receive a first key obtained by the receiving end device using the public key to encrypt a symmetric encryption key, and decrypt the first key by using a locally stored private key to obtain the symmetric encryption a second sending module, configured to encrypt the message to be transmitted by using the symmetric encryption key, and send the message to the receiving end device.
  • the first sending module is further configured to transmit the public key to the receiving end device in a clear text.
  • the first receiving module is further configured to receive the first key that is sent by the receiving end device in the form of cipher text.
  • the first sending module is further configured to be a randomly generated asymmetrically encrypted public Before the key is transmitted to the receiving device, the asymmetrically encrypted public key and the private key are randomly generated, and the private key is stored locally.
  • the message to be transmitted includes: requesting an annotation RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • a message transmission apparatus which is applied to a receiving end device, and includes: a second receiving module, configured to receive a public key sent by a sending end device, and use the public key to encrypt symmetric encryption.
  • the key is obtained by the first key, wherein the public key is an asymmetrically encrypted public key generated by the sending device, and the third sending module is configured to send the first key to the sending device.
  • the sending end device decrypts the first key according to the private key corresponding to the public key to obtain the symmetric encryption key; and the third receiving module is configured to receive the packet sent by the sending end device.
  • the packet is a packet encrypted by the sending end device by using the symmetric encryption key.
  • the second receiving module is further configured to receive a public key that is sent by the sending end device in a plaintext form.
  • the third sending module is further configured to transmit the first key to the sending end device in the form of cipher text.
  • the packet includes: an RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • a message transmission system including: a transmitting end device, a receiving end device; and a transmitting end device transmitting a pre-generated asymmetrically encrypted public key to a receiving end device; the receiving After receiving the public key sent by the sending end device, the end device obtains the first key by using the public key to encrypt the symmetric encryption key, and sends the first key to the sending end device; The end device decrypts the first key by using a locally stored private key to obtain the symmetric encryption key; the sending end device encrypts the to-be-transmitted message by using the symmetric encryption key, and transmits the message To the receiving device.
  • a storage medium is also provided.
  • the storage medium is arranged to store program code for performing the following steps: the sender device will generate a pre-generated asymmetry Transmitting the encrypted public key to the receiving end device; the transmitting end device receiving the first key, wherein the first key is obtained by the receiving end device using the public key to encrypt a symmetric encryption key; The end device decrypts the first key according to the locally stored private key to obtain the symmetric encryption key; the sending end device encrypts the packet to be transmitted by using the symmetric encryption key, and the packet is Sent to the receiving device.
  • the storage medium is further arranged to store program code for performing the following steps:
  • the receiving end device receives the public key sent by the sending end device, and uses the public key to encrypt the symmetric encryption key to obtain the first key, where the public key is an asymmetrically encrypted public key generated by the sending end device;
  • the transmitting device randomly generates the asymmetrically encrypted public key and the private key, and sends the public key to the receiving device.
  • the receiving device uses the public key to encrypt the symmetric encryption key, and the sending device receives the public key.
  • the encrypted symmetric encryption key has a private key to decrypt the key to obtain a symmetric encryption key, and then the transmitting device and the receiving device transmit the message through the symmetric encryption key.
  • FIG. 1 is a flowchart 1 of a message transmission method according to an embodiment of the present invention.
  • FIG. 2 is a second flowchart of a message transmission method according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a message transmission system according to an alternative embodiment of the present invention.
  • FIG. 5 is a structural block diagram of a message transmission apparatus applied to a transmitting end device according to an embodiment of the present invention
  • FIG. 6 is a structural block diagram of a message transmission apparatus applied to a receiving end device according to an embodiment of the present invention.
  • the embodiments described in this document can be used in the gateway device, including but not limited to the following types: various uplink home gateways and their uplink devices, trunk gateways and their subordinate user interface devices, access gateways, etc.,
  • the core gateway can directly or indirectly hang the fax machine, and the upstream can connect to the Ethernet directly or indirectly.
  • Embodiments of the invention may operate on such gateways.
  • FIG. 1 is a flowchart 1 of a packet transmission method according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps. :
  • Step S102 the transmitting end device transmits the pre-generated asymmetrically encrypted public key to the receiving end device;
  • Step S104 the sending end device receives the first key, where the first key is obtained by the receiving end device using the public key to encrypt a symmetric encryption key;
  • Step S106 The sending end device decrypts the first key according to the locally stored private key to obtain the symmetric encryption key.
  • Step S108 the sender device encrypts the packet to be transmitted by using the symmetric encryption key. And send the message to the receiving device.
  • the transmitting end device and the receiving end device transmit the symmetric encryption key through the asymmetrically encrypted public key and the private key. After the symmetric encryption key is exchanged between the two, the symmetric encryption key is used to transmit the message.
  • the problem of poor security of message transmission in the related art is solved, and the security of message transmission is greatly improved. .
  • the sending end device transmits the public key to the receiving end device in a plaintext form.
  • the sending end device receives the first key that is sent by the receiving end device in the form of cipher text.
  • the sending device sends the public key in plain text.
  • the receiving device sends the first key in cipher text, which increases the security of sending the first key.
  • the transmitting device transmits the randomly generated asymmetrically encrypted public key to the receiving end device
  • the sending end device randomly generates the asymmetrically encrypted public key and the private key, and stores the private key locally.
  • the to-be-transmitted message includes: requesting an annotation RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • FIG. 2 is a flowchart 2 of a packet transmission method according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps. :
  • Step S202 The receiving end device receives the public key sent by the sending end device, and uses the public key to encrypt the symmetric encryption key to obtain the first key, where the public key is an asymmetrically encrypted public key generated by the sending end device;
  • Step S204 the first key is sent to the sending end device, where the sending end device decrypts the first key according to the private key corresponding to the public key to obtain the symmetric encryption key;
  • Step S206 Receive a packet sent by the sending end device, where the packet is a packet encrypted by the sending end device by using the symmetric encryption key.
  • the receiving end device receives the public key that is sent by the sending end device in the form of a plaintext.
  • the receiving end device transmits the first key to the sending end in the form of cipher text Ready.
  • the message includes: an RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • the optional embodiment of the present invention provides a method for transmitting the content of the RFC2833 message for the network stealing and attacking the voice call data, and combining the symmetric encryption and the asymmetric encryption algorithm.
  • the asymmetric encryption algorithm with high complexity and security is used to encrypt the key of the symmetric encryption algorithm
  • the symmetric encryption algorithm with low complexity is used to encrypt the RFC2833 message.
  • Step 1 The call originator (equivalent to the sender device in the foregoing embodiment) randomly generates the asymmetrically encrypted public key and the private key, and the public key is sent in the form of plaintext through the signaling negotiation process, and the private key is stored locally;
  • Step 2 The call receiver (corresponding to the receiving device in the foregoing embodiment) randomly generates a symmetric encryption key when the public key of the call originator is received, and the copy is saved locally;
  • Step 3 The call receiver encrypts the randomly generated symmetric encryption key by using the public key transmitted by the call initiator, and sends the key in the form of ciphertext to the call initiator through the signaling negotiation response;
  • Step 4 The call initiator decrypts the symmetrically encrypted ciphertext key by using the locally saved private key.
  • Step 5 At this time, both parties of the call have saved the symmetrically encrypted plaintext key, and the symmetric encrypted plaintext key can be used to encrypt the RFC2833 message and transmit the message.
  • the signaling negotiation may be a softswitch voice communication protocol negotiation such as a Session Initiation Protocol (SIP) or a Media Gateway Control Protocol H248.
  • SIP Session Initiation Protocol
  • H248 Media Gateway Control Protocol
  • the call originator and the call recipient may be home gateway devices.
  • the symmetric encryption and decryption algorithm may be a Data Encryption Standard (DES) algorithm.
  • the asymmetric encryption algorithm may be an RSA encryption algorithm. (Rivest-Shamir-Adleman, referred to as RSA).
  • an asymmetric encryption algorithm is introduced in an optional embodiment of the present invention, and a public key and a private key are randomly generated.
  • the call receiver uses a public key to encrypt a symmetric encryption key, and the call initiator uses a private key. Decryption, the public key and the private key cannot be deduced from each other.
  • the calling device does not need a preset key, and does not need the signaling server to participate in key distribution.
  • the principle of asymmetric encryption greatly improves the security of RFC2833 packets transmitted in the network.
  • Sex while not encrypting the RFC2833 message with the public key itself, but encrypting the second symmetric encryption key, using the ciphertext to transmit the symmetric encryption key in the network, decrypting the private key and encrypting the RFC2833 message with the symmetric encryption key.
  • the solution is an RFC2833 message encryption and decryption transmission technology that does not increase the system load and improves the security of the voice user information. .
  • FIG. 3 is a schematic structural diagram of a message transmission system according to an alternative embodiment of the present invention. As shown in FIG. 3, this embodiment describes a module architecture for transmitting RFC2833 messages between a local phone user and a remote phone voice banking device.
  • the module architecture includes: gateway device A, gateway device B, signaling server, telephone, and telephone voice banking device.
  • the gateway system in Figure 3 is a gateway-based integrated system product, including but not limited to the following types: various uplink home gateways and their uplink devices, trunk gateways and their associated user interface devices, access Gateway, etc. Among them, the core gateway can directly or indirectly hang the fax machine, and the uplink can directly or indirectly connect to the Ethernet.
  • the implementation code of the method runs on such a gateway.
  • the Call Signaling Server is a device that handles call signaling, including but not limited to sip servers, softswitches, and the like.
  • the phone is used to generate DTMF signals, and the gateway device converts the encrypted RFC2833 message to Ethernet for transmission.
  • the telephone voice bank processes the RFC2833 message that has been decrypted and decoded by the gateway device.
  • the specific implementation process uses the system of FIG. 3 as the hardware architecture, and does not describe the process of the gateway device converting the DTMF signal into the RFC2833 message, nor the process of processing the decrypted RFC2833 message by the telephone voice bank.
  • An optional embodiment of the present invention performs a telephone banking by using a telephone
  • the service is an example that describes the process of encrypting, decrypting, and transmitting RFC2833 messages.
  • Both the gateway device A and the gateway device B support an asymmetric first encryption algorithm RSA and a symmetric second encryption algorithm DES.
  • the key of the first encryption algorithm is called a first public key and a first private key, and the second encryption algorithm The key is called the second key.
  • the encryption algorithm itself can also be negotiated, but it should not be an important technical point of the present invention and will not be described in detail.
  • FIG. 4 is a flowchart of a message transmission method according to an alternative embodiment of the present invention. As shown in FIG. 4, the specific steps are as follows:
  • S401 The user phone dials, and the gateway device A randomly generates the first public key and the first private key according to the RSA algorithm;
  • the gateway device A saves the first private key to the local device, initiates a call negotiation, and carries the first public key in the extension field.
  • the gateway device B After receiving the call negotiation initiated by the gateway device A, the gateway device B randomly generates a second key according to the DES algorithm, and saves the local key to the local device.
  • the gateway device B reads the first public key in the call negotiation extension field, and encrypts the second key by using the first public key.
  • the gateway device B carries the second key in the cipher text in the extension field of the call negotiation response.
  • the gateway device A After receiving the call negotiation response, the gateway device A establishes a call normally; the gateway device A reads the second key in the ciphertext form carried in the extended field of the call negotiation response, and decrypts the ciphertext form with the first private key.
  • the second key is the second key in plain text and is saved locally.
  • the phone user starts pressing the button according to the prompt of the voice banking system, and the DTMF signal of the gateway device A conversion button is an RFC2833 message; the gateway device A encrypts and transmits the RFC2833 message by using the second key;
  • the gateway device B After receiving the encrypted RFC2833 message, the gateway device B uses the locally saved second key for decryption and subsequent service processing.
  • any method for processing RFC2833 messages by using an asymmetric encryption algorithm belongs to the scope of this patent protection, and it can be determined whether the method is used by capturing packet signaling and media information.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method of various embodiments of the present invention.
  • a message transmission device is also provided, which is used to implement the foregoing embodiments and preferred embodiments, and has not been described again.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 5 is a structural block diagram of a message transmission apparatus applied to a transmitting end device according to an embodiment of the present invention. As shown in FIG. 5, the apparatus includes:
  • the first sending module 52 is configured to transmit the pre-generated asymmetrically encrypted public key to the receiving end device;
  • the first receiving module 54 is connected to the first sending module 52, and configured to receive the first key obtained by the receiving end device using the public key to encrypt the symmetric encryption key, and use the locally stored private key to the first key. Decrypting to obtain the symmetric encryption key;
  • the second sending module 56 is connected to the first receiving module 54 and configured to use the symmetric encryption
  • the key encrypts the packet to be transmitted, and sends the packet to the receiving device.
  • the first sending module 52 is further configured to transmit the public key to the receiving end device in a plaintext form.
  • the first receiving module 54 is further configured to receive the first key that is sent by the receiving end device in the form of cipher text.
  • the first sending module 52 is further configured to randomly generate the asymmetrically encrypted public key and the private key before transmitting the randomly generated asymmetrically encrypted public key to the receiving end device, and store the private key in the local.
  • the to-be-transmitted message includes: requesting an annotation RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • FIG. 6 is a structural block diagram of a message transmission apparatus applied to a receiving end device according to an embodiment of the present invention. As shown in FIG. 6, the apparatus includes:
  • the second receiving module 62 is configured to receive a public key sent by the sending end device, and use the public key to encrypt the symmetric encryption key to obtain a first key, where the public key is an asymmetrically encrypted public key generated by the sending end device. ;
  • the third sending module 64 is connected to the second receiving module 62, and configured to send the first key to the sending end device, where the sending end device decrypts the first key according to a private key corresponding to the public key Obtaining the symmetric encryption key;
  • the third receiving module 66 is connected to the third sending module 64, and is configured to receive the packet sent by the sending end device, where the packet is a packet encrypted by the sending end device by using the symmetric encryption key.
  • the second receiving module 62 is further configured to receive a public key that is sent by the sending end device in a clear text.
  • the third sending module 64 is further configured to transmit the first key to the sending end device in the form of cipher text.
  • the message includes: an RFC2833 message.
  • the sending end device and the receiving end device are both gateway devices.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • a message transmission system which includes: a sender device, a receiver device;
  • the sending end device transmits the pre-generated asymmetrically encrypted public key to the receiving end device
  • the receiving end device After receiving the public key sent by the sending end device, the receiving end device uses the public key to encrypt the symmetric encryption key to obtain the first key, and sends the first key to the sending end device;
  • the sending end device decrypts the first key by using a locally stored private key to obtain the symmetric encryption key
  • the sender device encrypts the packet to be transmitted by using the symmetric encryption key, and transmits the packet to the receiving device.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the sending end device transmits the pre-generated asymmetrically encrypted public key to the receiving end device.
  • the sending end device receives the first key, where the first key is obtained by the receiving end device using the public key to encrypt a symmetric encryption key;
  • the sending end device decrypts the first key according to the locally stored private key to obtain the symmetric encryption key.
  • the sending end device encrypts the to-be-transmitted packet by using the symmetric encryption key, and sends the packet to the receiving end device.
  • a storage medium is also provided.
  • the storage medium is arranged to store program code for performing the following steps:
  • the receiving end device receives the public key sent by the sending end device, and uses the public key to encrypt the symmetric encryption key to obtain the first key, where the public key is an asymmetrically encrypted public key generated by the sending end device;
  • the first key is sent to the sending end device, where the sending end device decrypts the first key according to the private key corresponding to the public key to obtain the symmetric encryption key;
  • S7 Receive a packet sent by the sending end device, where the packet is a packet encrypted by the sending end device by using the symmetric encryption key.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • the processor executes the method steps described in the foregoing embodiments according to the stored program code in the storage medium.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the transmitting device randomly generates the asymmetrically encrypted public key and the private key, and sends the public key to the receiving device.
  • the receiving device uses the public key to encrypt the symmetric encryption key, and the sending device receives the public key.
  • the encrypted symmetric encryption key has a private key to decrypt the key to obtain a symmetric encryption key, and then the transmitting device and the receiving device transmit the message through the symmetric encryption key.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种报文传输方法、装置及系统，其中，该方法包括：发送端设备将预先生成的非对称加密的公钥传输到接收端设备；该发送端设备接收该接收端设备使用该公钥加密对称加密密钥得到的第一密钥，并使用本地存储的私钥对该第一密钥解密，得到该对称加密密钥；该发送端设备使用该对称加密密钥加密待传输的报文，并将该报文发送到该接收端设备。采用上述技术方案，解决了相关技术中报文传输安全性差的问题，大幅提高了报文传输的安全性。

Description

报文传输方法、装置及系统 技术领域
本发明涉及通信领域，具体而言，涉及一种报文传输方法、装置及系统。
背景技术
随着网络技术的发展，基于IP网络的语音传输技术(Voice over Internet Protocol，简称为VoIP)越来越得到广泛的应用。VoIP实现过程：首先将发话端的模拟语音信息经过模数转换成数字信号，再经过数字信号处理(Digital Signal Processing，简称为DSP)相关技术处理进行语音编码，接着进行封包增加控制信息，通过网络协议(Internet Protocol，简称为IP)网络把实时传输协议(Real-time Transport Protocol，简称为RTP)传输到目的端，最后DSP把RTP报文解码及相关还原工作，数模转换成模拟信号送给受话端，即完成基本的语音通话。双音多频(Double Tone Multi-frequency，简称DTMF)及特殊传真、调制解调器modem信号音作为语音信号，有带内、带外两种传送方式，带外方式一般以RFC2833(请求注解Request For Comments，简称为RFC)报文格式的RTP报文封装传送，这样既减轻了网络语音终端系统的带内传输带来的音检测工作负担，同时也避免了如G.723.1等低比特率编解码器误检测DTMF问题，提高了语音终端设备自动识别DTMF能力，所以这种特殊信号以RFC2833报文方式传输；但由于其携带信息的透明性(明文数字传输，简单抓包手段就能截获和分析)和特殊性(如银行卡密码在电话中的输入交互)，往往容易被网络窃听，对用户造成经济损失。而对整个VoIP通话的语音进行加密保护又会增加终端的中央处理器(Central Processing Unit，简称为CPU)负载，因此，对其特殊信息进行加密保护尤其显得重要。
传统的RFC2833报文加密传输采用对称加密算法，收发双方采用相同的密钥进行加密。密钥本身写死在设备中，或者通过协议流下发到设备。 前一种方法，密钥固定后无法修改，灵活性差，一旦一台设备密钥泄露，全网设备发送RFC2833报文的加密都会失效，影响巨大。后一种方法，密钥虽然支持灵活可配和实时变化，但在协议流中传输明文密钥，安全性差，极易被破解。而其他方法，比如密文在协议流中传输对称密钥，本质还是对称加密方法，同样存在上述两种问题。但这种加密方式的优点是算法复杂度低，不会增加终端的CPU负荷。
针对相关技术中报文传输安全性差的问题，目前还没有有效地解决方案。
发明内容
本发明实施例提供了一种报文传输方法、装置及系统，以至少解决相关技术中报文传输安全性差的问题。
根据本发明的一个实施例，提供了一种报文传输方法，包括：发送端设备将预先生成的非对称加密的公钥传输到接收端设备；所述发送端设备接收第一密钥，其中，所述第一密钥是所述接收端设备使用所述公钥加密对称加密密钥得到；所述发送端设备根据本地存储的私钥对所述第一密钥解密，得到所述对称加密密钥；所述发送端设备使用所述对称加密密钥加密待传输的报文，并将所述报文发送到所述接收端设备。
可选地，发送端设备将随机生成的非对称加密的公钥传输到接收端设备，包括：所述发送端设备以明文的形式将所述公钥传输到所述接收端设备。
可选地，所述发送端设备接收所述接收端设备使用所述公钥加密对称加密密钥得到的第一密钥，包括：所述发送端设备接收所述接收端设备以密文的形式发送的所述第一密钥。
可选地，发送端设备将随机生成的非对称加密的公钥传输到接收端设备之前，包括：所述发送端设备随机生成非对称加密的公钥和私钥，并将所述私钥存储在本地。
可选地，所述待传输的报文包括：请求注解RFC2833报文。
可选地，所述发送端设备和所述接收端设备均为网关设备。
根据本发明的一个实施例，提供了一种报文传输方法，包括：接收端设备接收发送端设备发送的公钥，使用所述公钥加密对称加密密钥得到第一密钥，其中，所述公钥为所述发送端设备生成的非对称加密的公钥；将所述第一密钥发送到所述发送端设备，其中，所述发送端设备依据与所述公钥对应的私钥解密所述第一密钥得到所述对称加密密钥；接收所述发送端设备发送的报文，其中，所述报文为所述发送端设备使用所述对称加密密钥加密的报文。
可选地，接收端设备接收发送端设备发送的公钥，包括：所述接收端设备接收所述发送端设备以明文的形式发送的公钥。
可选地，将所述第一密钥发送到所述发送端设备，包括：所述接收端设备以密文的形式将所述第一密钥传输到所述发送端设备。
可选地，所述报文包括：RFC2833报文。
可选地，所述发送端设备和所述接收端设备均为网关设备。
根据本发明的另一个实施例，提供了一种报文传输装置，应用于发送端设备，包括：第一发送模块，设置为将预先生成的非对称加密的公钥传输到接收端设备；第一接收模块，设置为接收所述接收端设备使用所述公钥加密对称加密密钥得到的第一密钥，并使用本地存储的私钥对所述第一密钥解密，得到所述对称加密密钥；第二发送模块，设置为使用所述对称加密密钥加密待传输的报文，并将所述报文发送到所述接收端设备。
可选地，所述第一发送模块还设置为以明文的形式将所述公钥传输到所述接收端设备。
可选地，所述第一接收模块还设置为接收所述接收端设备以密文的形式发送的所述第一密钥。
可选地，所述第一发送模块还设置为在将随机生成的非对称加密的公 钥传输到接收端设备之前，随机生成非对称加密的公钥和私钥，并将所述私钥存储在本地。
可选地，所述待传输的报文包括：请求注解RFC2833报文。
可选地，所述发送端设备和所述接收端设备均为网关设备。
根据本发明的另一个实施例，提供了一种报文传输装置，应用于接收端设备，包括：第二接收模块，设置为接收发送端设备发送的公钥，使用所述公钥加密对称加密密钥得到第一密钥，其中，所述公钥为所述发送端设备生成的非对称加密的公钥；第三发送模块，设置为将所述第一密钥发送到所述发送端设备，其中，所述发送端设备依据与所述公钥对应的私钥解密所述第一密钥得到所述对称加密密钥；第三接收模块，设置为接收所述发送端设备发送的报文，其中，所述报文为所述发送端设备使用所述对称加密密钥加密的报文。
可选地，所述第二接收模块还设置为接收所述发送端设备以明文的形式发送的公钥。
可选地，第三发送模块还设置为以密文的形式将所述第一密钥传输到所述发送端设备。
可选地，所述报文包括：RFC2833报文。
可选地，所述发送端设备和所述接收端设备均为网关设备。
根据本发明的另一个实施例，提供了一种报文传输系统，包括：发送端设备，接收端设备；发送端设备将预先生成的非对称加密的公钥传输到接收端设备；所述接收端设备在接收所述发送端设备发送的公钥之后，使用所述公钥加密对称加密密钥得到第一密钥，并将所述第一密钥发送到所述发送端设备；所述发送端设备使用本地存储的私钥解密所述第一密钥，得到所述对称加密密钥；所述发送端设备使用所述对称加密密钥加密待传输的报文，并将所述报文传输到所述接收端设备。
根据本发明的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：发送端设备将预先生成的非对称 加密的公钥传输到接收端设备；所述发送端设备接收第一密钥，其中，所述第一密钥是所述接收端设备使用所述公钥加密对称加密密钥得到；所述发送端设备根据本地存储的私钥对所述第一密钥解密，得到所述对称加密密钥；所述发送端设备使用所述对称加密密钥加密待传输的报文，并将所述报文发送到所述接收端设备。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：
接收端设备接收发送端设备发送的公钥，使用所述公钥加密对称加密密钥得到第一密钥，其中，所述公钥为所述发送端设备生成的非对称加密的公钥；
将所述第一密钥发送到所述发送端设备，其中，所述发送端设备依据与所述公钥对应的私钥解密所述第一密钥得到所述对称加密密钥；
接收所述发送端设备发送的报文，其中，所述报文为所述发送端设备使用所述对称加密密钥加密的报文。
通过本发明实施例，发送端设备随机生成非对称加密的公钥和私钥，将公钥发送到接收端设备，接收端设备采用公钥加密对称加密密钥，发送端设备接收到被公钥加密过的对称加密密钥，有私钥解密上述密钥，得到对称加密密钥，然后，发送端设备和接收端设备通过对称加密密钥传输报文。采用上述技术方案，解决了相关技术中报文传输安全性差的问题，大幅提高了报文传输的安全性。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的一种报文传输方法流程图一；
图2是根据本发明实施例的一种报文传输方法流程图二；
图3是根据本发明可选实施例的报文传输系统结构示意图；
图4是根据本发明可选实施例的报文传输方法流程图；
图5是根据本发明实施例的应用于发送端设备的报文传输装置的结构框图；
图6是根据本发明实施例的应用于接收端设备的报文传输装置的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请文件记载的实施例可以运行于网关设备中，包括但不限于以下种类：各种上行的家庭网关及其上行设备、中继网关及其下挂用户接口设备、接入网关等，其中，核心的网关能直接或间接下挂传真机，上行能直接或间接连接以太网。本发明实施例可以运行在此类网关上。
在本实施例中提供了一种运行于上述网关设备的报文传输方法，图1是根据本发明实施例的一种报文传输方法流程图一，如图1所示，该流程包括如下步骤：
步骤S102，发送端设备将预先生成的非对称加密的公钥传输到接收端设备；
步骤S104，该发送端设备接收第一密钥，其中，该第一密钥是该接收端设备使用该公钥加密对称加密密钥得到的；
步骤S106，该发送端设备根据本地存储的私钥对该第一密钥解密，得到该对称加密密钥；
步骤S108，该发送端设备使用该对称加密密钥加密待传输的报文， 并将该报文发送到该接收端设备。
通过上述步骤，发送端设备与接收端设备通过非对称加密的公钥和私钥来传输对称加密密钥，在二者交互了对称加密密钥之后，通过对称加密密钥进行报文的传输，解决了相关技术中报文传输安全性差的问题，大幅提高了报文传输的安全性。。
可选地，该发送端设备以明文的形式将该公钥传输到该接收端设备。该发送端设备接收该接收端设备以密文的形式发送的该第一密钥。发送端设备发送公钥时采用明文形式发送，接收端设备发送第一密钥时采用密文形式发送，增加了发送第一密钥的安全性。
可选地，发送端设备将随机生成的非对称加密的公钥传输到接收端设备之前，该发送端设备随机生成非对称加密的公钥和私钥，并将该私钥存储在本地。
可选地，该待传输的报文包括：请求注解RFC2833报文。
可选地，该发送端设备和该接收端设备均为网关设备。
在本实施例中提供了一种运行于上述网关设备的报文传输方法，图2是根据本发明实施例的一种报文传输方法流程图二，如图2所示，该流程包括如下步骤：
步骤S202，接收端设备接收发送端设备发送的公钥，使用该公钥加密对称加密密钥得到第一密钥，其中，该公钥为该发送端设备生成的非对称加密的公钥；
步骤S204，将该第一密钥发送到该发送端设备，其中，该发送端设备依据与该公钥对应的私钥解密该第一密钥得到该对称加密密钥；
步骤S206，接收该发送端设备发送的报文，其中，该报文为该发送端设备使用该对称加密密钥加密的报文。
可选地，该接收端设备接收该发送端设备以明文的形式发送的公钥。
可选地，该接收端设备以密文的形式将该第一密钥传输到该发送端设 备。
可选地，该报文包括：RFC2833报文。
可选地，该发送端设备和该接收端设备均为网关设备。
针对相关技术中存在的传输报文安全性差的问题，本发明可选实施例针对网络窃取、攻击语音通话数据，结合对称加密和非对称加密算法，提出了一种RFC2833报文的内容传输方法。在本实施例的技术方案中，不仅仅采用对称加密方式，而用复杂度和安全性高的非对称加密算法加密对称加密算法的密钥，用复杂度低的对称加密算法加密RFC2833报文，采用上述技术方案，保证了不增加设备CPU负荷的情况下，保证了报文内容在网络中传输的安全性。
本发明的可选实施例记载的技术方案步骤如下：
步骤一，通话发起方(相当于上述实施例中的发送端设备)随机产生非对称加密的公钥和私钥，公钥通过信令协商过程以明文的形式发送，私钥保存在本地；
步骤二，通话接收方(相当于上述实施例中的接收端设备)在收到通话发起方的公钥时，随机产生对称加密密钥，复制一份保存在本地；
步骤三，通话接收方采用通话发起方传输的公钥来加密随机产生的对称加密密钥，通过信令协商应答以密文的形式发送密钥到通话发起方；
步骤四，通话发起方通过本地保存的私钥解密对称加密的密文密钥；
步骤五，此时通话双方都已经保存对称加密的明文密钥，可以采用该对称加密明文密钥加密RFC2833报文，并进行传输报文。
其中，在本申请的可选实施例中，该的信令协商可以是会话初始协议(Session Initiation Protocol，简称为SIP)、媒体网关控制协议H248等软交换语音通信协议协商。该通话发起方和通话接收方可以是家庭网关设备。该对称加解密算法可以是数据加密标准(Data Encryption Standard，简称为DES)算法。该非对称加密算法可以是RSA加密算法 (Rivest-Shamir-Adleman，简称为RSA)。
与相关技术相比较，本发明可选实施例中引入了非对称加密算法，采用了随机产生公钥和私钥方式，通话接收方采用公钥加密对称加密密钥，通话发起方采用私钥进行解密，公钥和私钥无法相互推导，通话设备双方不需要预置密钥，不需要信令服务器参与密钥分发，利用非对称加密的原理极大提高了RFC2833报文在网络中传输的安全性，同时不是用公钥本身加密RFC2833报文，而是加密第二种对称加密密钥，用密文将对称加密密钥在网络中传输，私钥解密后使用对称加密密钥加密RFC2833报文，这样不加重设备CPU负荷，就保证了语音媒体传输对家庭网关等嵌入式系统的实时性要求，该方案是一种不加重系统负荷，提高语音用户信息安全性的RFC2833报文加解密传输技术。
图3是根据本发明可选实施例的报文传输系统结构示意图，如图3所示，本实施例描述的是本地话机用户和远端电话语音银行设备之间进行RFC2833报文传输的模块构架图，该模块架构包括：网关设备A、网关设备B、信令服务器、话机、电话语音银行设备。
图3中的网关系统是一种以网关为核心综合系统产品，包括但不受限于以下种类：各种上行的家庭网关及其上行设备、中继网关及其下挂用户接口设备、接入网关等。其中，核心的网关能直接或间接下挂传真机，上行能直接或间接连接以太网，本方法的实现代码就运行此类网关上。
呼叫信令服务器是一种处理通话信令的设备，包括但不受限于sip服务器、软交换等。
话机用于产生DTMF信号，进过网关设备转换为加密RFC2833报文在以太网上传输。
电话语音银行处理进过网关设备解密和解码的RFC2833报文。
具体实施过程以图3系统为硬件构架，不累述网关设备转换DTMF信号为RFC2833报文的过程，也不累述电话语音银行处理解密后的RFC2833报文过程。本发明可选实施例以用户使用话机开展一次电话银行 业务为例，描述RFC2833报文加密，解密和传输的过程。网关设备A和网关设备B都支持非对称的第一加密算法RSA和对称的第二加密算法DES，第一加密算法的密钥称为第一公钥和第一私钥，第二加密算法的密钥称为第二密钥。这里的加密算法本身也可以进行协商，但应为不是本发明的重要技术点，不进行具体描述。
图4是根据本发明可选实施例的报文传输方法流程图，如图4所示，具体步骤如下：
S401，用户话机拨号，网关设备A根据RSA算法随机产生第一公钥和第一私钥；
S402，网关设备A保存第一私钥到本地，发起通话协商，在扩展字段中携带第一公钥；
S403，网关设备B收到网关设备A发起的通话协商后，根据DES算法随机生成第二密钥，并保存到本地；
S404，网关设备B读取通话协商扩展字段中的第一公钥，用第一公钥加密第二密钥；
S405，网关设备B在通话协商应答的扩展字段中携带密文形式的第二密钥；
S406，网关设备A收到通话协商应答后，正常建立通话；网关设备A读取通话协商应答的扩展字段中携带的密文形式的第二密钥，用第一私钥解密密文形式的第二密钥为明文第二密钥，保存到本地；
S407，话机用户根据语音银行系统提示开始按键，网关设备A转换按键的DTMF信号为RFC2833报文；网关设备A使用第二密钥对RFC2833报文加密并传输；
S408，网关设备B收到加密RFC2833报文后，使用本地保存的第二密钥进行解密及后续业务处理。
通过上述具体实施方式的说明，可以了解到，该方法说明了RFC2833 加密传输有多种配置可能，但都包含在本方法中，上述实施例只是对本发明为达成预定目的所采取的技术手段及功效得以更加深入且具体的了解，并非用来对本发明加以限制。同时任何使用非对称加密算法处理RFC2833报文的方法都属于本专利保护范围，通过抓包信令和媒体的信息可以判定该方法是否得到使用。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例该的方法。
实施例2
在本实施例中还提供了一种报文传输装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图5是根据本发明实施例的应用于发送端设备的报文传输装置的结构框图，如图5所示，该装置包括：
第一发送模块52，设置为将预先生成的非对称加密的公钥传输到接收端设备；
第一接收模块54，与第一发送模块52连接，设置为接收该接收端设备使用该公钥加密对称加密密钥得到的第一密钥，并使用本地存储的私钥对该第一密钥解密，得到该对称加密密钥；
第二发送模块56，与第一接收模块54连接，设置为使用该对称加密 密钥加密待传输的报文，并将该报文发送到该接收端设备。
可选地，该第一发送模块52还设置为以明文的形式将该公钥传输到该接收端设备。
可选地，该第一接收模块54还设置为接收该接收端设备以密文的形式发送的该第一密钥。
可选地，该第一发送模块52还设置为在将随机生成的非对称加密的公钥传输到接收端设备之前，随机生成非对称加密的公钥和私钥，并将该私钥存储在本地。
可选地，该待传输的报文包括：请求注解RFC2833报文。
可选地，该发送端设备和该接收端设备均为网关设备。
图6是根据本发明实施例的应用于接收端设备的报文传输装置的结构框图，如图6所示，该装置包括：
第二接收模块62，设置为接收发送端设备发送的公钥，使用该公钥加密对称加密密钥得到第一密钥，其中，该公钥为该发送端设备生成的非对称加密的公钥；
第三发送模块64，与第二接收模块62连接，设置为将该第一密钥发送到该发送端设备，其中，该发送端设备依据与该公钥对应的私钥解密该第一密钥得到该对称加密密钥；
第三接收模块66，与第三发送模块64连接，设置为接收该发送端设备发送的报文，其中，该报文为该发送端设备使用该对称加密密钥加密的报文。
可选地，该第二接收模块62还设置为接收该发送端设备以明文的形式发送的公钥。
可选地，第三发送模块64还设置为以密文的形式将该第一密钥传输到该发送端设备。
可选地，该报文包括：RFC2833报文。
可选地，该发送端设备和该接收端设备均为网关设备。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例3
根据本发明的另一个实施例，提供了一种报文传输系统，其中，包括：发送端设备，接收端设备；
发送端设备将预先生成的非对称加密的公钥传输到接收端设备；
该接收端设备在接收该发送端设备发送的公钥之后，使用该公钥加密对称加密密钥得到第一密钥，并将该第一密钥发送到该发送端设备；
该发送端设备使用本地存储的私钥解密该第一密钥，得到该对称加密密钥；
该发送端设备使用该对称加密密钥加密待传输的报文，并将该报文传输到该接收端设备。
实施例4
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，发送端设备将预先生成的非对称加密的公钥传输到接收端设备；
S2，该发送端设备接收第一密钥，其中，该第一密钥是该接收端设备使用该公钥加密对称加密密钥得到的；
S3，该发送端设备根据本地存储的私钥对该第一密钥解密，得到该对称加密密钥；
S4，该发送端设备使用该对称加密密钥加密待传输的报文，并将该报文发送到该接收端设备。
根据本发明的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：
S5，接收端设备接收发送端设备发送的公钥，使用该公钥加密对称加密密钥得到第一密钥，其中，该公钥为该发送端设备生成的非对称加密的公钥；
S6，将该第一密钥发送到该发送端设备，其中，该发送端设备依据与该公钥对应的私钥解密该第一密钥得到该对称加密密钥；
S7，接收该发送端设备发送的报文，其中，该报文为该发送端设备使用该对称加密密钥加密的报文。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行上述实施例记载的方法步骤。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
通过本发明实施例，发送端设备随机生成非对称加密的公钥和私钥，将公钥发送到接收端设备，接收端设备采用公钥加密对称加密密钥，发送端设备接收到被公钥加密过的对称加密密钥，有私钥解密上述密钥，得到对称加密密钥，然后，发送端设备和接收端设备通过对称加密密钥传输报文。采用上述技术方案，解决了相关技术中报文传输安全性差的问题，大幅提高了报文传输的安全性。

Claims (23)

  1. 一种报文传输方法，包括：
    发送端设备将预先生成的非对称加密的公钥传输到接收端设备；
    所述发送端设备接收第一密钥，其中，所述第一密钥是所述接收端设备使用所述公钥加密对称加密密钥得到的；
    所述发送端设备根据本地存储的私钥对所述第一密钥解密，得到所述对称加密密钥；
    所述发送端设备使用所述对称加密密钥加密待传输的报文，并将所述报文发送到所述接收端设备。
  2. 根据权利要求1所述的方法，其中，发送端设备将随机生成的非对称加密的公钥传输到接收端设备，包括：
    所述发送端设备以明文的形式将所述公钥传输到所述接收端设备。
  3. 根据权利要求1所述的方法，其中，所述发送端设备接收所述接收端设备使用所述公钥加密对称加密密钥得到的第一密钥，包括：
    所述发送端设备接收所述接收端设备以密文的形式发送的所述第一密钥。
  4. 根据权利要求1所述的方法，其中，发送端设备将随机生成的非对称加密的公钥传输到接收端设备之前，包括：
    所述发送端设备随机生成非对称加密的公钥和私钥，并将所述私钥存储在本地。
  5. 根据权利要求1至4任一项所述的方法，其中，所述待传输的报文包括：请求注解RFC2833报文。
  6. 根据权利要求1至4任一项所述的方法，其中，所述发送端 设备和所述接收端设备均为网关设备。
  7. 一种报文传输方法，包括：
    接收端设备接收发送端设备发送的公钥，使用所述公钥加密对称加密密钥得到第一密钥，其中，所述公钥为所述发送端设备生成的非对称加密的公钥；
    将所述第一密钥发送到所述发送端设备，其中，所述发送端设备依据与所述公钥对应的私钥解密所述第一密钥得到所述对称加密密钥；
    接收所述发送端设备发送的报文，其中，所述报文为所述发送端设备使用所述对称加密密钥加密的报文。
  8. 根据权利要求7所述的方法，其中，接收端设备接收发送端设备发送的公钥，包括：
    所述接收端设备接收所述发送端设备以明文的形式发送的公钥。
  9. 根据权利要求7所述的方法，其中，将所述第一密钥发送到所述发送端设备，包括：
    所述接收端设备以密文的形式将所述第一密钥传输到所述发送端设备。
  10. 根据权利要求7至9任一项所述的方法，其中，所述报文包括：RFC2833报文。
  11. 根据权利要求7至9任一项所述的方法，其中，所述发送端设备和所述接收端设备均为网关设备。
  12. 一种报文传输装置，应用于发送端设备，包括：
    第一发送模块，设置为将预先生成的非对称加密的公钥传输到接收端设备；
    第一接收模块，设置为接收所述接收端设备使用所述公钥加密对称加密密钥得到的第一密钥，并使用本地存储的私钥对所述第一密钥解密，得到所述对称加密密钥；
    第二发送模块，设置为使用所述对称加密密钥加密待传输的报文，并将所述报文发送到所述接收端设备。
  13. 根据权利要求12所述的装置，其中，所述第一发送模块还设置为以明文的形式将所述公钥传输到所述接收端设备。
  14. 根据权利要求12所述的装置，其中，所述第一接收模块还设置为接收所述接收端设备以密文的形式发送的所述第一密钥。
  15. 根据权利要求12所述的装置，其中，所述第一发送模块还设置为在将随机生成的非对称加密的公钥传输到接收端设备之前，随机生成非对称加密的公钥和私钥，并将所述私钥存储在本地。
  16. 根据权利要求12至15任一项所述的装置，其中，所述待传输的报文包括：请求注解RFC2833报文。
  17. 根据权利要求12至15任一项所述的装置，其中，所述发送端设备和所述接收端设备均为网关设备。
  18. 一种报文传输装置，应用于接收端设备，包括：
    第二接收模块，设置为接收发送端设备发送的公钥，使用所述公钥加密对称加密密钥得到第一密钥，其中，所述公钥为所述发送端设备生成的非对称加密的公钥；
    第三发送模块，设置为将所述第一密钥发送到所述发送端设备，其中，所述发送端设备依据与所述公钥对应的私钥解密所述第一密钥得到所述对称加密密钥；
    第三接收模块，设置为接收所述发送端设备发送的报文，其中， 所述报文为所述发送端设备使用所述对称加密密钥加密的报文。
  19. 根据权利要求18所述的装置，其中，所述第二接收模块还设置为接收所述发送端设备以明文的形式发送的公钥。
  20. 根据权利要求18所述的装置，其中，第三发送模块还设置为以密文的形式将所述第一密钥传输到所述发送端设备。
  21. 根据权利要求18至20任一项所述的装置，其中，所述报文包括：RFC2833报文。
  22. 根据权利要求18至20任一项所述的装置，其中，所述发送端设备和所述接收端设备均为网关设备。
  23. 一种报文传输系统，包括：发送端设备，接收端设备，其中，
    所述发送端设备将预先生成的非对称加密的公钥传输到所述接收端设备；
    所述接收端设备在接收所述发送端设备发送的公钥之后，使用所述公钥加密对称加密密钥得到第一密钥，并将所述第一密钥发送到所述发送端设备；
    所述发送端设备使用本地存储的私钥解密所述第一密钥，得到所述对称加密密钥；
    所述发送端设备使用所述对称加密密钥加密待传输的报文，并将所述报文传输到所述接收端设备。
PCT/CN2017/086614 2016-06-16 2017-05-31 报文传输方法、装置及系统 WO2017215443A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610428944.8 2016-06-16
CN201610428944.8A CN107517184A (zh) 2016-06-16 2016-06-16 报文传输方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2017215443A1 true WO2017215443A1 (zh) 2017-12-21

Family

ID=60663932

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/086614 WO2017215443A1 (zh) 2016-06-16 2017-05-31 报文传输方法、装置及系统

Country Status (2)

Country Link
CN (1) CN107517184A (zh)
WO (1) WO2017215443A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112839037A (zh) * 2020-12-31 2021-05-25 广东电网有限责任公司电力调度控制中心 一种配电网规约指令防篡改方法及系统
CN113037760A (zh) * 2021-03-15 2021-06-25 中国建设银行股份有限公司 报文发送方法和装置
CN114500093A (zh) * 2022-02-24 2022-05-13 中国工商银行股份有限公司 报文信息的安全交互方法及系统

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108833943B (zh) * 2018-04-24 2020-12-08 苏州科达科技股份有限公司 码流的加密协商方法、装置及会议终端
CN112468477A (zh) * 2020-11-20 2021-03-09 中国建设银行股份有限公司 基于服务台网关的数据对接方法、装置及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101964793A (zh) * 2010-10-08 2011-02-02 上海银联电子支付服务有限公司 终端和服务器间的数据传输方法及系统、签到和支付方法
CN102065016A (zh) * 2010-12-30 2011-05-18 中兴通讯股份有限公司 报文发送和接收方法及装置、报文处理方法及系统
CN102143487A (zh) * 2010-02-03 2011-08-03 中兴通讯股份有限公司 一种端对端会话密钥协商方法和系统
CN102333093A (zh) * 2011-09-28 2012-01-25 深圳市赛格导航科技股份有限公司 一种数据加密传输方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101155030B (zh) * 2006-09-29 2010-10-06 维豪信息技术有限公司 基于注册鉴权的网络资源整合访问方法
CN101626294A (zh) * 2008-07-07 2010-01-13 华为技术有限公司 基于身份的认证方法、保密通信方法、设备和系统
CN101483863B (zh) * 2009-02-06 2011-04-27 中兴通讯股份有限公司 即时消息的传送方法、系统及wapi终端
CN101800734B (zh) * 2009-02-09 2013-10-09 华为技术有限公司 一种会话信息交互方法、装置及系统
CN101483866B (zh) * 2009-02-11 2011-03-16 中兴通讯股份有限公司 Wapi终端证书的管理方法、装置及系统
CN102664889A (zh) * 2012-04-23 2012-09-12 网经科技（苏州）有限公司 基于椭圆曲线的ims媒体双向加密方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102143487A (zh) * 2010-02-03 2011-08-03 中兴通讯股份有限公司 一种端对端会话密钥协商方法和系统
CN101964793A (zh) * 2010-10-08 2011-02-02 上海银联电子支付服务有限公司 终端和服务器间的数据传输方法及系统、签到和支付方法
CN102065016A (zh) * 2010-12-30 2011-05-18 中兴通讯股份有限公司 报文发送和接收方法及装置、报文处理方法及系统
CN102333093A (zh) * 2011-09-28 2012-01-25 深圳市赛格导航科技股份有限公司 一种数据加密传输方法及系统

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112839037A (zh) * 2020-12-31 2021-05-25 广东电网有限责任公司电力调度控制中心 一种配电网规约指令防篡改方法及系统
CN113037760A (zh) * 2021-03-15 2021-06-25 中国建设银行股份有限公司 报文发送方法和装置
CN113037760B (zh) * 2021-03-15 2023-01-06 中国建设银行股份有限公司 报文发送方法和装置
CN114500093A (zh) * 2022-02-24 2022-05-13 中国工商银行股份有限公司 报文信息的安全交互方法及系统
CN114500093B (zh) * 2022-02-24 2024-06-11 中国工商银行股份有限公司 报文信息的安全交互方法及系统

Also Published As

Publication number Publication date
CN107517184A (zh) 2017-12-26

Similar Documents

Publication Publication Date Title
WO2017215443A1 (zh) 报文传输方法、装置及系统
US7827398B2 (en) Method for offloading encryption and decryption of a message received at a message server to remote end devices
US7464267B2 (en) System and method for secure transmission of RTP packets
US6741705B1 (en) System and method for securing voice mail messages
JP4710267B2 (ja) ネットワークシステム、データ中継装置、セッションモニタシステム、およびパケットモニタ中継装置
KR100862050B1 (ko) ＶｏＩＰ 보안 통신을 제공하는 사용자 에이전트 및 이를이용한 보안 통신 제공 방법
JP3943034B2 (ja) コール処理システムにおけるセキュア・インターネット・プロトコル通信のための方法および装置
CN103974241A (zh) 一种面向Android系统移动终端的语音端到端加密方法
US9363034B2 (en) Method to encrypt information that is transferred between two communication units
US8923279B2 (en) Prevention of voice over IP spam
CN106935242A (zh) 一种语音通信加密系统与方法
CN106936788A (zh) 一种适用于voip语音加密的密钥分发方法
CN104618387A (zh) 将sip信令用于量子安全通信系统的方法、综合接入量子网关及系统
CN101790160A (zh) 安全协商会话密钥的方法及装置
WO2007048301A1 (fr) Procede de cryptage pour service mgn
US8181013B2 (en) Method, media gateway and system for transmitting content in call established via media gateway control protocol
WO2017197968A1 (zh) 一种数据传输方法及装置
US7570765B1 (en) Method and an apparatus to perform secure real-time transport protocol-on-the-fly
US20100166182A1 (en) Method and system for securing voice over internet protocol transmissions
WO2016070685A1 (zh) 一种实现sip会话传输的方法及系统
KR101210938B1 (ko) 암호 통신 방법 및 이를 이용한 암호 통신 시스템
KR101121230B1 (ko) Ｓｉｐ 기반 인터넷 전화 서비스 보안 시스템 및 그 방법
WO2009094813A1 (fr) Procédé et appareil de négociation de paramètres de sécurité pour sécuriser le flux multimédia
CN104753869A (zh) 基于sip协议的通话加密方法
JP3890048B2 (ja) ＶｏＩＰ通信装置および暗号通信方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17812554

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17812554

Country of ref document: EP

Kind code of ref document: A1