WO2018112787A1 - 一种srtp密钥指示方法及装置 - Google Patents

一种srtp密钥指示方法及装置 Download PDF

Info

Publication number
WO2018112787A1
WO2018112787A1 PCT/CN2016/111279 CN2016111279W WO2018112787A1 WO 2018112787 A1 WO2018112787 A1 WO 2018112787A1 CN 2016111279 W CN2016111279 W CN 2016111279W WO 2018112787 A1 WO2018112787 A1 WO 2018112787A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
encryption
indication message
parameter
srtp
Prior art date
Application number
PCT/CN2016/111279
Other languages
English (en)
French (fr)
Inventor
王锴
欧阳文斌
孙晓晖
李振兴
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/111279 priority Critical patent/WO2018112787A1/zh
Publication of WO2018112787A1 publication Critical patent/WO2018112787A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present application relates to the field of communications technologies, and in particular, to an SRTP key indication method and apparatus.
  • SRTP Secure Real-time Transport Protocol
  • RTP Real-time Transport Protocol
  • the embodiment of the present invention provides an SRTP key indication method and apparatus, which solves the problem that the key is easily leaked in the existing SRTP technology, thereby causing the RTP data to be easily leaked, and improving the security of the user data.
  • an SRTP key indication method comprising: receiving a first key indication message; the first key indication message includes first key encryption information, and the first key encryption information includes a first key The ciphertext, the first encryption algorithm, and the first encryption parameter; decrypting the ciphertext of the first key according to the preset key, the first encryption algorithm, and the first encryption parameter to obtain the first key; Decrypt the SRTP packet.
  • the first key when receiving the first key indication message, decrypting the ciphertext of the first key according to the preset key, the first encryption algorithm included in the first key indication message, and the first encryption parameter, The first key, thereby solving the problem that the first key is easy to leak when the SRTP key is negotiated, and also improving the security of the first key in the transmission process.
  • the method further includes: determining to generate the second key encryption information according to the preset key; wherein the second key encryption information includes the second key a ciphertext of the key, a second encryption algorithm, and a second encryption parameter, the second key is used to encrypt the RTP message; the second key indication message is sent, and the second key indication message includes the second key encryption information.
  • the SRTP key is negotiated, the problem that the second key is easily leaked is solved, and the security of the second key in the transmission process is also improved.
  • the method further includes: selecting any one of the at least two key encryption information One key encryption information is used as the first key encryption information; a third key indication message is transmitted, and the third key indication message includes information indicating the first key encryption information.
  • the first key indication message includes at least two key encryption information
  • the first key encryption information is selected from the at least two key encryption information, and the information is encrypted according to the first key.
  • the included first key decrypts the SRTP message, so that the appropriate key can be selected for decryption according to the capability or characteristics of the encryption and decryption.
  • the first encryption parameter includes a first salt value and a first initial vector; wherein the first salt value is ciphertext or plaintext; and the first initial vector is plaintext.
  • Decrypting the first key ciphertext according to the preset key, the first encryption algorithm, and the first encryption parameter, and obtaining the first key the method further includes: decrypting the SRTP message according to the first key.
  • the method further includes: encrypting the RTP message according to the second key.
  • the security of the voice data encrypted and decrypted using the second key can be improved, thereby ensuring the security of the user data.
  • a second aspect provides an SRTP key indication method, where the method includes: determining, according to a preset key, generating second key encryption information; wherein, the second key encryption information includes a ciphertext of the second key, a second encryption algorithm and a second encryption parameter; the second key is used to encrypt the RTP message; and the second key indication message is sent; wherein the second key indication message includes the second key encryption information.
  • determining to generate the second secret according to the preset key The key encrypts the information, and sends the second key encryption information through the second key indication message, thereby solving the problem that the second key is easy to leak when the SRTP key is negotiated, and also improving the second key in the transmission process. Security in the middle.
  • the second encryption parameter includes a second salt value and a second initial vector; wherein the second salt value is ciphertext or plaintext; and the second initial vector is plaintext.
  • the method further includes: encrypting the RTP message according to the second key, to obtain an SRTP message.
  • the security of the voice data encrypted and decrypted using the second key can be improved, thereby ensuring the security of the user data.
  • the method further includes: selecting the second key encryption information from the at least two key encryption information;
  • the second key encryption information is any one of at least two key encryption information;
  • the fourth key indication message is transmitted, and the fourth key indication message includes information for indicating the second key encryption information.
  • the first key indication message includes at least two key encryption information
  • the second key encryption information is selected from the at least two key encryption information, and the information is encrypted according to the second key.
  • the second key included encrypts the RTP message, so that an appropriate key can be selected for encryption according to the capability or characteristics of the encryption and decryption.
  • a third aspect provides an apparatus for indicating an SRTP key, the apparatus comprising: a receiving unit, configured to receive a first key indication message; wherein the first key indication message includes first key encryption information;
  • the encryption information includes a ciphertext of the first key, a first encryption algorithm, and a first encryption parameter, and a decryption unit, configured to decrypt the ciphertext of the first key according to the preset key, the first encryption algorithm, and the first encryption parameter Obtaining a first key; the first key is used to decrypt the secure real-time transport protocol SRTP message.
  • the determining unit is configured to determine, according to the preset key, the second key encryption information, where the second key encryption information includes the ciphertext of the second key, the second encryption algorithm, and a second encryption parameter; the second key is used to encrypt the real-time transport protocol RTP message; the sending unit is configured to send the second key indication message; wherein the second key indication message includes the second key encryption information.
  • the apparatus further includes: a selecting unit, configured to encrypt information from the at least two keys Selecting any one of the key encryption information as the first key encryption information; the sending unit is configured to send the third key indication message, and the third key indication message includes information for indicating the first key encryption information.
  • the first encryption parameter includes a first salt value and a first initial vector; wherein the first salt value is ciphertext or plaintext; and the first initial vector is plaintext.
  • the decrypting unit is further configured to: decrypt the SRTP packet according to the first key.
  • the determining unit is further configured to: encrypt the RTP message according to the second key.
  • a fourth aspect provides an apparatus for indicating an SRTP key, the apparatus comprising: a determining unit, configured to determine second key encryption information according to a preset key; and the second key encryption information includes a ciphertext of the second key a second encryption algorithm and a second encryption parameter; the second key is used to encrypt the real-time transport protocol RTP message; the sending unit is configured to send the second key indication message; wherein the second key indication message includes Two key encryption information.
  • the second encryption parameter includes a second salt value and a second initial vector; wherein the second salt value is ciphertext or plaintext; and the second initial vector is plaintext.
  • the determining unit is further configured to: encrypt the RTP packet according to the second key, to obtain a secure real-time transport protocol SRTP packet.
  • an SRTP key indication apparatus in a fifth aspect, includes a processor and a memory, the memory stores code and data, the processor can execute code in the memory, and the processor is configured to execute the first aspect or the foregoing
  • the SRTP key indication method provided by any one of the possible implementation manners of the aspect, or the SRTP key indication method provided by the foregoing second aspect or any possible implementation manner of the second aspect.
  • a computer readable storage medium where computer executed instructions are stored, and when the at least one processor of the device executes the computer to execute an instruction, the device performs the first aspect or the first aspect.
  • the SRTP key indication method provided by any one of the possible implementation manners, or the SRTP key indication method provided by the foregoing second aspect or any possible implementation manner of the second aspect.
  • a computer program product comprising computer executable instructions stored in a computer readable storage medium; at least A processor can read the computer-executable instructions from a computer-readable storage medium, and the at least one processor executes the computer-executable instructions to cause the apparatus to implement the SRTP-density provided by the first aspect or any one of the possible implementations of the first aspect.
  • FIG. 1 is a schematic structural diagram of a communication system according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of processing of voice data according to an embodiment of the present application.
  • FIG. 3 is a flowchart of a first method for indicating an SRTP key according to an embodiment of the present application
  • FIG. 4 is a flowchart of a second method for indicating an SRTP key according to an embodiment of the present application
  • FIG. 5 is a flowchart of a third SRTP key indication method according to an embodiment of the present application.
  • FIG. 6 is a flowchart of a fourth SRTP key indication method according to an embodiment of the present disclosure.
  • FIG. 7 is a flowchart of a fifth SRTP key indication method according to an embodiment of the present disclosure.
  • FIG. 8 is a flowchart of a sixth SRTP key indication method according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of an apparatus for indicating an SRTP key according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of another SRTP key indication apparatus according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of still another SRTP key indication apparatus according to an embodiment of the present disclosure.
  • Multiple as referred to herein means two or more. "and/or”, describing the association relationship of the associated objects, indicating that there may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately.
  • the symbol “/” generally indicates that the contextual object is an "or" relationship.
  • FIG. 1 is a schematic structural diagram of a communication system according to an embodiment of the present disclosure.
  • the communication system includes a first gateway 101, a network control device 102, and a second gateway 103.
  • the first gateway 101 can use the network function provided by the network control device 102 and the second gateway 103. Voice communication between.
  • the voice communication may be Voice Over Internet Protocol (VoIP) communication.
  • VoIP Voice Over Internet Protocol
  • UDP User Datagram Protocol
  • TCP Transmission Control Protocol
  • the Transmission Control Protocol (TCP) method transmits the voice data report by the IP packet network.
  • the compressed voice data may be processed by Real-time Transport Protocol (RTP) and Real-time Transport Control Protocol (RTCP). .
  • RTP is used to transmit voice data
  • RTCP is used to transmit control information of voice data.
  • SRTP Secure Real-time Transport Protocol
  • SRTCP Secure Real-time Transport Control Protocol
  • the voice data in the process provides encryption, message authentication, integrity assurance, and replay protection.
  • the processing of the voice data in the sending process may be as shown in (a) of FIG. 2, during the receiving process.
  • the processing in this can be as shown in (b) of FIG. 2.
  • the processing of the upper layer application at the time of transmission is opposite to the processing at the time of reception.
  • the first gateway or the second gateway may be configured by using a session in a Session Initiation Protocol (SIP) or a Media Gateway Control Protocol (MGCP) in H.248.
  • the Session Description Protocol (SDP) negotiates with the network control device for the key of the SRTP.
  • the first gateway 101 is the calling party and the second gateway 103 is the called party, when the first gateway 101 and the network control device 102 negotiate the key of the SRTP, the first gateway The server may act as a negotiation initiator to actively send a negotiation request to the network control device 102.
  • the network control device 102 may serve as the negotiation initiator and actively go to the second.
  • the gateway 103 sends a negotiation request.
  • the first gateway 101 and the second gateway 103 may be a Multi-Service Access Node (MSAN), an Access Gateway (AGW), or an Integrated Access Device (Integrated Access Device). IAD), IP Programmable Switch (IP PBX) Wait.
  • the network control device 102 can be a multimedia subsystem IMS device, a softswitch device, a Proxy-Call Session Control Function (P-CSCF), a Session Border Controller (SBC), and the like.
  • FIG. 3 is a flowchart of an SRTP key indication method according to an embodiment of the present application. Referring to FIG. 3, the method includes the following steps.
  • Step 201 The receiver receives the first key indication message.
  • the first key indication message includes first key encryption information, and the first key encryption information includes a ciphertext of the first key, a first encryption algorithm, and a first encryption parameter.
  • the first encryption algorithm is an algorithm when the first key is encrypted, and the first encryption parameter is a parameter when the first key is encrypted.
  • the network control device may send a first key indication message to the gateway, or the gateway sends a first key indication message to the network control device, where the gateway may be the first gateway or the second gateway. Therefore, for convenience of description, the embodiment of the present application refers to a party that sends the first key indication message as a sender, and a party that receives the first key indication message is referred to as a receiver.
  • the ciphertext of the first key included in the first key encryption information may be the ciphertext obtained by the sender by encrypting the first key according to the preset key, the first encryption algorithm, and the first encryption parameter.
  • the first encryption algorithm is an encryption algorithm used when the sender encrypts the first key.
  • the first encryption parameter may be an encryption parameter when the sender encrypts the first key using the first encryption algorithm.
  • the preset key used by the sender to encrypt the first key may be set in advance, and the preset keys used by the sender and the receiver are consistent.
  • the sender may use the first key indication message to include the ciphertext of the first key, the first encryption algorithm, and the first encryption parameter.
  • the first key encryption information is sent to the recipient such that the recipient receives the first key indication message.
  • the first key indication message received by the receiver may be a session request or a session refresh request, etc.
  • the session request may be an invite message, a 180 response message, a PRACK message
  • the session refresh request may be It is an invitation message or a session update message.
  • the first encryption parameter included in the first key encryption information may include a first salt value and a first initial vector.
  • the first salt value may be ciphertext or plaintext, and the first initial vector is plaintext.
  • the first salt value is a random string when the first key is encrypted, and the first initial vector is the first key. The initial vector when the key is encrypted.
  • the salt value is to strengthen the security of the encryption algorithm, and part of the newly added algorithm.
  • a salt value is a randomly generated set of strings that can include random uppercase and lowercase letters, numbers, and characters. The length of the string varies from one to the other, and the final ciphertext produced using different salt values is different.
  • the initial vector is a fixed-length input value, and usually the initial vector can be a random number or a pseudo-random number. Using the initial vector generated by the random number can achieve semantic security and make it difficult for an attacker to crack the ciphertext of the same key.
  • the first salt value is a salt value generated when the first key is encrypted
  • the first initial vector is an input value used when encrypting the first key, using the first salt value and the first An initial vector encrypts the first key to ensure the security of the first key. Even if the ciphertext, the first salt value and the first initial vector of the first key are leaked, it takes time to crack the first key. For a long time, the security of the first key is higher.
  • Step 202 The receiver decrypts the ciphertext of the first key according to the preset key, the first encryption algorithm, and the first encryption parameter, to obtain the first key.
  • the first key is used to decrypt the SRTP message.
  • the receiving party may perform the first key according to the preset preset key and the first encryption algorithm and the first encryption parameter included in the first key encryption information.
  • the ciphertext of the first key included in the encrypted information is decrypted, so that the first key for decrypting the SRTP packet can be obtained.
  • the receiver when the receiver receives the first key encryption information sent by the sender through the first key indication message, the receiver may use the preset key, the first encryption algorithm, and the first encryption parameter. Decrypting the ciphertext of the first key to obtain the first key, thereby solving the problem that the first key is easy to leak when the receiver and the sender perform SRTP key negotiation, and also ensuring that the first key is in the Security during transmission.
  • step 203 the method further includes: step 203.
  • Step 203 The receiver decrypts the SRTP packet by using the first key.
  • the SRTP packet is an encrypted RTP packet, that is, the SRTP packet is encrypted voice data.
  • the SRTP packet can be an SRTP packet sent by the sender.
  • the receiver can use the first key to decrypt the SRTP packet, so as to obtain the voice data sent by the sender.
  • the sender can use the first key to encrypt the voice data to be sent, that is, the sender sends the RTP message to be sent, and sends the encrypted SRTP message to the receiver.
  • the receiver when the receiver receives the SRTP packet sent by the sender, the receiver can decrypt the SRTP packet by using the first key, and obtain the corresponding RTP packet, that is, the sender sends the packet.
  • the voice data can improve the security of the SRTP message transmitted by the receiver in the direction of the transmission while ensuring the security of the key, thereby ensuring the security of the user data.
  • the method further includes: Step 2021 - Step 2023.
  • step 2022 - step 2023 may be located after step 201.
  • Step 2021 and step 201-203 above may be in no particular order.
  • Step 2021 The receiver determines the second key encryption information according to the preset key.
  • the second key encryption information includes a ciphertext of the second key, a second encryption algorithm, and a second encryption parameter.
  • the second encryption algorithm is an algorithm when the second key is encrypted
  • the second encryption parameter is a parameter when the second key is encrypted.
  • the second key is used to encrypt the RTP message.
  • the receiver may encrypt the second key according to the preset key, the second encryption algorithm, and the second encryption parameter to obtain the ciphertext of the second key. And encrypting the information by using the ciphertext of the second key, the second encryption algorithm, and the second encryption parameter as the second key.
  • the second encryption algorithm may be an encryption algorithm used by the receiver to encrypt the second key.
  • the second encryption parameter may be an encryption parameter related to the second encryption algorithm when the receiver encrypts the second key using the second encryption algorithm.
  • the RTP packet may be an RTP packet to be sent by the receiver, that is, the voice data that the receiver needs to send, and the receiver may encrypt the RTP packet to be sent by using the second key, and obtain the encrypted data.
  • the SRTP packet is sent to the sender to send the voice data that the receiver needs to send to the sender through encryption.
  • the second encryption parameter may include a second salt value and a second initial vector.
  • the second salt value may be ciphertext or plaintext, and the second initial vector is plaintext.
  • the second salt value is a random character string when the second key is encrypted, and the second initial vector is an initial vector when the second key is encrypted.
  • the second salt value and the second initial vector and the first salt value and the first step in the above step 201 The initial vector is similar. For details, refer to the description of the first salt value and the first initial vector in the above step 201. The embodiments of the present application are not described herein again.
  • the second key is encrypted by using the second salt value and the second initial vector, so that the security of the second key can be ensured, even if the ciphertext and the second salt value of the second key are leaked.
  • the second initial vector the second key is also required to take a long time, so the security of the second key is higher.
  • Step 2022 The receiver sends a second key indication message, and the second key indication message includes second key encryption information.
  • the second key indication message may be a session response.
  • the session request is an invitation message
  • the session response may be a 180 response message
  • the session response may be a PRACK message
  • the session response may be a PRACK message or 200. Confirm the message.
  • the session refresh request is an invite message or a session update message
  • the session response is a 200 confirmation message.
  • Step 2023 When the sender receives the second key indication message, the sender decrypts the ciphertext of the second key according to the preset key, the second encryption algorithm, and the second encryption parameter, thereby obtaining the second secret. key.
  • the sender may perform the second key according to the preset key set in advance and the second encryption algorithm and the second encryption parameter included in the second key indication message.
  • the ciphertext is decrypted to obtain the plaintext of the second key.
  • the receiving party may determine the second key encryption information according to the preset key, and send the second key encryption information to the sender by using the second key indication message, when the sender receives the When the second key indicates a message, the sender may decrypt the ciphertext of the second key according to the preset key, the second encryption algorithm, and the second encryption parameter to obtain the second key, so that the receiver and the sender perform the When the SRTP key is negotiated, the problem that the second key is easily leaked is solved, and the security of the second key in the transmission process is also ensured.
  • the method further includes step 204.
  • Step 204 and step 203 are in no particular order.
  • Step 204 The receiver encrypts the RTP message according to the second key.
  • the RTP packet is an unencrypted packet, that is, the RTP packet is encrypted before processing. Voice data.
  • the RTP packet may be an RTP packet to be sent by the receiver.
  • the second key is used to encrypt the real-time transport protocol (RTP) packet.
  • RTP real-time transport protocol
  • the receiver can encrypt the RTP packet to be sent by using the second key to obtain the SRTP.
  • the packet is sent to the sender.
  • the sender receives the SRTP packet, the sender can decrypt the SRTP packet by using the second key to obtain the RTP packet.
  • the sender when the RTP packet to be sent by the receiver is encrypted, and the encrypted SRTP packet is sent to the sender, the sender can decrypt the SRTP packet according to the second key.
  • the voice data sent by the receiver can improve the security of the user, and the security of the user data can be improved.
  • the method may further include the following two steps.
  • Step 2011 The receiver selects the first key encryption information from the at least two key encryption information.
  • the first key encryption information is any one of at least two key encryption information.
  • the sender sends the first key indication message
  • the sender can support at least two keys
  • the sender can use the preset key for each of the at least two keys.
  • the encryption algorithm and the encryption parameter corresponding to the key are encrypted, and the ciphertext of the key is obtained, so that at least two keys are encrypted to obtain ciphertext of at least two keys.
  • the sender may send at least two key encryption information corresponding to the at least two keys to the receiver for key negotiation by using the first key indication message.
  • the receiver may arbitrarily select one of the at least two key encryption information as the first key encryption information.
  • the receiving party may select matching key encryption information from at least two key encryption information according to its own characteristics, capabilities, or preset rules, and use the selected key encryption information as the first key encryption information.
  • This embodiment of the present invention does not limit this.
  • Step 2012 The receiver sends a third key indication message, and the third key indication message includes information for indicating the first key encryption information.
  • the recipient may send a third key indication message indicating the first key encryption information to the sender.
  • the sender may determine, according to the third key indication message, that the key selected by the receiver is the first key, so that the sender can encrypt the RTP message.
  • the corresponding key is used for encryption, so that the receiver decrypts the SRTP packet by using the first key when receiving the SRTP packet.
  • the receiver may send the information used to indicate the first key encryption information to the second encryption indication message.
  • sender That is, the step 2022 is specifically: the receiving direction sends a second encryption indication message, where the second encryption indication message includes second key encryption information and information for indicating the first key encryption information.
  • the receiver when the first key indication message received by the receiver includes at least two key encryption information, the receiver may select the first key encryption information from the at least two key encryption information. And decrypting the SRTP packet according to the first key included in the first key encryption information, so that the receiver can select an appropriate key for decryption according to its own encryption and decryption capability or characteristics.
  • FIG. 7 is a flowchart of an SRTP key indication method according to an embodiment of the present application. Referring to FIG. 7, the method includes the following steps.
  • Step 301 The sender determines the second key encryption information according to the preset key.
  • the second key encryption information includes a ciphertext of the second key, a second encryption algorithm, and a second encryption parameter; the second encryption algorithm is an algorithm when the second key is encrypted, and the second encryption parameter is when the second key is encrypted.
  • the second key is used to encrypt the RTP message.
  • the network control device may send a second key indication message to the gateway, or the gateway sends a second key indication message to the network control device, where the gateway may be the first gateway or the second gateway. Therefore, for convenience of description, the embodiment of the present application refers to the party that sends the second key indication message as the sender, and the party that receives the second key indication message as the receiver, so that the sender sends the second key indication. Before the message, the second key encryption information needs to be determined according to the preset key.
  • the ciphertext of the second key is a ciphertext obtained by the sender encrypting the second key according to the preset key, the second encryption algorithm, and the second encryption parameter.
  • the second encryption algorithm is the sender's pair The encryption algorithm used when the second key is encrypted.
  • the second encryption parameter is an encryption parameter related to the second encryption algorithm when the sender encrypts the second key using the second encryption algorithm.
  • the preset key used by the sender to encrypt the second key may be set in advance, and the preset keys used by the sender and the receiver are consistent.
  • the sender After the sender encrypts the second key according to the preset key, the second encryption algorithm, and the second encryption parameter to obtain the ciphertext of the second key, the sender may ciphertext and second of the second key.
  • the encryption algorithm and the second encryption parameter are used as the second key to encrypt the information.
  • the second encryption parameter may include a second salt value and a second initial vector, the second salt value is ciphertext or plaintext, and the second initial vector is plaintext.
  • the second salt value is a random character string when the second key is encrypted, and the second initial vector is an initial vector when the second key is encrypted.
  • the second salt value and the second initial vector are similar to the first salt value and the first initial vector in step 201 of the above embodiment. For details, refer to the first salt value and the first initial vector in step 201 of the above embodiment. It is to be noted that the embodiments of the present application are not described herein again.
  • the second key is encrypted by using the second salt value and the second initial vector, so that the security of the second key can be ensured, even if the ciphertext and the second salt value of the second key are leaked.
  • the second initial vector the second key is also required to take a long time, so the security of the second key is higher.
  • Step 302 The sender sends a second key indication message.
  • the second key indication message includes second key encryption information.
  • the sender may send the second key encryption information to the recipient through the second key indication message.
  • the second key indication message sent by the sender may be a session request or a session refresh request, etc., for example, the session request may be an invite message, a 180 response message, a PRACK message, and the session refresh request may be an invitation message or a session. Update messages, etc.
  • Step 303 When the receiver receives the second key indication message, the receiver decrypts the ciphertext of the second key according to the preset key, the second encryption algorithm, and the second encryption parameter, to obtain the second key. .
  • the receiving party may perform the second key according to the preset key set in advance and the second encryption algorithm and the second encryption parameter included in the second key indication message.
  • the ciphertext is decrypted to obtain the plaintext of the second key.
  • the sender may determine the second key encryption information according to the preset key, and send the second key encryption information to the receiver through the second key indication message, when the receiver receives When the second key indicates a message, the receiver may decrypt the ciphertext of the second key according to the preset key, the second encryption algorithm, and the second encryption parameter to obtain the second key, so that the sender and the receiver perform the
  • the SRTP key is negotiated, the problem of easy key leakage is solved, and the security of the key during transmission is also guaranteed.
  • step 303 the method further includes: step 304-step 305.
  • Step 304 The sender encrypts the RTP packet according to the second key, obtains the SRTP packet, and sends the SRTP packet.
  • the RTP message is an unencrypted message, that is, the RTP message is voice data before the encryption process.
  • the RTP packet may be an RTP packet to be sent by the sender, and the sender may use the second key to encrypt the RTP packet to obtain the encrypted SRTP packet.
  • the sender can send the SRTP packet to the receiver.
  • the receiver receives the SRTP packet, the receiver can decrypt the SRTP packet by using the second key to obtain the RTP packet.
  • the sender when the RTP packet to be sent by the receiver is encrypted, and the encrypted SRTP packet is sent to the sender, the sender can decrypt the SRTP packet according to the second key.
  • the voice data sent by the receiver can improve the security of the user, and the security of the user data can be improved.
  • the method further includes the following two steps before the sender encrypts the RTP message by using the second key.
  • Step 3021 The receiver selects the second key encryption information from the at least two key encryption information.
  • the second key encryption information is any one of at least two key encryption information.
  • the sender sends the second key indication message
  • the sender can use the preset key for each of the at least two keys. Encryption algorithm and encryption parameter corresponding to the key, encrypting the key, obtaining the ciphertext of the key, thereby encrypting at least two keys Ciphertext to at least two keys.
  • the sender may send at least two key encryption information corresponding to the at least two keys to the receiver by using the second key indication message.
  • the receiver may arbitrarily select one of the at least two key encryption information as the second key encryption information.
  • the receiving party may select matching key encryption information from at least two key encryption information according to its own characteristics, capabilities, or preset rules, and use the selected key encryption information as the second key encryption information.
  • This embodiment of the present invention does not limit this.
  • Step 3022 The receiver sends a fourth key indication message, and the fourth key indication message includes information for indicating the second key encryption information.
  • the recipient may send a fourth key indication message indicating the second key encryption information to the sender.
  • the sender may determine, according to the fourth key indication message, that the key selected by the receiver is the second key, so that the sender can encrypt the RTP message. Encryption is performed using the second key to obtain an SRTP packet, and the SRTP packet is sent to the receiver.
  • the receiver may select the second key encryption information from the at least two key encryption information. And sending a fourth key indication message to the sender, so that the sender determines, according to the fourth key indication message, that the RTP message is encrypted by using the second key, so that the receiving party can make the receiving party according to its own encryption and decryption capability or characteristics. , choose the appropriate key to decrypt.
  • each network element such as a gateway and a network control device, etc.
  • each network element includes hardware structures and/or software modules corresponding to each function.
  • the present invention can be implemented in a combination of hardware or hardware and computer software in conjunction with the network elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.
  • the embodiment of the present invention may perform the gateway, the network control device, and the like according to the foregoing method example.
  • the division of the function modules for example, can divide each function module for each function, or integrate two or more functions into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • the SRTP key indication device in the following embodiments may be a functional module division performed on the gateway, and the gateway may be the first gateway or the second gateway; or the SRTP key indication in the following embodiments.
  • the apparatus may also be a functional module division performed on the network control device. The embodiment of the present application is described by taking an SRTP key indication device as an example.
  • FIG. 9 shows a possible schematic diagram of an SRTP key indication apparatus, which includes a receiving unit 401 and a decryption unit 402, in the case where the respective functional modules are divided by corresponding functions.
  • the receiving unit 401 is configured to perform step 201 in FIG. 3-6; the decrypting unit 402 is configured to perform step 202 in FIG. 3-6, and step 203 in FIG.
  • the SRTP key indication apparatus 400 further includes: a determining unit 403, a sending unit 404, and a selecting unit 405.
  • the determining unit 403 is configured to perform step 2021 in FIG. 5-6;
  • the sending unit 404 is configured to perform step 2022 in FIG. 5-6;
  • the selecting unit 405 is configured to perform selection from the at least two key encryption information.
  • the first key encrypts the information. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional description of the corresponding functional modules, and details are not described herein again.
  • FIG. 10 shows another possible structural diagram of the SRTP key indication apparatus.
  • the SRTP key indication apparatus 410 includes a determination unit 411 and a transmission unit 412.
  • the determining unit 411 is configured to perform the step of using the second key to encrypt the RTP message in step 301 in FIG. 7-8 and the step 303 in FIG. 8; the sending unit 412 is configured to perform the operations in FIG. 7-8.
  • Step 302 Steps of transmitting an SRTP message in step 303 of FIG. All the related content of the steps involved in the foregoing method embodiments may be referred to the functional description of the corresponding functional modules, and details are not described herein again.
  • FIG. 11 shows a possible logical structure diagram of the SRTP key indicating means.
  • the SRTP key indication means 420 includes a processor 422, a communication interface 423, a memory 421, and a bus 424.
  • the processor 422, the communication interface 423, and the memory 421 are connected to one another via a bus 424.
  • the processor 422 can be used to The action of the SRTP key indicating device is controlled and managed.
  • the processor 422 is configured to perform step 202 in FIGS. 3-6, step 203 in FIG. 4 and FIG. 6, step 2021 in FIG. 5 and FIG. 6, and / or other processes for the techniques described herein.
  • Communication interface 423 can be used for communication with other SRTP key indicating devices.
  • the memory 421 can be used to store program codes and data of the SRTP key indicating means.
  • the processor 422 can be a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, combinations of digital signal processors and microprocessors, and the like.
  • the bus 424 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the SRTP key indication device when the SRTP key indication device receives the first key indication message, may include the first encryption algorithm and the first information included in the first key indication message according to the preset key An encryption parameter decrypts the ciphertext of the first key to obtain a first key, thereby solving the problem that the first key is easy to leak when the SRTP key is negotiated, and also improving the first key during transmission. Security.
  • a computer readable storage medium is stored, where computer execution instructions are stored, and when at least one processor of the device executes the computer to execute an instruction, the device executes the above figure. 3 - The step of the sender or the step of the receiver in the SRTP key indication method provided by any of the illustrated embodiments of FIG.
  • a computer program product comprising computer executable instructions stored in a computer readable storage medium; at least one processor of the device may be Reading the storage medium to read the computer to execute the instruction, the at least one processor executing the computer to execute the instruction, causing the device to perform the step or receiving of the sender in the SRTP key indication method provided by the embodiment illustrated in any of the above-mentioned FIG. 3-8 The steps of the party.
  • a communication system including a sender device and a receiver device.
  • the sender device may be the SRTP key indication device shown in any of Figures 9-11, and/or the receiver device is the SRTP key indication device shown in any of Figures 9-11.
  • the sender device is configured to perform the step of the sender in the SRTP key indication method provided by the foregoing embodiment shown in any of FIG. 3 to FIG. 8; the receiver device is configured to perform any of the foregoing manners in FIG. 3-8.
  • the SRTP key provided by the illustrated embodiment indicates the steps of the receiver in the method.
  • the receiving party when the receiving party receives the first key indication message, the receiving party may decrypt the secret of the first key according to the preset key, the first encryption algorithm, and the first encryption parameter.
  • the first key is obtained, and then the receiver can determine the second key encryption information according to the preset key, and send the second key encryption information by using the second key indication message, and the sender encrypts according to the second key.
  • the information can determine the second key, so that when the receiver and the sender perform SRTP key negotiation, the problem of easy key leakage is solved, and the security of the key in the transmission process is also ensured.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请实施例提供一种SRTP密钥指示方法及装置，涉及通信技术领域，解决了现有技术中密钥易泄露，进而致使RTP数据易泄露的问题。所述方法包括：接收第一密钥指示消息；其中，所述第一密钥指示消息包括第一密钥加密信息；所述第一密钥加密信息包括第一密钥的密文、第一加密算法和第一加密参数；所述第一加密算法为所述第一密钥加密时的算法，所述第一加密参数为所述第一密钥加密时的参数；根据预设密钥、所述第一加密算法和所述第一加密参数，解密所述第一密钥的密文，得到所述第一密钥；所述第一密钥用于对安全实时传输协议SRTP报文进行解密。

Description

一种SRTP密钥指示方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及一种SRTP密钥指示方法及装置。
背景技术
安全实时传输协议(Secure Real-time Transport Protocol，SRTP)是在实时传输协议(Real-time Transport Protocol，RTP)的基础上定义的一个协议，用于为RTP数据提供加密、消息认证和完整性等安全保护。
目前，在通过SRTP为会话描述协议(Session Description Protocol，SDP)媒体流中的RTP数据提供安全性保护时，发送方和接收方都是通过明文形式，对RTP数据用于加密或解密的密钥进行协商。在协商过程中，用于加密或解密的明文密钥很容易泄露或者被截获，从而导致密钥泄露，进而致使RTP数据泄露，影响用户数据的安全性。
发明内容
本申请的实施例提供一种SRTP密钥指示方法及装置，解决了现有SRTP技术中密钥易泄露，进而致使RTP数据易泄露的问题，提高了用户数据的安全性。
为达到上述目的，本申请的实施例采用如下技术方案：
第一方面，提供一种SRTP密钥指示方法，该方法包括：接收第一密钥指示消息；第一密钥指示消息包括第一密钥加密信息，第一密钥加密信息包括第一密钥的密文、第一加密算法和第一加密参数；根据预设密钥、第一加密算法和第一加密参数，解密第一密钥的密文，得到第一密钥；第一密钥用于对SRTP报文进行解密。上述技术方案中，当接收到第一密钥指示消息时，根据预设密钥、第一密钥指示消息包括的第一加密算法和第一加密参数，解密第一密钥的密文，得到第一密钥，从而在SRTP密钥协商时，解决了第一密钥易泄露的问题，同时也提高了第一密钥在传输过程中的安全性。
在一种可能的实现方式中，接收第一密钥指示消息之后，该方法还包括：根据预设密钥，确定生成第二密钥加密信息；其中，第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数，第二密钥用于对RTP报文进行加密；发送第二密钥指示消息，第二密钥指示消息包括第二密钥加密信息。上述可选的技术方案中，在SRTP密钥协商时，解决了第二密钥易泄露的问题，同时也提高了第二密钥在传输过程中的安全性。
在一种可能的实现方式中，若第一密钥指示消息包括至少两个密钥加密信息，接收第一密钥指示消息之后，该方法还包括：从至少两个密钥加密信息中选择任一个密钥加密信息作为第一密钥加密信息；发送第三密钥指示消息，第三密钥指示消息包括用于指示第一密钥加密信息的信息。上述可选的技术方案中，当第一密钥指示消息包括至少两个密钥加密信息时，从至少两个密钥加密信息中选择第一密钥加密信息，并根据第一密钥加密信息包括的第一密钥对SRTP报文进行解密，从而可以根据自身加解密的能力或者特点等，选择合适的密钥进行解密。
在一种可能的实现方式中，第一加密参数包括第一盐值和第一初始向量；其中，第一盐值为密文或者明文；第一初始向量为明文。根据预设密钥、第一加密算法和第一加密参数，解密第一密钥密文，得到第一密钥之后，该方法还包括：根据第一密钥，对SRTP报文进行解密。上述可选的技术方案中，在保证第一密钥安全性的同时，可以提高使用第一密钥进行加解密的语音数据的安全性，进而保证了用户数据的安全性。
在一种可能的实现方式中，发送第二密钥指示消息之后，该方法还包括：根据第二密钥，对RTP报文进行加密。上述可选的技术方案中，在保证第二密钥安全性的同时，可以提高使用第二密钥进行加解密的语音数据的安全性，进而保证了用户数据的安全性。
第二方面，提供一种SRTP密钥指示方法，该方法包括：根据预设密钥，确定生成第二密钥加密信息；其中，第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数；第二密钥用于对RTP报文进行加密；发送第二密钥指示消息；其中，第二密钥指示消息包括第二密钥加密信息。上述技术方案中，根据预设密钥，确定生成第二密 钥加密信息，并通过第二密钥指示消息发送第二密钥加密信息，从而在SRTP密钥协商时，解决了第二密钥易泄露的问题，同时也提高了第二密钥在传输过程中的安全性。
在一种可能的实现方式中，第二加密参数包括第二盐值和第二初始向量；其中，第二盐值为密文或者明文；第二初始向量为明文。
在一种可能的实现方式中，发送第二密钥指示消息之后，该方法还包括：根据第二密钥，对RTP报文进行加密，得到SRTP报文。上述可选的技术方案中，在保证第二密钥安全性的同时，可以提高使用第二密钥进行加解密的语音数据的安全性，进而保证了用户数据的安全性。
在一种可能的实现方式中，若第二密钥指示消息包括至少两个密钥加密信息，该方法还包括：从至少两个密钥加密信息中选择第二密钥加密信息；其中，第二密钥加密信息为至少两个密钥加密信息中的任一个；发送第四密钥指示消息，第四密钥指示消息包括用于指示第二密钥加密信息的信息。上述可选的技术方案中，当第而密钥指示消息包括至少两个密钥加密信息时，从至少两个密钥加密信息中选择第二密钥加密信息，并根据第二密钥加密信息包括的第二密钥对RTP报文进行加密，从而可以根据自身加解密的能力或者特点等，选择合适的密钥进行加密。
第三方面，提供一种SRTP密钥指示装置，该装置包括：接收单元，用于接收第一密钥指示消息；其中，第一密钥指示消息包括第一密钥加密信息；第一密钥加密信息包括第一密钥的密文、第一加密算法和第一加密参数；解密单元，用于根据预设密钥、第一加密算法和第一加密参数，解密第一密钥的密文，得到第一密钥；第一密钥用于对安全实时传输协议SRTP报文进行解密。
在一种可能的实现方式中，确定单元，用于根据预设密钥，确定第二密钥加密信息；其中，第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数；第二密钥用于对实时传输协议RTP报文进行加密；发送单元，用于发送第二密钥指示消息；其中，第二密钥指示消息包括第二密钥加密信息。
在一种可能的实现方式中，若第一密钥指示消息包括至少两个密钥加密信息，该装置还包括：选择单元，用于从至少两个密钥加密信息 中选择任意一个密钥加密信息作为第一密钥加密信息；发送单元，用于发送第三密钥指示消息，第三密钥指示消息包括用于指示第一密钥加密信息的信息。
在一种可能的实现方式中，第一加密参数包括第一盐值和第一初始向量；其中，第一盐值为密文或者明文；第一初始向量为明文。
在一种可能的实现方式中，解密单元还用于：根据第一密钥，对SRTP报文进行解密。
在一种可能的实现方式中，确定单元还用于：根据第二密钥，对RTP报文进行加密。
第四方面，提供一种SRTP密钥指示装置，该装置包括：确定单元，用于根据预设密钥，确定第二密钥加密信息；第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数；第二密钥用于对实时传输协议RTP报文进行加密；发送单元，用于发送第二密钥指示消息；其中，第二密钥指示消息包括第二密钥加密信息。
在一种可能的实现方式中，第二加密参数包括第二盐值和第二初始向量；其中，第二盐值为密文或者明文；第二初始向量为明文。
在一种可能的实现方式中，确定单元还用于：根据第二密钥，对RTP报文进行加密，得到安全实时传输协议SRTP报文。
第五方面，提供一种SRTP密钥指示装置，SRTP密钥指示装置包括处理器和存储器，存储器中存储代码和数据，处理器可运行存储器中的代码，处理器用于执行上述第一方面或第一方面的任一种可能的实现方式所提供的SRTP密钥指示方法，或者执行上述第二方面或第二方面的任一种可能的实现方式所提供的SRTP密钥指示方法。
第六方面，提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当设备的至少一个处理器执行该计算机执行指令时，设备执行上述第一方面或第一方面的任一种可能的实现方式所提供的SRTP密钥指示方法，或者执行上述第二方面或第二方面的任一种可能的实现方式所提供的SRTP密钥指示方法。
第七方面，提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少 一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备实施上述第一方面或第一方面的任一种可能的实现方式所提供的SRTP密钥指示方法，或者执行上述第二方面或第二方面的任一种可能的实现方式所提供的SRTP密钥指示方法。
附图说明
图1为本申请实施例提供的一种通信系统的结构示意图；
图2为本申请实施例提供的一种语音数据的处理示意图；
图3为本申请实施例提供的第一种SRTP密钥指示方法的流程图；
图4为本申请实施例提供的第二种SRTP密钥指示方法的流程图；
图5为本申请实施例提供的第三种SRTP密钥指示方法的流程图；
图6为本申请实施例提供的第四种SRTP密钥指示方法的流程图；
图7为本申请实施例提供的第五种SRTP密钥指示方法的流程图；
图8为本申请实施例提供的第六种SRTP密钥指示方法的流程图；
图9为本申请实施例提供的一种SRTP密钥指示装置的结构示意图；
图10为本申请实施例提供的另一种SRTP密钥指示装置的结构示意图；
图11为本申请实施例提供的又一种SRTP密钥指示装置的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
在本文中提及的“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。符号“/”一般表示前后关联对象是一种“或”的关系。
图1为本申请实施例提供的一种通信系统的结构示意图，参见图1，该通信系统包括第一网关101、网络控制设备102和第二网关103。其中，第一网关101可以通过网络控制设备102提供的网络功能与第二网关103 之间进行语音通信。
其中，语音通信可以为基于因特网协议的语音(Voice Over Internet Protocol，VoIP)通信。VoIP通信中可以采用各种压缩算法等对原始的语音数据进行压缩处理，然后采用网络技术将压缩后的语音数据进行打包处理，在运输层通过用户数据报协议(User Datagram Protocol，UDP)或者传输控制协议(Transmission Control Protocol，TCP)的方式将语音数据的报交由IP分组网络来进行传送。在将压缩后的语音数据传送至传输层之前，可以采用实时传输协议(Real-time Transport Protocol，RTP)和实时传输控制协议(Real-time Transport Control Protocol，RTCP)对压缩后的语音数据进行处理。其中，RTP用于传送语音数据，RTCP用于传送语音数据的控制信息。为了保证语音数据在传输过程中的安全性，还可以采用安全实时传输协议(Secure Real-time Transport Protocol，SRTP)和安全实时传输控制协议(Secure Real-time Transport Control Protocol，SRTCP)，为实时传输过程中的语音数据提供加密、消息认证、完整性保证和重放保护等。
可选的，如图2所示，当上层应用通过SRTP和SRTCP发送语音数据或者接收语音数据时，该语音数据在发送过程中的处理可以如图2中的(a)所示，在接收过程中的处理可以如图2中的(b)所示。其中，上层应用在发送时的处理过程与接收时的处理过程相反。
在本申请实施例中，第一网关或者第二网关可以在会话初始协议(Session Initiation Protocol，SIP)、或者H.248中的媒体网关控制协议(Media Gateway Control Protocol，MGCP)下，通过会话描述协议(Session Description Protocol，SDP)与网络控制设备对SRTP的密钥进行协商等。其中，在VoIP通信过程中，若第一网关101为主叫方，第二网关103为被叫方，则在第一网关101和网络控制设备102对SRTP的密钥进行协商时，第一网关101可以作为协商发起方，主动向网络控制设备102发送协商请求；在第二网关103和网络控制设备102对SRTP的密钥进行协商时，网络控制设备102可以作为协商发起方，主动向第二网关103发送协商请求。
在实际应用中，第一网关101和第二网关103可以为多业务接入点(Multi-Service Access Node，MSAN)、接入网关(Access Gateway，AGW)、综合接入设备(Integrated Access Device，IAD)、IP程控交换机(IP PBX) 等。网络控制设备102可以为多媒体子系统IMS设备、软交换设备、代理呼叫会话控制功能(Proxy-Call Session Control Function，P-CSCF)、会话边界控制器(Session Border Controller，SBC)等。
图3为申请实施例提供的一种SRTP密钥指示方法的流程图，参见图3，该方法包括以下几个步骤。
步骤201：接收方接收第一密钥指示消息。第一密钥指示消息包括第一密钥加密信息，第一密钥加密信息包括第一密钥的密文、第一加密算法和第一加密参数。第一加密算法为第一密钥加密时的算法，第一加密参数为第一密钥加密时的参数。
在图1所示的通信系统中，网络控制设备可以向网关发送第一密钥指示消息，或者网关向网络控制设备发送第一密钥指示消息，该网关可以是第一网关或者第二网关。因此，为便于描述，本申请实施例将发送第一密钥指示消息的一方称为发送方，将接收第一密钥指示消息的一方称为接收方。
其中，第一密钥加密信息包括的第一密钥的密文可以是发送方根据预设密钥、第一加密算法和第一加密参数对第一密钥进行加密，得到的密文。第一加密算法为发送方对第一密钥进行加密时使用的加密算法。第一加密参数可以为发送方使用第一加密算法对第一密钥进行加密时的加密参数。另外，发送方对第一密钥进行加密时使用的预设密钥可以事先进行设置，且发送方和接收方使用的预设密钥是一致的。
当发送方对第一密钥进行加密得到第一密钥的密文时，发送方可以通过第一密钥指示消息将包括第一密钥的密文、第一加密算法和第一加密参数的第一密钥加密信息发送给接收方，从而使得接收方接收到第一密钥指示消息。
可选的，在实际应用中，接收方接收到的第一密钥指示消息可以为会话请求或者会话刷新请求等，比如，会话请求可以是邀请消息、180响应消息、PRACK消息，会话刷新请求可以是邀请消息或者会话更新消息等。
进一步的，第一密钥加密信息包括的第一加密参数可以包括第一盐值和第一初始向量。其中，第一盐值可以为密文或者明文，第一初始向量为明文。第一盐值为第一密钥加密时的随机字符串，第一初始向量为第一密 钥加密时的初始向量。
其中，盐值是为了加强加密算法的安全性，而新加入的算法的一部分。盐值是随机生成的一组字符串，可以包括随机的大小写字母、数字和字符，字符串的长度根据要求的不同而不同，使用不同的盐值产生的最终密文也是不同的。
另外，初始向量是是一个固定长度的输入值，通常初始向量可以是随机数或伪随机数。使用随机数产生的初始向量可以达到语义安全，并让攻击者难以对同一密钥的密文进行破解。
在本申请实施例中，第一盐值是对第一密钥进行加密时生成的盐值，第一初始向量为对第一密钥进行加密时使用的输入值，使用第一盐值和第一初始向量对第一密钥进行加密，可以保证第一密钥的安全性，即使泄露了第一密钥的密文、第一盐值和第一初始向量，破解第一密钥也需要耗费较长的时间，因此第一密钥的安全性较高。
步骤202：接收方根据预设密钥、第一加密算法和第一加密参数，解密第一密钥的密文，得到第一密钥。第一密钥用于对SRTP报文进行解密。
当接收方接收到第一密钥指示消息时，接收方可以根据事先设置的预设密钥，以及第一密钥加密信息中包括的第一加密算法和第一加密参数，对第一密钥加密信息中包括的第一密钥的密文进行解密，从而可以得到对SRTP报文进行解密的第一密钥。
在本申请时实施例中，当接收方接收到发送方通过第一密钥指示消息发送的第一密钥加密信息时，接收方可以根据预设密钥、第一加密算法和第一加密参数，解密第一密钥的密文，得到第一密钥，从而在接收方和发送方进行SRTP密钥协商时，解决了第一密钥易泄露的问题，同时也保证了第一密钥在传输过程中的安全性。
进一步的，参见图4，在步骤202之后，该方法还包括：步骤203。
步骤203：接收方使用第一密钥对SRTP报文进行解密。
其中，该SRTP报文是指加密后的RTP报文，即该SRTP报文为加密处理后的语音数据。该SRTP报文可以是发送方发送的SRTP报文。
由于第一密钥用于对SRTP报文进行解密，因此，当接收方接收到发 送方发送的SRTP报文时，接收方可以使用第一密钥对该SRTP报文进行解密，从而得到发送方发送的语音数据。发送方在发送语音数据时，发送方可以使用第一密钥对待发送的语音数据进行加密，即发送方对待发送的RTP报文进行加密，并将加密得到SRTP报文发送给接收方。
在本申请时实施例中，当接收方接收到发送方发送的SRTP报文时，接收方可以通过第一密钥对该SRTP报文进行解密，得到对应的RTP报文，即得到发送方发送的语音数据，从而在保证密钥安全性的同时，可以提高发送方向接收方传输的SRTP报文的安全性，进而保证了用户数据的安全性。
进一步的，参见图5，该方法还包括：步骤2021-步骤2023。其中，步骤2022-步骤2023可以位于步骤201之后。步骤2021与上述步骤201-步骤203可以不分先后顺序。
步骤2021：接收方根据预设密钥，确定第二密钥加密信息。第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数。第二加密算法为第二密钥加密时的算法，第二加密参数为第二密钥加密时的参数。第二密钥用于对RTP报文进行加密。
若接收方使用第二密钥对RTP报文进行加密，则接收方可以根据预设密钥、第二加密算法和第二加密参数对第二密钥进行加密，得到第二密钥的密文，并将第二密钥的密文、第二加密算法和第二加密参数作为第二密钥加密信息。其中，第二加密算法可以为接收方对第二密钥进行加密时使用的加密算法。第二加密参数可以为接收方使用第二加密算法对第二密钥进行加密时，与第二加密算法相关的加密参数。
其中，该RTP报文可以是接收方待发送的RTP报文，即接收方需要发送的语音数据，接收方可以使用第二密钥对该待发送的RTP报文进行加密，并将加密得到的SRTP报文发送给发送方，以将接收方需要发送的语音数据通过加密的方式发送给发送方。
可选的，第二加密参数可以包括第二盐值和第二初始向量。其中，第二盐值可以为密文或者明文，第二初始向量为明文。第二盐值为第二密钥加密时的随机字符串，第二初始向量为第二密钥加密时的初始向量。
其中，第二盐值和第二初始向量与上述步骤201中的第一盐值和第一 初始向量类似，具体描述参见上述步骤201中对于第一盐值和第一初始向量的阐述，本申请实施例在此不再赘述。
在本申请实施例中，使用第二盐值和第二初始向量对第二密钥进行加密，可以保证第二密钥的安全性，即使泄露了第二密钥的密文、第二盐值和第二初始向量，破解第二密钥也需要耗费较长的时间，因此第二密钥的安全性较高。
步骤2022：接收方发送第二密钥指示消息，第二密钥指示消息包括第二密钥加密信息。
可选的，在实际应用中，若第一密钥指示消息为会话请求或者会话刷新请求，则第二密钥指示消息可以为会话响应。其中，当会话请求为邀请消息时，会话响应可以为180响应消息；当会话请求为180响应消息时，会话响应可以为PRACK消息；当会话请求为PRACK消息时，会话响应可以为PRACK消息或者200确认消息。当会话刷新请求为邀请消息或者会话更新消息时，会话响应为200确认消息。
步骤2023：当发送方接收到第二密钥指示消息时，发送方根据预设密钥、第二加密算法和第二加密参数，对第二密钥的密文进行解密，从而得到第二密钥。
当发送方接收到第二密钥指示消息时，发送方可以根据事先设置的预设密钥、以及第二密钥指示消息包括的第二加密算法和第二加密参数，对第二密钥的密文进行解密，从而得到第二密钥的明文。
在本申请时实施例中，接收方可以根据预设密钥，确定第二密钥加密信息，并通过第二密钥指示消息将第二密钥加密信息发送给发送方，当发送方接收到第二密钥指示消息时，发送方可以根据预设密钥、第二加密算法和第二加密参数，解密第二密钥的密文，得到第二密钥，从而在接收方和发送方进行SRTP密钥协商时，解决了第二密钥易泄露的问题，同时也保证了第二密钥在传输过程中的安全性。
进一步的，参见图6，该步骤2023之后，该方法还包括步骤204。其中，步骤204与步骤203不分先后顺序。
步骤204：接收方根据第二密钥，对RTP报文进行加密。
其中，该RTP报文是指未加密的报文，即该RTP报文为加密处理前 的语音数据。该RTP报文可以是接收方待发送的RTP报文。
由于第二密钥用于对实时传输协议RTP报文进行加密，因此，当接收方解密得到第二密钥后，接收方可以使用第二密钥对待发送的RTP报文进行加密的，得到SRTP报文，并将该SRTP报文发送给发送方。当发送方接收到该SRTP报文时，发送方可以使用第二密钥对该SRTP报文进行解密，从而得到该RTP报文。
在本申请时实施例中，当接收方对待发送的RTP报文进行加密，并将加密得到的SRTP报文发送给发送方时，发送方可以根据第二密钥对该SRTP报文解密，得到接收方发送的语音数据，从而在保证密钥安全性的同时，可以提高接收方向发送方传输SRTP报文的安全性，进而保证了用户数据的安全性。
进一步的，若第一密钥指示消息包括至少两个密钥加密信息，在接收方接收到第一密钥指示消息之后，该方法还可以包括以下两个步骤。
步骤2011：接收方从至少两个密钥加密信息中选择第一密钥加密信息。其中，第一密钥加密信息为至少两个密钥加密信息中的任一个。
其中，发送方向接收方发送第一密钥指示消息时，若发送方可以支持至少两个密钥，则对于至少两个密钥中的每个密钥，发送方可以根据预设密钥、该密钥对应的加密算法和加密参数，对该密钥进行加密，得到该密钥的密文，从而对至少两个密钥进行加密后得到至少两个密钥的密文。发送方可以通过第一密钥指示消息将至少两个密钥对应的至少两个密钥加密信息发送给接收方进行密钥协商。
当接收方接收到的第一密钥指示消息包括至少两个密钥加密信息时，接收方可以从该至少两个密钥加密信息中任意选择一个作为第一密钥加密信息。
可选的，接收方可以按照自身的特点、能力或者预设的规则等，从至少两个密钥加密信息选择匹配的密钥加密信息，将选择的密钥加密信息作为第一密钥加密信息，本发明实施例对此不做限定。
步骤2012：接收方发送第三密钥指示消息，第三密钥指示消息包括用于指示第一密钥加密信息的信息。
当接收方选择第一密钥加密信息后，接收方可以向发送方发送用于指示第一密钥加密信息的第三密钥指示消息。当发送方接收到第三密钥指示消息时，发送方可以根据第三密钥指示消息，确定接收方选择的密钥为第一密钥，从而发送方在对RTP报文进行加密时，可以使用对应的密钥进行加密，以使接收方在接收到SRTP报文时，通过第一密钥对该SRTP报文进行解密。
可选的，接收方在从至少两个密钥加密信息中选择第一密钥加密信息后，接收方也可以通过第二加密指示消息，将用于指示第一密钥加密信息的信息发送给发送方。即步骤2022具体为：接收方向发送方发送第二加密指示消息，第二加密指示消息包括第二密钥加密信息和用于指示第一密钥加密信息的信息。
在本申请时实施例中，当接收方接收到的第一密钥指示消息包括至少两个密钥加密信息时，接收方可以从至少两个密钥加密信息中选择第一密钥加密信息，并根据第一密钥加密信息包括的第一密钥对SRTP报文进行解密，从而可以使接收方根据自身的加解密能力或者特点等，选择合适的密钥进行解密。
图7为本申请实施例提供的一种SRTP密钥指示方法的流程图，参见图7，该方法包括以下几个步骤。
步骤301：发送方根据预设密钥，确定第二密钥加密信息。第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数；第二加密算法为第二密钥加密时的算法，第二加密参数为第二密钥加密时的参数；第二密钥用于对RTP报文进行加密。
在图1所示的通信系统中，网络控制设备可以向网关发送第二密钥指示消息，或者网关向网络控制设备发送第二密钥指示消息，该网关可以是第一网关或者第二网关。因此，为便于描述，本申请实施例将发送第二密钥指示消息的一方称为发送方，将接收第二密钥指示消息的一方称为接收方，从而发送方在发送第二密钥指示消息之前，需要根据预设密钥，确定第二密钥加密信息。
其中，第二密钥的密文是发送方根据预设密钥、第二加密算法和第二加密参数对第二密钥进行加密，得到的密文。第二加密算法是发送方对第 二密钥进行加密时使用的加密算法。第二加密参数是发送方使用第二加密算法对第二密钥进行加密时，与第二加密算法相关的加密参数。另外，发送方对第二密钥进行加密时使用的预设密钥可以事先进行设置，且发送方和接收方使用的预设密钥是一致的。
当发送方根据预设密钥、第二加密算法和第二加密参数对第二密钥进行加密，得到第二密钥的密文后，发送方可以将第二密钥的密文、第二加密算法和第二加密参数作为第二密钥加密信息。
进一步的，第二加密参数可以包括第二盐值和第二初始向量，第二盐值为密文或者明文，第二初始向量为明文。第二盐值为第二密钥加密时的随机字符串，第二初始向量为第二密钥加密时的初始向量。
其中，第二盐值和第二初始向量与上述实施例步骤201中的第一盐值和第一初始向量类似，具体描述参见上述实施例步骤201中对于第一盐值和第一初始向量的阐述，本申请实施例在此不再赘述。
在本申请实施例中，使用第二盐值和第二初始向量对第二密钥进行加密，可以保证第二密钥的安全性，即使泄露了第二密钥的密文、第二盐值和第二初始向量，破解第二密钥也需要耗费较长的时间，因此第二密钥的安全性较高。
步骤302：发送方发送第二密钥指示消息。其中，第二密钥指示消息包括第二密钥加密信息。
当发送方确定第二密钥加密信息之后，发送方可以通过第二密钥指示消息向接收方发送第二密钥加密信息。在实际应用中，发送方发送的第二密钥指示消息可以为会话请求或者会话刷新请求等，比如，会话请求可以是邀请消息、180响应消息、PRACK消息，会话刷新请求可以是邀请消息或者会话更新消息等。
步骤303：当接收方接收到第二密钥指示消息时，接收方根据预设密钥、第二加密算法和第二加密参数，对第二密钥的密文进行解密，得到第二密钥。
当接收方接收到第二密钥指示消息时，接收方可以根据事先设置的预设密钥、以及第二密钥指示消息包括的第二加密算法和第二加密参数，对第二密钥的密文进行解密，从而得到第二密钥的明文。
在本申请时实施例中，发送方可以根据预设密钥，确定第二密钥加密信息，并通过第二密钥指示消息将第二密钥加密信息发送给接收方，当接收方接收到第二密钥指示消息时，接收方可以根据预设密钥、第二加密算法和第二加密参数，解密第二密钥的密文，得到第二密钥，从而在发送方和接收方进行SRTP密钥协商时，解决了密钥易泄露的问题，同时也保证了密钥在传输过程中的安全性。
进一步的，参见图8，在步骤303之后，该方法还包括：步骤304-步骤305。
步骤304：发送方根据第二密钥，对RTP报文进行加密，得到SRTP报文，并发送该SRTP报文。
其中，该RTP报文是指未加密的报文，即该RTP报文为加密处理前的语音数据。该RTP报文可以是发送方待发送的RTP报文，发送方可以使用第二密钥，对该RTP报文进行加密，得到加密后的SRTP报文。发送方可以将该SRTP报文发送给接收方。当接收方接收到该SRTP报文时，接收方可以使用第二密钥对该SRTP报文进行解密，从而得到该RTP报文。
在本申请时实施例中，当接收方对待发送的RTP报文进行加密，并将加密得到的SRTP报文发送给发送方时，发送方可以根据第二密钥对该SRTP报文解密，得到接收方发送的语音数据，从而在保证密钥安全性的同时，可以提高接收方向发送方传输SRTP报文的安全性，进而保证了用户数据的安全性。
进一步的，若第二密钥指示消息包括至少两个密钥加密信息，在发送方使用第二密钥对RTP报文进行加密之前，该方法还包括以下两个步骤。
步骤3021：接收方从至少两个密钥加密信息中选择第二密钥加密信息。其中，第二密钥加密信息为至少两个密钥加密信息中的任一个。
其中，发送方向接收方发送第二密钥指示消息时，若发送方可以支持至少两个密钥，则对于至少两个密钥中的每个密钥，发送方可以根据预设密钥、该密钥对应的加密算法和加密参数，对该密钥进行加密，得到该密钥的密文，从而对至少两个密钥进行加密后得 到至少两个密钥的密文。发送方可以通过第二密钥指示消息将至少两个密钥对应的至少两个密钥加密信息发送给接收方。
当接收方接收到的第二密钥指示消息包括至少两个密钥加密信息时，接收方可以从该至少两个密钥加密信息中任意选择一个作为第二密钥加密信息。
可选的，接收方可以按照自身的特点、能力或者预设的规则等，从至少两个密钥加密信息选择匹配的密钥加密信息，将选择的密钥加密信息作为第二密钥加密信息，本发明实施例对此不做限定。
步骤3022：接收方发送第四密钥指示消息，第四密钥指示消息包括用于指示第二密钥加密信息的信息。
当接收方选择第二密钥加密信息后，接收方可以向发送方发送用于指示第二密钥加密信息的第四密钥指示消息。当发送方接收到第四密钥指示消息时，发送方可以根据第四密钥指示消息，确定接收方选择的密钥为第二密钥，从而发送方在对RTP报文进行加密时，可以使用第二密钥进行加密，以得到SRTP报文，并将该SRTP报文发送给接收方。
在本申请时实施例中，当接收方接收到的第二密钥指示消息包括至少两个密钥加密信息时，接收方可以从至少两个密钥加密信息中选择第二密钥加密信息，并向发送方发送第四密钥指示消息，以使发送方根据第四密钥指示消息确定使用第二密钥对RTP报文进行加密，从而可以使接收方根据自身的加解密能力或者特点等，选择合适的密钥进行解密。
上述主要从各个网元之间交互的角度对本发明实施例提供的方案进行了介绍。可以理解的是，各个网元，例如网关和网络控制设备等为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的网元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
本发明实施例可以根据上述方法示例对网关和网络控制设备等进行 功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本发明实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
需要说明的是，以下实施例中的SRTP密钥指示装置可以是对网关进行的功能模块划分，该网关可以是第一网关也可以是第二网关；或者，以下实施例中的SRTP密钥指示装置也可以是对网络控制设备进行的功能模块划分，本申请实施例以SRTP密钥指示装置为例进行说明。
在采用对应各个功能划分各个功能模块的情况下，图9示出了SRTP密钥指示装置的一种可能的结构示意图，SRTP密钥指示装置400包括：接收单元401和解密单元402。其中，接收单元401用于执行图3-图6中的步骤201；解密单元402用于执行图3-图6中的步骤202，以及图4中的步骤203。进一步的，该SRTP密钥指示装置400还包括：确定单元403、发送单元404和选择单元405。其中，确定单元403用于执行图5-图6中的步骤2021；发送单元404用于执行图5-图6中的步骤2022；选择单元405用于执行从至少两个密钥加密信息中选择第一密钥加密信息的步骤。上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用对应各个功能划分各个功能模块的情况下，图10示出了SRTP密钥指示装置的另一种可能的结构示意图，SRTP密钥指示装置410包括：确定单元411、发送单元412。其中，确定单元411用于执行图7-图8中的步骤301、以及图8的步骤303中使用第二密钥加密RTP报文的步骤；发送单元412用于执行图7-图8中的步骤302、以及图8的步骤303中发送SRTP报文的步骤。上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
在采用集成的单元的情况下，图11示出了SRTP密钥指示装置的一种可能的逻辑结构示意图。SRTP密钥指示装置420包括：处理器422、通信接口423、存储器421以及总线424。处理器422、通信接口423以及存储器421通过总线424相互连接。在本申请实施例中，处理器422可用于对 SRTP密钥指示装置的动作进行控制管理，例如，处理器422用于执行图3-图6中的步骤202、图4和图6中的步骤203、图5和图6中的步骤2021，和/或用于本文所描述的技术的其他过程。通信接口423，可以用于与其他SRTP密钥指示装置之间的通信。存储器421可用于存储SRTP密钥指示装置的程序代码和数据。
其中，处理器422可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。总线424可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图11中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本申请实施例提供的SRTP密钥指示装置，当该SRTP密钥指示装置接收到第一密钥指示消息时，可以根据预设密钥、第一密钥指示消息包括的第一加密算法和第一加密参数，解密第一密钥的密文，得到第一密钥，从而在SRTP密钥协商时，解决了第一密钥易泄露的问题，同时也提高了第一密钥在传输过程中的安全性。
在本发明的另一实施例中，还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当设备的至少一个处理器执行该计算机执行指令时，设备执行上述图3-图8任一图示的实施例所提供的SRTP密钥指示方法中发送方的步骤或者接收方的步骤。
在本发明的另一实施例中，还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备实施上述图3-图8任一图示的实施例所提供的SRTP密钥指示方法中发送方的步骤或者接收方的步骤。
在本发明的另一实施例中，还提供一种通信系统，该通信系统包括发送方设备和接收方设备。发送方设备可以为图9-图11任一所示的SRTP密钥指示装置，和/或接收方设备为图9-图11任一所示的SRTP密钥指示装置。其中，发送方设备用于执行上述图3-图8任一图示的实施例所提供的SRTP密钥指示方法中发送方的步骤；接收方设备用于执行上述图3-图8任一图示的实施例所提供的SRTP密钥指示方法中接收方的步骤。
在本发明实施例提供的通信系统中，当接收方接收到第一密钥指示消息时，接收方可以根据预设密钥、第一加密算法和第一加密参数，解密第一密钥的密文，得到第一密钥，之后接收方可以根据预设密钥，确定第二密钥加密信息，并通过第二密钥指示消息发送第二密钥加密信息，发送方根据第二密钥加密信息可以确定第二密钥，从而在接收方和发送方进行SRTP密钥协商时，解决了密钥易泄露的问题，同时也保证了密钥在传输过程中的安全性。
最后应说明的是：以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (13)

  1. 一种SRTP密钥指示方法，其特征在于，所述方法包括：
    接收第一密钥指示消息；其中，所述第一密钥指示消息包括第一密钥加密信息；所述第一密钥加密信息包括第一密钥的密文、第一加密算法和第一加密参数；所述第一加密算法为所述第一密钥加密时的算法，所述第一加密参数为所述第一密钥加密时的参数；
    根据预设密钥、所述第一加密算法和所述第一加密参数，解密所述第一密钥的密文，得到所述第一密钥；所述第一密钥用于对安全实时传输协议SRTP报文进行解密。
  2. 根据权利要求1所述的方法，其特征在于，所述接收第一密钥指示消息之后，所述方法还包括：
    根据所述预设密钥，确定第二密钥加密信息；其中，所述第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数；所述第二加密算法为所述第二密钥加密时的算法，所述第二加密参数为所述第二密钥加密时的参数；所述第二密钥用于对实时传输协议RTP报文进行加密；
    发送所述第二密钥指示消息；其中，所述第二密钥指示消息包括所述第二密钥加密信息。
  3. 根据权利要求1或2所述的方法，其特征在于，若所述第一密钥指示消息包括至少两个密钥加密信息，所述接收第一密钥指示消息之后，所述方法还包括：
    从所述至少两个密钥加密信息中选择所述第一密钥加密信息；其中，所述第一密钥加密信息为所述至少两个密钥加密信息中的任一个；
    发送第三密钥指示消息；其中，所述第三密钥指示消息包括用于指示所述第一密钥加密信息的信息。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第一加密参数包括第一盐值和第一初始向量；其中，所述第一盐值为密文或者明文；所述第一初始向量为明文；所述第一盐值为所述第一密钥加密时的随机字符串；所述第一初始向量为所述第一密钥加密时的初始向量。
  5. 一种SRTP密钥指示方法，其特征在于，所述方法包括：
    根据预设密钥，确定第二密钥加密信息；其中，所述第二密钥加密 信息包括第二密钥的密文、第二加密算法和第二加密参数；所述第二加密算法为所述第二密钥加密时的算法，所述第二加密参数为所述第二密钥加密时的参数；所述第二密钥用于对实时传输协议RTP报文进行加密；
    发送第二密钥指示消息；其中，所述第二密钥指示消息包括所述第二密钥加密信息。
  6. 根据权利要求5所述的方法，其特征在于，所述第二加密参数包括第二盐值和第二初始向量；其中，所述第二盐值为密文或者明文；所述第二初始向量为明文；所述第二盐值为所述第二密钥加密时的随机字符串；所述第二初始向量为所述第二密钥加密时的初始向量。
  7. 一种SRTP密钥指示装置，其特征在于，所述装置包括：
    接收单元，用于接收第一密钥指示消息；其中，所述第一密钥指示消息包括第一密钥加密信息；所述第一密钥加密信息包括第一密钥的密文、第一加密算法和第一加密参数；所述第一加密算法为所述第一密钥加密时的算法，所述第一加密参数为所述第一密钥加密时的参数；
    解密单元，用于根据预设密钥、所述第一加密算法和所述第一加密参数，解密所述第一密钥的密文，得到所述第一密钥；所述第一密钥用于对安全实时传输协议SRTP报文进行解密。
  8. 根据权利要求7所述的装置，其特征在于，所述装置还包括：
    确定单元，用于根据所述预设密钥，确定第二密钥加密信息；其中，所述第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数；所述第二加密算法为所述第二密钥加密时的算法，所述第二加密参数为所述第二密钥加密时的参数；所述第二密钥用于对实时传输协议RTP报文进行加密；
    发送单元，用于发送第二密钥指示消息；其中，所述第二密钥指示消息包括所述第二密钥加密信息。
  9. 根据权利要求7或8所述的装置，其特征在于，若所述第一密钥指示消息包括至少两个密钥加密信息，所述装置还包括：
    选择单元，用于从所述至少两个密钥加密信息中选择所述第一密钥加密信息；其中，所述第一密钥加密信息为所述至少两个密钥加密信息中的任一个；
    发送单元，用于发送第三密钥指示消息；其中，所述第三密钥指示消息包括用于指示所述第一密钥加密信息的信息。
  10. 根据权利要求7-9任一项所述的装置，其特征在于，所述第一加密参数包括第一盐值和第一初始向量；其中，所述第一盐值为密文或者明文；所述第一初始向量为明文；所述第一盐值为所述第一密钥加密时的随机字符串；所述第一初始向量为所述第一密钥加密时的初始向量。
  11. 一种SRTP密钥指示装置，其特征在于，所述装置包括：
    确定单元，用于根据预设密钥，确定第二密钥加密信息；所述第二密钥加密信息包括第二密钥的密文、第二加密算法和第二加密参数；所述第二加密算法为所述第二密钥加密时的算法，所述第二加密参数为所述第二密钥加密时的参数；所述第二密钥用于对实时传输协议RTP报文进行加密；
    发送单元，用于发送第二密钥指示消息；其中，所述第二密钥指示消息包括所述第二密钥加密信息。
  12. 根据权利要求11所述的装置，其特征在于，所述第二加密参数包括第二盐值和第二初始向量；其中，所述第二盐值为密文或者明文；所述第二初始向量为明文；所述第二盐值为所述第二密钥加密时的随机字符串；所述第二初始向量为所述第二密钥加密时的初始向量。
  13. 一种SRTP密钥指示装置，其特征在于，所述SRTP密钥指示装置包括处理器和存储器，所述存储器中存储代码和数据，所述处理器可运行存储器中的代码，所述处理器用于执行上述权利要求1-4任一项所述的SRTP密钥指示方法，或者执行上述权利要求5-6任一项所述的SRTP密钥指示方法。
PCT/CN2016/111279 2016-12-21 2016-12-21 一种srtp密钥指示方法及装置 WO2018112787A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/111279 WO2018112787A1 (zh) 2016-12-21 2016-12-21 一种srtp密钥指示方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/111279 WO2018112787A1 (zh) 2016-12-21 2016-12-21 一种srtp密钥指示方法及装置

Publications (1)

Publication Number Publication Date
WO2018112787A1 true WO2018112787A1 (zh) 2018-06-28

Family

ID=62624257

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/111279 WO2018112787A1 (zh) 2016-12-21 2016-12-21 一种srtp密钥指示方法及装置

Country Status (1)

Country Link
WO (1) WO2018112787A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101810019A (zh) * 2007-09-27 2010-08-18 朗讯科技公司 对无线网络中的节点的认证方法和装置
US20150220756A1 (en) * 2014-02-04 2015-08-06 Exponential Horizons, Llc Cryptographic method and system of protecting digital content & recovery of same through unique user identification
CN105959281A (zh) * 2016-04-29 2016-09-21 腾讯科技（深圳）有限公司 文件加密传输方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101810019A (zh) * 2007-09-27 2010-08-18 朗讯科技公司 对无线网络中的节点的认证方法和装置
US20150220756A1 (en) * 2014-02-04 2015-08-06 Exponential Horizons, Llc Cryptographic method and system of protecting digital content & recovery of same through unique user identification
CN105959281A (zh) * 2016-04-29 2016-09-21 腾讯科技（深圳）有限公司 文件加密传输方法和装置

Similar Documents

Publication Publication Date Title
Gupta et al. Security analysis of voice-over-IP protocols
US9112840B2 (en) Verifying privacy of web real-time communications (WebRTC) media channels via corresponding WebRTC data channels, and related methods, systems, and computer-readable media
JP4710267B2 (ja) ネットワークシステム、データ中継装置、セッションモニタシステム、およびパケットモニタ中継装置
WO2015180654A1 (zh) 一种保密通信实现方法及装置
US8725885B1 (en) Securely establishing ice relay connections
CN104219041A (zh) 一种适用于移动互联网的数据传输加密方法
CN108833943B (zh) 码流的加密协商方法、装置及会议终端
KR101297936B1 (ko) 단말기 간의 보안 통신 방법 및 그 장치
JP2009526454A (ja) メディアサーバと加入者機器との間においてメディアデータを暗号化して伝送するための方法、装置および／またはコンピュータプログラム製品
WO2017215443A1 (zh) 报文传输方法、装置及系统
Petraschek et al. Security and Usability Aspects of Man-in-the-Middle Attacks on ZRTP.
Arkko et al. Key Management Extensions for Session Description Protocol (SDP) and Real Time Streaming Protocol (RTSP)
US9143488B2 (en) Real-time encryption of voice and fax over IP
WO2017197968A1 (zh) 一种数据传输方法及装置
US7570765B1 (en) Method and an apparatus to perform secure real-time transport protocol-on-the-fly
WO2012139427A1 (zh) 媒体消息处理方法、系统及装置
WO2016180180A1 (zh) 一种语音通话的加密方法及装置
WO2016070685A1 (zh) 一种实现sip会话传输的方法及系统
KR102358965B1 (ko) 통신 장치, 통신 방법, 및 프로그램
WO2018112787A1 (zh) 一种srtp密钥指示方法及装置
Jung et al. Securing RTP Packets Using Per‐Packet Key Exchange for Real‐Time Multimedia
Jung et al. One-time packet key exchange scheme for secure real-time multimedia applications
KR101210938B1 (ko) 암호 통신 방법 및 이를 이용한 암호 통신 시스템
Jung et al. Securing rtp packets using per-packet selective encryption scheme for real-time multimedia applications
US11362812B2 (en) Method of end to end securing of a communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16924683

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16924683

Country of ref document: EP

Kind code of ref document: A1