WO2022033278A1 - 一种基于ims数据通道的通信方法及设备 - Google Patents

一种基于ims数据通道的通信方法及设备 Download PDF

Info

Publication number
WO2022033278A1
WO2022033278A1 PCT/CN2021/107414 CN2021107414W WO2022033278A1 WO 2022033278 A1 WO2022033278 A1 WO 2022033278A1 CN 2021107414 W CN2021107414 W CN 2021107414W WO 2022033278 A1 WO2022033278 A1 WO 2022033278A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
terminal
data channel
certificate
identification information
Prior art date
Application number
PCT/CN2021/107414
Other languages
English (en)
French (fr)
Inventor
魏海涛
叶进洲
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21855331.1A priority Critical patent/EP4184821A4/en
Publication of WO2022033278A1 publication Critical patent/WO2022033278A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1016—IP multimedia subsystem [IMS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/64—Self-signed certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the present application relates to the field of wireless communication, and in particular, to a communication method and device based on an IMS data channel.
  • the Internet Protocol Multimedia Subsystem (IMS) data channel is a new concept emerging in the industry. Its main technical feature is that the data channel of the 5th generation wireless systems (5G) technology is superimposed on the voice over long term evolution (voice over long term evolution, VoLTE) voice service, so that the IMS-based real-time audio and video Communication is upgraded to real-time interaction, which enriches the IMS-enabled business scenarios.
  • 5G 5th generation wireless systems
  • VoLTE voice over long term evolution
  • the IMS data channel can be considered as a new media type, which can adopt flow control on the user datagram protocol-based packet transport layer security protocol used in web real time communication (WebRTC).
  • the transmission protocol (stream control transmission protocol over datagram transport layer security over user datagram protocol, SCTP over DTLS over UDP) is used as the bearer protocol, which means that the security mechanism of the IMS data channel is different from the security mechanism adopted by the audio service and video service.
  • the former uses the SCTP over DTLS over UDP protocol
  • the latter uses the secure real time transport protocol (SRTP).
  • SRTP secure real time transport protocol
  • SCTP secure real time transport protocol
  • the present application provides a communication method and device based on an IMS data channel, so as to provide reliable IMS data channel communication.
  • the present application provides a communication method based on an IMS data channel, which can be applied to a certificate management server in a communication network.
  • the certificate management server can communicate with the corresponding terminal (such as the first terminal) through network elements of the IMS network, such as an application server (AS) and a call session control function (CSCF) .
  • AS application server
  • CSCF call session control function
  • the certificate management server receives the encrypted ticket (ticket) from the first terminal forwarded by the AS and a ticket for identifying The identification information of the first application of the first application, then, the certificate management server sends the encrypted ticket and the identification information of the first application to the key management server (key management system, KMS), so that the KMS is based on the encrypted ticket and the identification of the first application.
  • KMS key management system
  • the information verifies the first application, and notifies the certificate management server of the verification result; then, after the verification of the first application is successful, the certificate management server receives the first key from the KMS, and generates a corresponding key according to the first key.
  • Data channel application certificate and finally, the certificate management server sends the data channel application certificate to the first terminal via the AS, so that the first application can perform IMS data channel service with the second application according to the data channel application certificate.
  • the certificate management server issues a reliable data channel application certificate to the first terminal, and the IMS network can learn the data channel application certificate, avoiding the first terminal to manually install/replace a third-party (non-communication network-provided) certificate and use Unreliable self-signed certificates, which in turn provide reliable IMS data channel communication.
  • the first terminal may also send the address of the KMS to the certificate management server.
  • the certificate management server may send the encrypted ticket and the identification information of the first application to the corresponding KMS according to the address of the KMS.
  • the certificate management server may send the data channel application certificate and the identification information of the first application to the first terminal by the AS, so that the first terminal may know that the received data channel application certificate is assigned to the first application, and then store the data channel application certificate in association with the identification information of the first application.
  • the identification information of the first application may include: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identifier of the first terminal includes: a device identifier of the first terminal or a user identifier of a user using the first terminal.
  • the above-mentioned terminal identification may be a device identification used for a terminal, such as an International Mobile Subscriber Identity (IMSI), an International Mobile Equipment Identity (IMEI), etc., or may also be The user identifier of the user who uses the terminal, such as the Internet Protocol Multimedia Public Identity (IP multimedia public identity, IMPU); the application identifier may be an application identifier (application identifier, AID).
  • IMSI International Mobile Subscriber Identity
  • IMEI International Mobile Equipment Identity
  • the user identifier of the user who uses the terminal such as the Internet Protocol Multimedia Public Identity (IP multimedia public identity, IMPU);
  • IP multimedia public identity, IMPU Internet Protocol Multimedia Public Identity
  • the application identifier may be an application identifier (application identifier, AID).
  • the above encrypted ticket may include: identification information of the first application.
  • encrypted tickets can be implemented as MIKEY (multimedia internet keying)-tickets.
  • the above encrypted ticket may further include: a key index of the second key, the second key matches the first key, and the second key is allocated by the KMS for the first application.
  • the key index of the second key may be the second key itself, the first key corresponding to the second key, or the identifier of the second key, etc.
  • the key index may also be It can be in other forms, as long as the second key can be uniquely determined through the key index of the second key.
  • the present application provides a communication method based on an IMS data channel, including: the KMS obtains a first encrypted ticket from a certificate management server and identification information of a first application, where the identification information of the first application is used to identify the first terminal The KMS decrypts the first encrypted ticket and obtains the identification information in the first encrypted ticket; KMS verifies the first application according to the identification information and the identification information of the first application; if the verification of the first application is successful, the KMS Send the first key to the certificate management server. The first key matches the second key allocated by the KMS for the first application. The first key is used by the certificate management server to generate a data channel application certificate for the first application. The data channel The application certificate is used for the first application to perform the IMS data channel service with the second application of the second terminal.
  • the KMS can determine whether the identification information matches the identification information of the first application, wherein if the identification information matches the identification information of the first application, it indicates that the verification of the first application is successful, if the identification information If it does not match the identification information of the first application, it indicates that the verification of the first application fails.
  • the first encrypted ticket may further include: a key index; correspondingly, the KMS may verify the first application according to the identification information, the key index and the identification information of the first application.
  • the KMS can determine whether the identification information matches the identification information of the first application; if the identification information matches the identification information of the first application, the KMS determines whether the key index matches the second key. match; wherein, if the key index matches the second key, it indicates that the verification of the first application is successful; if the key index does not match the second key, it indicates that the verification of the first application fails.
  • the above method may further include: the KMS receives a key request from the first terminal; the KMS responds to the encrypted ticket key request, assign a second key and a second encrypted ticket to the first application, where the second encrypted ticket includes: the identification information of the first application, or the identification information of the first application and the key index of the second key; The first terminal sends the second key and the second encrypted ticket.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the above method may further include: establishing a communication channel between the KMS and the first terminal using a generic bootstrapping architecture (GBA).
  • GBA generic bootstrapping architecture
  • the present application provides a communication method based on an IMS data channel, comprising: a first terminal sending an encrypted ticket and identification information of a first application to a certificate management server via an AS, where the identification information of the first application is used to identify the first terminal The first application of the terminal; the first terminal receives the data channel application certificate sent by the certificate management server via the AS, and the data channel application certificate is sent by the certificate management server after successfully verifying the first application according to the encrypted ticket and the identification information of the first application; The first terminal performs the IMS data channel service with the second application of the second terminal according to the data channel application certificate.
  • the above method may further include: the first terminal sends the address of the KMS to the certificate management server via the AS, where the address of the KMS is used to instruct the certificate management server to communicate with the KMS.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the above method may further include: the first terminal requests the KMS for the key and the ticket; the first terminal receives The second key and the encrypted ticket distributed by the KMS to the first application, and the encrypted ticket includes: the identification information of the first application, or the identification information of the first application and the key index of the second key.
  • the data channel application certificate is generated by the certificate management server according to the first key, and the first key matches the second key; correspondingly, when the second terminal successfully authenticates the first application , the first terminal verifies the data channel application certificate through the cooperation of the first key and the second key.
  • the above method may further include: establishing a communication channel between the first terminal and the KMS using GBA.
  • the present application provides a communication method based on an IMS data channel, comprising: an AS receiving an encrypted ticket from a first terminal and identification information of a first application, where the identification information of the first application is used to identify the first terminal of the first terminal.
  • An application the AS sends the encrypted ticket and the identification information of the first application to the certificate management server; the AS receives the first data channel application certificate from the certificate management server, and the first data channel application certificate is allocated by the certificate management server for the first application , the first data channel application certificate is used for the first application to perform the IMS data channel service with the second application of the second terminal; the AS saves the first data channel application certificate, and sends the first data channel application certificate to the first terminal.
  • the IMS network can refuse to use the non-IMS network by checking whether the fingerprint information of the certificate exchanged in the DTLS handshake process is the data channel application certificate issued by the certificate management server.
  • the generated data channel application certificate while ensuring the safe communication of the terminal, also enables the communication IMS network to supervise the reliability of the communication process.
  • the above method may further include: the AS receiving a second data channel application certificate allocated by the certificate management server for the second application, and the second data channel application certificate is used for the second application to perform IMS data with the first application Channel service; the AS saves the second data channel application certificate, and sends the second data channel application certificate to the second terminal.
  • the above method may further include: the AS obtains the data channel application certificate from the first terminal and the data channel application certificate from the second terminal during the DTLS handshake process; the AS obtains the data channel application certificate from the first terminal The data channel application certificate matches the first data channel application certificate; the AS matches the data channel application certificate from the second terminal with the second data channel application certificate; if the data channel application certificate from the first terminal matches the first data channel application certificate The application certificate matches, and the data channel application certificate from the second terminal matches the second data channel application certificate, then the first application and the second application are allowed to establish an IMS data channel; if the data channel application certificate from the first terminal matches the first application certificate If the data channel application certificate does not match, and/or the data channel application certificate from the second terminal does not match the second data channel application certificate, the first application and the second application are prohibited from establishing an IMS data channel.
  • the present application provides a communication device, which may be a chip or a system-on-chip in a certificate management server, or may be a certificate management server for implementing the first aspect or any possible implementation of the first aspect
  • the functional modules of the method described in the manner includes: a first communication module for receiving an encrypted ticket from the AS and identification information of the first application, where the identification information of the first application is used to identify the first application of the first terminal; the second The communication module is used to send the encrypted ticket and the identification information of the first application to the KMS, and the encrypted ticket and the identification information of the first application are used for the KMS to verify the first application; and the first key is received by the KMS. Sent after the first application is successfully verified; the first communication module is further configured to send the data channel application certificate corresponding to the first key to the AS, and the data channel application certificate is used for the first application and the second application of the second terminal Carry out IMS data channel services.
  • the first communication module is further configured to obtain the address of the KMS; the second communication module is further configured to send the encrypted ticket and the identification information of the first application to the KMS according to the address of the KMS.
  • the first communication module is further configured to send the data channel application certificate and the identification information of the first application to the AS.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the encrypted ticket includes: identification information of the first application.
  • the encrypted ticket further includes: a key index of the second key, the second key matches the first key, and the second key is allocated by the KMS for the first application.
  • the present application provides a communication device.
  • the communication device may be a chip or a system-on-a-chip in a KMS, and may also be any of the possible implementation manners described in the KMS for implementing the second aspect or the second aspect.
  • the function module of the method includes: a third communication module, configured to obtain a first encrypted ticket from a certificate management server and identification information of a first application, where the identification information of the first application is used to identify the first terminal of the first terminal.
  • an application a first processing module for decrypting the first encrypted ticket and obtaining identification information in the first encrypted ticket; verifying the first application according to the identification information and the identification information of the first application; a third communication module, also used for If the verification of the first application is successful, send the first key to the certificate management server, the first key matches the second key allocated by the KMS for the first application, and the first key is used for the certificate management server to be the first key
  • the application generates a data channel application certificate, and the data channel application certificate is used for the first application to perform the IMS data channel service with the second application of the second terminal.
  • the first processing module is configured to determine whether the identification information matches the identification information of the first application, wherein if the identification information matches the identification information of the first application, it indicates that the first application is verified Success, if the identification information does not match the identification information of the first application, it indicates that the verification of the first application fails.
  • the first encrypted ticket further includes: a key index; and a first processing module configured to verify the first application according to the identification information, the key index and the identification information of the first application.
  • the first processing module is configured to determine whether the identification information matches the identification information of the first application; if the identification information matches the identification information of the first application, determine whether the key index matches the second application. Whether the keys match; wherein, if the key index matches the second key, it indicates that the verification of the first application is successful; if the key index does not match the second key, it indicates that the verification of the first application fails.
  • the above communication device further includes a fourth communication module, configured to receive the first encrypted ticket from the certificate management server and the identification information of the first application before the third communication module obtains the first encrypted ticket from the first terminal.
  • the first processing module is further configured to respond to the key request and allocate a second key and a second encrypted ticket to the first application, where the second encrypted ticket includes: the identification information of the first application, or the first application The identification information and the key index of the second key; the fourth communication module is further configured to send the second key and the second encrypted ticket to the first terminal.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the fourth communication module is further configured to establish a communication channel with the first terminal using GBA.
  • the present application provides a communication device.
  • the communication device may be a chip or a system-on-chip in the first terminal, or may be any possible implementation of the third aspect or the third aspect in the first terminal.
  • the communication device includes: a fifth communication module for sending an encrypted ticket and identification information of the first application to the AS, where the identification information of the first application is used to identify the first application of the first terminal; receiving the transmission from the AS
  • the data channel application certificate is sent by the certificate management server after successfully verifying the first application according to the encrypted ticket and the identification information of the first application; the sixth communication module is used to communicate with the second terminal according to the data channel application certificate.
  • the second application of IMS performs IMS data channel service.
  • the fifth communication module is further configured to send the address of the KMS to the AS, where the address of the KMS is used to instruct the certificate management server to communicate with the KMS.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the above communication device may further include: a seventh communication module, further configured to request the key and the ticket from the KMS before the fifth communication module sends the encrypted ticket and the identification information of the first application to the AS ; Receive the second key and the encrypted ticket distributed by the KMS for the first application, where the encrypted ticket includes: the identification information of the first application, or the identification information of the first application and the key index of the second key.
  • the first terminal and the KMS use GBA to establish a communication channel.
  • the data channel application certificate is generated by the certificate management server according to the first key, and the first key matches the second key; the sixth communication module is further configured to be used when the second terminal pairs When the first application is successfully verified, the data channel application certificate is verified through the cooperation of the first key and the second key.
  • the present application provides a communication device.
  • the communication device may be a chip or a system-on-a-chip in an AS, and may also be any of the possible implementation manners described in the AS for implementing the fourth aspect or the fourth aspect.
  • the function module of the method may be any of the possible implementation manners described in the AS for implementing the fourth aspect or the fourth aspect.
  • the communication device includes: an eighth communication module, configured to receive an encrypted ticket from the first terminal and identification information of the first application, where the identification information of the first application is used to identify the first application of the first terminal;
  • the ninth communication module is used for sending the encrypted ticket and the identification information of the first application to the certificate management server; receiving the first data channel application certificate from the certificate management server, the first data channel application certificate is that the certificate management server is the first application Allocated, the first data channel application certificate is used for the first application to perform the IMS data channel service with the second application of the second terminal; the second processing module is used to save the first data channel application certificate;
  • the eighth communication module is also used for for sending the first data channel application certificate to the first terminal.
  • the ninth communication module is further configured to receive a second data channel application certificate allocated by the certificate management server for the second application, where the second data channel application certificate is used for the second application to perform IMS with the first application a data channel service; the second processing module is further configured to save the second data channel application certificate; the eighth communication module is further configured to send the second data channel application certificate to the second terminal.
  • the eighth communication module is further configured to obtain the data channel application certificate from the first terminal and the data channel application certificate from the second terminal during the DTLS handshake process; the second processing module is further configured to use in matching the data channel application certificate from the first terminal with the first data channel application certificate; matching the data channel application certificate from the second terminal with the second data channel application certificate; if the data channel application certificate from the first terminal If the certificate matches the first data channel application certificate, and the data channel application certificate from the second terminal matches the second data channel application certificate, the first application and the second application are allowed to establish an IMS data channel; if the data from the first terminal If the channel application certificate does not match the first data channel application certificate, and/or the data channel application certificate from the second terminal does not match the second data channel application certificate, the first application and the second application are prohibited from establishing an IMS data channel.
  • the present application provides a certificate management server, comprising: a processor and a memory; the processor is coupled to the memory, and the processor is configured to read and execute instructions in the memory, so as to implement the first aspect and any one thereof The communication method based on the IMS data channel described in the possible implementation manner.
  • the present application provides a KMS, comprising: a processor and a memory; the processor is coupled to the memory, and the processor is configured to read and execute instructions in the memory, so as to implement the second aspect and any possible possibilities thereof
  • the communication method based on the IMS data channel described in the embodiment.
  • the present application provides a terminal, comprising: a processor and a memory; the processor is coupled to the memory, and the processor is configured to read and execute instructions in the memory, so as to implement the third aspect and any possibility thereof
  • the communication method based on the IMS data channel described in the implementation manner.
  • the present application provides an AS, comprising: a processor and a memory; the processor is coupled to the memory, and the processor is configured to read and execute instructions in the memory, so as to implement the fourth aspect and any possibility thereof
  • the communication method based on the IMS data channel described in the implementation manner.
  • the present application provides a communication system, including: a certificate management server, a KMS, and an AS; wherein, the certificate management server is configured to execute the IMS-based IMS according to the first aspect and any possible implementation manners thereof.
  • a data channel communication method KMS, configured to perform the IMS data channel-based communication method according to the second aspect and any possible implementation manner thereof
  • AS configured to perform the fourth aspect and any possible implementation manner thereof The communication method based on the IMS data channel described in the implementation manner.
  • the present application provides a computer-readable storage medium, where the computer-readable storage medium stores instructions, when the instructions are executed on a computer, for executing the first aspect, the second aspect, the third aspect or the The communication method based on the IMS data channel according to the fourth aspect and any possible implementation manner thereof.
  • the present application provides a computer program or computer program product that, when the computer program or computer program product is executed on a computer, enables the computer to implement the above-mentioned first aspect, second aspect, third aspect or fourth aspect
  • the communication method based on the IMS data channel described in the aspect and any possible implementation manner thereof.
  • 1 is a schematic diagram of a protocol stack of WebRTC in an embodiment of the application
  • FIG. 2 is a schematic diagram of a secure transmission protocol of different data types in the IMS in an embodiment of the present application
  • FIG. 3 is a schematic structural diagram of a communication system in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a ticket request process in an embodiment of the application.
  • FIG. 5 is a schematic diagram of a certificate request process in an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a communication method for an IMS data channel in an embodiment of the present application
  • FIG. 7 is a schematic structural diagram of a communication device in an embodiment of the present application.
  • FIG. 8 is another schematic structural diagram of a communication device in an embodiment of the present application.
  • FIG. 9 is another schematic structural diagram of a communication device in an embodiment of the present application.
  • FIG. 10 is a schematic diagram of hardware of a communication device in an embodiment of the present application.
  • the corresponding apparatus may include one or more units, such as functional units, to perform one or more of the described method steps (eg, one unit performs one or more steps) , or units, each of which performs one or more of the steps), even if such unit or units are not explicitly depicted or illustrated in the figures.
  • the corresponding method may contain a step to perform the functionality of the one or more units (eg, a step to perform the one or more units) functionality, or steps, each of which performs the functionality of one or more of the units), even if such step or steps are not explicitly described or illustrated in the figures.
  • the browsers themselves do not support establishing a channel directly with each other for communication, and they are all relayed through the server.
  • a and B they want to communicate, they first need to establish a channel between A and the server, B and the server.
  • a sends a message to B A first sends the message to the server, and the server relays the message from A to B, and vice versa.
  • a message between A and B needs to pass through two channels, and the efficiency of communication is limited by the bandwidth of these two channels at the same time. At the same time, such channels are not suitable for the transmission of data streams.
  • WebRTC web real time communication
  • WebRTC is a technology that supports web browsers for real-time voice conversations or video conversations, and aims to enable browsers to provide a simple interface for real-time communication (RTC).
  • RTC real-time communication
  • WebRTC establishes a (peer-to-peer) channel between a browser and another browser through a series of signaling. This channel can send any data without going through the server to achieve high performance , low latency, point-to-point communication.
  • Fig. 1 is the schematic diagram of the protocol stack of the WebRTC in the embodiment of the application, as shown in Fig.
  • the protocol stack adopted by the WebRTC data channel is the flow control transmission protocol (stream control transmission protocol over datagram transport layer security over interactive connectivity establishment or user datagram protocol, SCTP over DTLS over ICE/UDP), in which the underlying UDP implements low-latency communication, the intermediate DTLS implements data channel secure communication, and the last high-level SCTP supports Multiple streams of different reliability are established in one SCTP connection.
  • flow control transmission protocol stream control transmission protocol over datagram transport layer security over interactive connectivity establishment or user datagram protocol, SCTP over DTLS over ICE/UDP
  • FIG. 2 is a schematic diagram of the secure transmission protocols of different data types in the IMS in the embodiment of the application. Referring to FIG.
  • the IMS data channel adopts SCTP over DTLS over UDP
  • the audio (voice) service adopts the secure real-time transmission protocol (secure real-time transmission protocol).
  • time transport protocol, SRTP) and video (video) services also use SRTP.
  • SCTP over DTLS over UDP adopts a security certificate verification mechanism
  • SRTP adopts a security key verification mechanism.
  • the network side will lose the ability to control and supervise the communication content in the IMS data channel, affecting the reliability of the communication.
  • FIG. 3 is a schematic diagram of the architecture of the communication system in the embodiment of the application.
  • the communication system 300 may include: a terminal 301, a key management system (KMS) 302, and a certificate management server 303 and an application server (application server, AS) 304 .
  • KMS key management system
  • AS application server
  • the first terminal in the terminal 301 can be used to send an encrypted ticket (which can also be recorded as the first encrypted ticket) and the identification information of the first application to the AS 304, and the encrypted ticket and the identification information of the first application are used for the certificate management server.
  • 303 Verify the first application; receive the data channel application certificate sent by AS 304, the data channel application certificate is sent after the certificate management server 303 successfully verifies the first application; send the data channel application certificate to the second terminal in the terminal 301, the data The channel application certificate is used for the first application to perform the IMS data channel service with the second application of the second terminal in the terminal 301;
  • the second terminal can be used to verify the first application according to the data channel application certificate; if the verification of the first application is successful, establish an IMS data channel with the first terminal; obtain the first key according to the data channel application certificate, The cooperation of the key and the second key distributed by the KMS for the first application verifies the data channel application certificate of the first application, and then the first application and the second application communicate with the first application in the IMS data channel; If the verification fails, the process ends.
  • the KMS 302 can be used to obtain the encrypted ticket from the certificate management server 303 and the identification information of the first application; decrypt the encrypted ticket to obtain the application identification in the encrypted ticket; according to the application identification in the encrypted ticket and the first application sent from the certificate management server
  • the identification information of the application verifies the first application; if the verification is successful, the first key is sent to the certificate management server 303, the first key matches the second key distributed by the KMS 302 for the first application, and the first key is
  • a key is used by the certificate management server 303 to generate a corresponding data channel application certificate (which may also be referred to as the first data channel application certificate), and the data channel application certificate can be used for the first application and the second application to perform IMS data channel services;
  • the certificate management server 303 can be used to send the encrypted ticket and the identification information of the first application to the AS 304, and the encrypted ticket and the identification information of the first application are used for the KMS 302 to verify the first application;
  • the key is sent by the KMS 302 after successfully verifying the first application 301;
  • the data channel application certificate corresponding to the first key is sent to the AS 304, and the data channel application certificate is used for the first application and the second application to perform IMS data channel services .
  • first terminal and/or the second terminal in this embodiment of the present application is a terminal device with a wireless communication function, which can be deployed on land, including indoor or outdoor, handheld, wearable, or vehicle-mounted; Can be deployed on water (such as ships, etc.); can also be deployed in the air (such as aircraft, balloons and satellites, etc.).
  • the above-mentioned terminal equipment can be a mobile phone (mobile phone), a tablet computer (Pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal device, an augmented reality (augmented reality, AR) terminal device, industrial control (industrial) wireless terminal in control), wireless terminal in self-driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety Wireless terminals, wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • the terminal device may also be a handheld device, vehicle-mounted device, wearable device, computing device, or other processing device connected to a wireless modem with wireless communication capabilities.
  • Terminal devices may be called by different names in different networks, for example: terminal device, access terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, terminal, wireless communication equipment, user agent or user device, cellular telephone, cordless telephone, session initiation protocol (SIP) telephone, wireless local loop (WLL) station, personal digital assistant (PDA), 5G network or terminal equipment in future evolution network, etc.
  • terminal device access terminal
  • subscriber unit subscriber station
  • mobile station mobile station
  • remote station remote terminal
  • mobile equipment user terminal
  • user agent or user device cellular telephone, cordless telephone, session initiation protocol (SIP) telephone, wireless local loop (WLL) station, personal digital assistant (PDA), 5G network or terminal equipment in future evolution network, etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • 5G network or terminal equipment in future evolution network etc.
  • a browser application needs to be installed in the first terminal and the second terminal, so that the first terminal and the
  • the above KMS can be deployed on a network application function (NAF) or on a third-party server.
  • the KMS can use a generic bootstrapping architecture (GBA) to authenticate the terminal 301, and securely communicate with the terminal 301 after the terminal 301 is authenticated.
  • GAA generic bootstrapping architecture
  • the terminal 301 if the KMS 302 is deployed on the NAF, the terminal 301 is connected to the NAF through the Ua interface, as shown by the dotted line in FIG. 3 , the terminal 301 communicates with the bootstrapping server function (BSF) 305 in the network to which it belongs through the Ub interface.
  • BSF bootstrapping server function
  • the KMS 302 is connected with the BSF 305 in the network to which it belongs through the Zn interface, and the above-mentioned BSF 305 is connected with the home subscriber server (home subscriber server, HSS) 306 through the Zh interface.
  • the above communication network may further include a call session control function (CSCF) 307 in the IMS network.
  • CSCF call session control function
  • the terminal 301 can be connected with the CSCF 307, the CSCF 307 is connected with the AS 304 through the IMS service control (IMS service control, ISC) interface, and the AS 304 is connected with the certificate management server 303, and the terminal 301 can send a message through the CSCF 307 and the AS 304 to The certificate management server 303, wherein the CSCF 307 and the AS 304 interact through a standard session initiation protocol (session initiation protocol, SIP).
  • IMS service control ISC interface
  • CSCF can be divided into P-CSCF (proxy CSCF) and S-CSCF (serving CSCF).
  • the communication method based on the IMS data channel provided by the embodiment of the present application will be described below with reference to the structure of the above-mentioned communication system.
  • FIG. 4 is a schematic diagram of a ticket request process in an embodiment of the present application. Referring to FIG. 4 , the method may include:
  • S401 The first terminal requests a key and a ticket from the KMS;
  • the first terminal may send a REQUEST_INIT message to the KMS to request the first application Corresponding keys and tickets.
  • the REQUEST_INIT message may carry the identification information of the first application.
  • the identification information of the first application may uniquely identify the first application of the first terminal. Then, the identification information of the first application may include the terminal identification of the first terminal, or the terminal identification of the first terminal and The application identifier of the first application. For example, if only one application in the first terminal (that is, the first application) requests a key and a ticket from the KMS at the same time, the REQUEST_INIT message may carry the terminal identifier of the first terminal (such as #UE A) ; If there are multiple applications including the first application in the first terminal to request keys and tickets from the KMS at the same time, the REQUEST_INIT message can carry the terminal identification (such as #UE A) of the first terminal and multiple The application identifier (eg #APP A) of one of the applications (eg, the first application), or the REQUEST_INIT message may carry the terminal identifier of the first terminal (eg #UE A) and the ID of each application in the multiple applications.
  • Application identifier eg #APP 1, #
  • the terminal identifier mentioned in the embodiment of the present application may be a device identifier used for a terminal, such as an international mobile subscriber identity (IMSI), an international mobile equipment identity (IMEI), and an international mobile subscriber identity (IMSI). ), etc., can also be the user identity of the user who uses the terminal, such as the Internet Protocol Multimedia Public Identity (IP multimedia public identity, IMPU); the application identity can be an application identifier (application identifier, AID). Of course, other forms of identification may exist, which are not specifically limited in this embodiment of the present application.
  • IMSI international mobile subscriber identity
  • IMEI international mobile equipment identity
  • IMSI international mobile subscriber identity
  • IP multimedia public identity IP multimedia public identity
  • IMPU Internet Protocol Multimedia Public Identity
  • the application identity can be an application identifier (application identifier, AID).
  • other forms of identification may exist, which are not specifically limited in this embodiment of the present application.
  • the above method may further include: establishing a communication channel between the first terminal and the KMS using GBA.
  • the first terminal initiates a GBA initialization request to the BSF; the BSF obtains the authentication information of the first terminal from the HSS, and generates the shared key Ks and the transaction identifier of the first terminal; the BSF sends the authentication information and transaction identifier of the first terminal to The first terminal, the first terminal stores it after corresponding processing; the first terminal carries the transaction identifier to initiate an authentication request to the KMS (that is, NAF); the KMS checks whether it stores a valid key, and if not, carries the transaction identifier to the KMS (namely NAF)
  • the BSF requests the Ks, and the KMS and the first terminal perform authentication and authentication on the Ks. After the authentication and authentication are successful, the first terminal obtains Ks. Further, the first terminal derives the key Ks_NAF for accessing the KMS by the first terminal according to Ks, and the subsequent communication between the first terminal and the KMS may be encrypted and protected by using Ks_NAF.
  • KMS assigns a key A (ie a second key) and an encrypted ticket A to the first application;
  • the KMS receives the REQUEST_INIT message (carrying the identification information of the first application) from the first terminal, and responds to the REQUEST_INIT message, assigning the corresponding key A and encrypted ticket A to the first application according to the identification information of the first application.
  • the encryption mechanism of encrypted ticket A is only known to KMS.
  • key A may be used for encrypted communication between the first application and the second application in the IMS data channel.
  • key A can be a private key.
  • the above encrypted ticket A is used for other network elements in the communication network to verify the first application.
  • the encrypted ticket A may include: identification information of the first application.
  • the encrypted note A may further include: the key index of the key A.
  • the key index of the key A may be the key A itself, or the key B (public key) corresponding to the key A, or the identifier of the key A, etc.
  • the key The index may also be in other forms, as long as the key A can be uniquely determined through the key index of the key A, which is not specifically limited in this embodiment of the present application.
  • S403 The KMS sends the key A and the encrypted ticket A to the first terminal.
  • the KMS sends a REQUEST_RESP message to the first terminal, and carries the key A and the encrypted ticket A in the REQUEST_RESP message.
  • the first terminal when the first application needs to perform encrypted communication with the second application through the IMS data channel, the first terminal needs to establish the IMS data channel between itself and the second terminal first, and before establishing the data channel , the first terminal needs to apply to the certificate management server for a data channel application certificate for the IMS data channel service.
  • FIG. 5 is a schematic diagram of a certificate request process in this embodiment of the application.
  • the method may include:
  • S501 The first terminal sends the encrypted ticket B and the identification information of the first application to the AS;
  • the first terminal may send a SIP message to the AS, and the SIP message may carry the encrypted ticket B and the identification information of the first application, and then the AS will carry the encrypted ticket B and the identification information of the first application in the hypertext transmission security protocol. (hyper text transfer protocol over securesocket layer), HTTPS) message sent to the certificate management server.
  • HTTPS hypertext transfer protocol over securesocket layer
  • the encrypted ticket B may be the same as the encrypted ticket A (ie the first application is legal), or it may be different from the encrypted ticket A (ie the first application is illegal).
  • the identification information of the first application is sent as plaintext.
  • the identification information of the first application may include: the terminal identification of the first terminal, such as the IMSI of the first terminal; and may also include the application identification of the first application, such as AID, in this case, the identification information of the first application may be It is a combination of IMSI and AID.
  • the legality of the first application in the embodiments of the present application refers to that the first application is legal for the IMS data channel between the first application and the second application, and the first application can pass the IMS data channel. Perform reliable IMS data channel encrypted communication with the second application; similarly, if the first application is illegal, it means that the first application is illegal for the IMS data channel between the first application and the second application, and the first application cannot communicate with the second application.
  • the second application performs encrypted communication on the IMS data channel, but at the same time the first application may also be legal for other IMS data channels between the first terminal and the second terminal. It can be seen that, for different applications, the validity is relative to the IMS data channel, so that the reliability of encrypted communication on each IMS data channel can be guaranteed.
  • S501 may include: the first terminal sends a certificate request to the AS, wherein the AS may carry the identification information of the first application in the field of the certificate request forwarded to the certificate management server, then the first terminal may omit sending The step of the identification information of the first application, that is, the first terminal may only send the encrypted ticket B to the AS, and the AS automatically sends the encrypted ticket B together with the identification information of the first application to the certificate management server.
  • the first terminal is registered in the IMS network.
  • the first terminal can first send the encrypted ticket B to the S-CSCF, and then the S-CSCF forwards it to the AS, and the AS then forwards the identification information of the first application (such as the terminal identification of the first terminal) and the encrypted ticket B to the certificate management server.
  • the S-CSCF forwards it to the AS
  • the AS forwards the identification information of the first application (such as the terminal identification of the first terminal) and the encrypted ticket B to the certificate management server.
  • the first terminal can send the encrypted ticket B to the S-CSCF through the following MESSAGE request message:
  • S502 The AS sends the encrypted ticket B and the identification information of the first application to the certificate management server;
  • the first terminal may also send the KMS address to the AS, and the AS forwards the KMS address to the certificate management server, so that the certificate management server can communicate with the corresponding KMS based on the KMS address.
  • the above certificate request may also carry a KMS address.
  • the certificate management server sends the encrypted ticket B and the identification information of the first application to the KMS;
  • the certificate management server may send the encrypted ticket B and the identification information of the first application to the corresponding KMS according to the address of the KMS sent by the first terminal.
  • the certificate management server sends a decryption request to the KMS, and the decryption request may carry the above-mentioned encrypted ticket B and the identification information of the first application.
  • KMS decrypts the encrypted bill B, and obtains the identification information in the encrypted bill B;
  • the identification information in the encrypted ticket B may include a terminal identification, or a terminal identification and an application identification. It can be understood that since the encrypted ticket B is the ticket to be verified, the terminal identifier may be the terminal identifier of the first terminal, or may not be the terminal identifier of the first terminal; similarly, the application identifier in the encrypted ticket B may be The application identifier of the first application may not be the application identifier of the first application.
  • S505 The KMS verifies the first application according to the identification information in the encrypted ticket B and the identification information of the first application, if the verification of the first application is successful, execute S506, and if the verification of the first application fails, the process ends;
  • the KMS After the KMS decrypts the encrypted ticket B, it obtains identification information, such as the terminal identification. Then, the KMS can match the terminal identification with the terminal identification of the first terminal in the identification information of the first application sent by the certificate management server, so as to verify the Whether the terminal identifier in the encrypted ticket B is consistent with the terminal identifier of the first terminal that sent the encrypted ticket B, if the two are consistent (or match), it indicates that the verification of the first application is successful, that is, the first application is legal, otherwise , if the two are inconsistent (or do not match), it indicates that the verification of the first application fails, that is, the first application is illegal.
  • the obtained identification information may also include a terminal identification and an application identification.
  • the KMS respectively associates the terminal identification and application identification with the terminal identification and the first terminal identification of the first terminal in the identification information of the first application.
  • the application identification of an application is matched to verify whether the terminal identification in the encrypted ticket B is consistent with the identification information of the first application that sent the encrypted ticket B. If the two are consistent (or match), it indicates that the first application If the verification of the application is successful, that is, the first application is legal, otherwise, if the two are inconsistent (or do not match), it indicates that the verification of the first application fails, that is, the first application is illegal.
  • the encrypted note B may also include a key index.
  • S505 may include: KMS according to the identification information in the encrypted note B, the key index and the first application The identification information verifies the first application.
  • the KMS first matches the identification information in the encrypted ticket B with the identification information of the first application. If the two are consistent (or match), the KMS matches the key index in the encrypted ticket B with the key index assigned to the first application in S402.
  • the key A is matched. For example, if the key index is the key itself, the key is compared with the key A to determine whether the two are consistent, or if the key index is the identifier corresponding to the key, then Determine whether the key corresponding to the ID is key A. If the two are consistent (or match), it indicates that the verification of the first application is successful, that is, the first application is legal; otherwise, if the two are inconsistent (or do not match), it indicates that the verification of the first application fails, that is, the first application fails. illegal.
  • the encrypted note B may also contain other information, which is not specifically limited in this embodiment of the present application.
  • the KMS after S504, if the verification of the first application fails, the KMS considers the first application to be illegal, and then the KMS notifies the certificate management server, so that the certificate management server rejects the certificate request of the first terminal.
  • the key B matches the key A allocated by the KMS for the first application in S402. It can be understood that, if the key A is a private key, the key B can be a matching public key.
  • the certificate management server generates a data channel application certificate according to the key B;
  • the certificate management server sends the data channel application certificate to the AS;
  • the certificate management server sends the generated data channel application certificate and the identification information of the first application to the AS, and the AS sends the data channel application certificate and the identification information of the first application together to the first terminal.
  • the first terminal can Knowing that the received data channel application certificate is allocated to the first application, the data channel application certificate is then stored in association with the identification information of the first application.
  • the AS first forwards the data channel application certificate and the identification information of the first application to the S-CSCF, and then the S-CSCF forwards them to the first terminal.
  • the AS may forward the data channel application certificate to the S-CSCF via the following 200(OK) response message:
  • the AS may save the data channel application certificate and the association relationship between the data channel application certificate and the application for subsequent determination of whether to allow the first application certificate.
  • the application establishes an IMS data channel with the second application.
  • S510 The first terminal uses the data channel application certificate to perform the IMS data channel service with the second application of the second terminal.
  • the above IMS data channel services may be: one or more services related to the IMS data channel between the first application and the second application, such as verifying the first application, determining the relationship between the first application and the second application Whether to allow the establishment of an IMS data channel, the establishment of an IMS data channel between the first application and the second application, the encrypted communication between the first application and the second application on the IMS data channel, etc.
  • other services may also be included, which is implemented in this application Examples are not particularly limited.
  • the first terminal may send the data channel application certificate to the second terminal, and after receiving the data channel application certificate, the second terminal may A and key B verify the data channel application certificate, and after the verification passes, perform encrypted communication with the first terminal on the IMS data channel to verify whether the first application allows encrypted communication using the IMS data channel. If the verification of the first application is successful, and the second terminal determines that the first application is legal, then the second terminal and the first terminal establish an IMS data channel between the first application and the second application, and use the IMS data channel on the IMS data channel. Perform encrypted communication, otherwise, if the verification of the first application fails and the second terminal determines that the first application is illegal, then the second terminal may refuse to establish an IMS data channel between the first application and the second application with the first terminal .
  • APP1 first application
  • APP2 of UE B (second terminal) want to perform IMS data channel service
  • APP1 and APP2 may be different
  • the application identifiers of APP1 and APP2 are the same, that is, #APP1.
  • APP1 is a video call application
  • APP2 is the same video call application; or, APP1 and APP2 can also be on different terminals.
  • the application identifiers of APP1 and APP2 can have at least the same part, for example, the application identifier of APP1 can be #X-APP1, the application identifier of APP2 The application ID can be #X-APP2. In the following, it is taken as an example that APP1 and APP2 have the same application identifier #APP1.
  • UE A and UE B apply for the key and encryption ticket from KMS respectively.
  • KMS assigned key A (private key) and encrypted ticket A to APP1;
  • UE A sends a certificate request to AS, wherein the certificate request carries encrypted ticket A, KMS address and the application identifier of APP1 (#APP1); since UE A has been registered in the IMS network, then AS After receiving the certificate request, forward the certificate request to the certificate management server, wherein the certificate request carries the encrypted ticket A, the KMS address, the terminal identifier of the UE (#UE A) and #APP 1;
  • Step 3 After receiving the certificate request, the certificate management server sends a parsing request to KMS according to the KMS address, requesting KMS to parse the encrypted ticket A, wherein the parsing request carries the encrypted ticket A, #UE A and #APP 1 ;
  • the fourth step after receiving the parsing request, the KMS parses the encrypted ticket A, and obtains #UE A and #APP 1 in the encrypted ticket A. Then, the KMS parses the #UE A and #APP 1 in the encrypted ticket A with the analysis. The #UE A and #APP 1 carried in the request are compared, and the two are consistent, then the KMS sends the key B (that is, the public key of the key A) corresponding to #UE A and #APP 1 to the certificate management server;
  • the certificate management server can generate the data channel application certificate corresponding to the first application according to the key B, and then send the data channel application certificate, #UE A and #APP 1 corresponding to the first application to the AS;
  • Step 6 AS saves the data channel application certificate, #UE A and #APP 1 corresponding to the first application, and forwards it to UE A;
  • the above-mentioned first to sixth steps are also performed on UE B, and the AS saves the data channel application certificate, #UE B and #APP 1 corresponding to the second application, and forwards it to UE B.
  • the seventh step UE A sends the SDP Offer or the SIP message MESSAGE A attached to the SDP Offer to the AS, and MESSAGE A carries #UE A and #APP 1;
  • Step 8 AS obtains #UE A and #APP 1 from the MESSAGE A.
  • AS determines whether to allow UE A to transmit APP1 data on the IMS data channel according to #UE A and #APP 1. If so, AS sends UE A to the UE.
  • B forwards MESSAGE A and instructs UE B to allow UE A to transmit the data of APP1 on the IMS data channel; on the contrary, if it is prohibited, when AS forwards MESSAGE A to UE B, #APP1 is deleted.
  • the ninth step AS receives the SDP Answer from UE B or the SIP message MESSAGE B attached to the SDP Answer, #MESSAGE B carries #UE B and #APP1; then, AS forwards MESSAGE B, at the same time, indicates to UE A whether Allow UE A to transmit the data of APP1 on the IMS data channel; further, AS establishes an IMS data channel for APP1 of UE A and APP2 of UE B;
  • UE A determines whether to allow UE A to transmit the data of APP1 on the IMS data channel according to the instruction. If allowed, UE A sends the encrypted data of APP1 to UE B on the IMS data channel.
  • UE B obtains the data of APP1 through decryption.
  • the certificate management server issues a reliable data channel application certificate to the first terminal, and the IMS network can learn the data channel application certificate, avoiding the first terminal to manually install/replace a third-party (non-communication network-provided) certificate And use unreliable self-signed certificates to provide reliable IMS data channel communication.
  • FIG. 6 is a schematic flowchart of a communication method for an IMS data channel in an embodiment of the present application. Referring to FIG. 6 , after the above S508, the method may include:
  • S601 the AS obtains the data channel application certificate of the first application
  • the certificate management server allocates the data channel application certificate to the first application, and sends it to the first terminal via the AS.
  • the AS saves the data channel application certificate of the first application.
  • S602 the AS obtains the data channel application certificate of the second application
  • the certificate management server allocates the data channel application certificate to the second application, and sends it to the second terminal via the AS.
  • the AS saves the data channel application certificate of the second application.
  • data channel application certificate of the first application and/or the data channel application certificate of the second application are used for the first application and the second application to perform the IMS data channel service.
  • S603 the AS obtains the data channel application certificate exchanged between the first terminal and the second terminal during the DTLS handshake process
  • the first terminal and the second terminal will respectively send data channel application certificates to the AS to exchange certificates.
  • the exchanged data channel application certificate may be the data channel application certificate obtained by the first application and the second application through S501 to S510, or may be the data channel application certificate provided by a third party (non-communication network).
  • the AS calculates the first fingerprint information and the second fingerprint information corresponding to the data channel application certificate exchanged between the first terminal and the second terminal;
  • the AS obtains the data channel application certificate exchanged between the first terminal and the second terminal through the DTLS process, such as the data channel application certificate from the first terminal and the data channel application certificate from the second terminal, and then calculates the fingerprints of the two certificates respectively. information to obtain the first fingerprint information and the second fingerprint information.
  • the AS matches the first fingerprint information with the data channel application certificate of the first application, and matches the second fingerprint information with the data channel application certificate of the second application; if the first fingerprint information matches the data channel application certificate of the first application The application certificate matches, and the second fingerprint information matches the data channel application certificate of the second application, then confirm that the user of the IMS data channel is a legitimate user, and execute S606, if the first fingerprint information and the data channel application certificate of the first application do not match. match, and/or the second fingerprint information does not match the data channel application certificate of the second application, then execute S607;
  • S606 the AS allows the first application to establish an IMS data channel with the second application
  • S607 The AS prohibits the first application from establishing an IMS data channel with the second application.
  • matching the fingerprint information with the data channel application certificate by the AS in S605 may include: the AS calculates the fingerprint information corresponding to the data channel application certificate, and then the calculated fingerprint information corresponds to the data channel application certificate exchanged in the DTLS handshake process. The fingerprint information is compared to determine whether the two are consistent. If the two are consistent, it indicates that the two match; otherwise, if the two are inconsistent, it indicates that the two do not match.
  • the above fingerprint information may be digest information obtained by applying the certificate to the data channel.
  • the IMS network can reject the use of non-identical data channels by checking whether the fingerprint information of the certificate exchanged in the DTLS handshake process is the data channel application certificate issued by the certificate management server.
  • the data channel application certificate generated by the IMS network ensures the secure communication of the terminal, and also enables the communication IMS network to supervise the reliability of the communication process.
  • an embodiment of the present application provides a communication device.
  • the communication device may be a chip or a system-on-chip in a certificate management server, or may be used in a certificate management server for any of the above possible implementation manners.
  • the function module of the method For example, FIG. 7 is a schematic structural diagram of a communication device in an embodiment of the application. Referring to FIG.
  • the communication device 700 includes: a communication module 701 for receiving an encrypted ticket and a first application from an AS The identification information of the first application is used to identify the first application of the first terminal; the communication module 702 is used to send the encrypted ticket and the identification information of the first application to the KMS, and the encrypted ticket and the identification information of the first application are used for Verifying the first application at the KMS; receiving the first key, which is sent by the KMS after the first application is successfully verified; the communication module 701 is also used to send the data corresponding to the first key to the AS The channel application certificate, and the data channel application certificate is used for the first application to perform the IMS data channel service with the second application of the second terminal.
  • the communication module 701 is further configured to obtain the address of the KMS; the second communication module is further configured to send the encrypted ticket and the identification information of the first application to the KMS according to the address of the KMS.
  • the communication module 701 is further configured to send the data channel application certificate and the identification information of the first application to the AS.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the encrypted ticket includes: identification information of the first application.
  • the encrypted ticket further includes: a key index of the second key, the second key matches the first key, and the second key is allocated by the KMS for the first application.
  • an embodiment of the present application provides a communication device.
  • the communication device may be a chip or a system-on-chip in a KMS, and may also be a function in the KMS for implementing the method described in any of the above possible implementation manners. module.
  • FIG. 8 is another schematic structural diagram of the communication apparatus in this embodiment of the application. Referring to FIG.
  • the communication apparatus 800 may include: a communication module 801 for obtaining the first information from the certificate management server The encrypted ticket and the identification information of the first application, the identification information of the first application is used to identify the first application of the first terminal; the processing module 802 is used to decrypt the first encrypted ticket and obtain the identification information in the first encrypted ticket; according to The identification information and the identification information of the first application are used to verify the first application; the communication module 801 is further configured to send a first key to the certificate management server if the verification of the first application is successful, and the first key and KMS are the first key. A second key assigned by an application matches, the first key is used by the certificate management server to generate a data channel application certificate for the first application, and the data channel application certificate is used for the first application to perform IMS data with the second application of the second terminal channel business.
  • the processing module 802 is configured to determine whether the identification information matches the identification information of the first application, wherein if the identification information matches the identification information of the first application, it indicates that the verification of the first application is successful , if the identification information does not match the identification information of the first application, it indicates that the verification of the first application fails.
  • the first encrypted ticket further includes: a key index; and a first processing module configured to verify the first application according to the identification information, the key index and the identification information of the first application.
  • the processing module 802 is configured to determine whether the identification information matches the identification information of the first application; if the identification information matches the identification information of the first application, determine whether the key index matches the second key index. Whether the keys match; wherein, if the key index matches the second key, it indicates that the verification of the first application is successful; if the key index does not match the second key, it indicates that the verification of the first application fails.
  • the above communication device 800 further includes: a communication module 803 for obtaining the first encrypted ticket from the certificate management server and the identification information of the first application at the communication module 801 Before, receiving a key request from the first terminal; the processing module 802 is further configured to respond to the key request and allocate a second key and a second encrypted ticket to the first application, where the second encrypted ticket includes: an identifier of the first application information, or the identification information of the first application and the key index of the second key; the communication module 803 is further configured to send the second key and the second encrypted ticket to the first terminal.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the communication module 803 is further configured to establish a communication channel with the first terminal using GBA.
  • FIG. 9 is another schematic structural diagram of the communication device in the embodiment of the present application.
  • the communication device 900 includes: a communication module 901 for sending an encrypted ticket and an AS to an AS.
  • the identification information of the first application the identification information of the first application is used to identify the first application of the first terminal; the data channel application certificate sent by the AS is received, and the data channel application certificate is the certificate management server according to the encrypted ticket and the first application.
  • the identification information is sent after the first application is successfully verified; the communication module 902 is configured to perform the IMS data channel service with the second application of the second terminal according to the data channel application certificate.
  • the communication module 901 is further configured to send the address of the KMS to the AS, where the address of the KMS is used to instruct the certificate management server to communicate with the KMS.
  • the identification information of the first application includes: a terminal identification of the first terminal; or, a terminal identification of the first terminal and an application identification of the first application.
  • the terminal identification of the first terminal includes: a device identification of the first terminal or a user identification of a user using the first terminal.
  • the above communication apparatus may further include: a communication module 903, further configured to send an encrypted ticket and the identification information of the first application to the AS before the communication module 901 sends an encrypted ticket to the AS.
  • the KMS requests the key and the ticket; receives the second key and the encrypted ticket distributed by the KMS for the first application, the encrypted ticket includes: the identification information of the first application, or the identification information of the first application and the key index of the second key .
  • the communication module 903 is further configured to establish a communication channel with the KMS using GBA.
  • the data channel application certificate is generated by the certificate management server according to the first key, and the first key matches the second key; the communication module 902 is further used for When an application is successfully verified, the data channel application certificate is verified through the cooperation of the first key and the second key.
  • an embodiment of the present application provides a communication device.
  • the communication device may be a chip or a system-on-chip in an AS, and may also be a function in the AS for implementing the method described in any of the above possible implementation manners. module. For example, still referring to FIG.
  • the communication device includes: a communication module 801 for receiving an encrypted ticket from a first terminal and identification information of a first application, where the identification information of the first application is used to identify the first The first application of the terminal; the communication module 803 is used to send the encrypted ticket and the identification information of the first application to the certificate management server; receive the first data channel application certificate from the certificate management server, and the first data channel application certificate is certificate management Assigned by the server to the first application, the first data channel application certificate is used for the first application to perform the IMS data channel service with the second application of the second terminal; the processing module 802 is used to save the first data channel application certificate; the communication module 801 , and is also used to send the first data channel application certificate to the first terminal.
  • the communication module 803 is further configured to receive a second data channel application certificate allocated by the certificate management server for the second application, and the second data channel application certificate is used for the second application to perform IMS data with the first application channel service; the second processing module is further configured to save the second data channel application certificate; the communication module 801 is further configured to send the second data channel application certificate to the second terminal.
  • the communication module 801 is further configured to obtain the data channel application certificate from the first terminal and the data channel application certificate from the second terminal during the DTLS handshake process;
  • the processing module 802 is further configured to The data channel application certificate from the first terminal is matched with the first data channel application certificate; the data channel application certificate from the second terminal is matched with the second data channel application certificate; if the data channel application certificate from the first terminal matches the If the first data channel application certificate matches, and the data channel application certificate from the second terminal matches the second data channel application certificate, the first application and the second application are allowed to establish an IMS data channel; if the data channel application certificate from the first terminal matches If the certificate does not match the first data channel application certificate, and/or the data channel application certificate from the second terminal does not match the second data channel application certificate, the first application and the second application are prohibited from establishing an IMS data channel.
  • communication module 701, communication module 702, communication module 801, communication module 803, communication module 901, communication module 902, and communication module 903 may be a transceiver circuit, a transceiver interface, a transceiver, etc.; the processing module 802 may be for one or more processors.
  • FIG. 10 is a hardware schematic diagram of a communication device in an embodiment of the present application.
  • the communication device 1000 provided in an embodiment of the present application, such as a terminal, a certificate management server, a KSM, and an AS, adopts general computer hardware. It includes a processor 1001 , a memory 1002 , a bus 1003 , an input device 1004 and an output device 1005 .
  • memory 1002 may include computer storage media in the form of volatile and/or non-volatile memory, such as read-only memory and/or random access memory.
  • the memory 1002 may store operating systems, application programs, other program modules, executable code, program data, user account opening data, user subscription data, and the like.
  • An input device 1004 may be used to input commands and information to the communication device 1000, such as a keyboard or a pointing device such as a mouse, trackball, touchpad, microphone, joystick, game pad, satellite dish, scanner, or similar device . These input devices may be connected to the processor 1001 through the bus 1003 .
  • the output device 1005 can be used for the communication device 1000 to output information.
  • the output device 1005 can also be other peripheral output devices, such as speakers and/or printing devices, which can also be connected to the processor 1001 through the bus 1003 .
  • Communication device 1000 may be connected to a network, such as a local area network (LAN), through network interface 1006.
  • LAN local area network
  • the computer-implemented instructions stored in the communication device 1000 may be stored in a remote storage device, rather than being limited to local storage.
  • the terminal executes the executable code or application program stored in the memory 1002, the terminal executes the method steps on the terminal side in the above embodiments, for example, S401, S501, S510 and so on.
  • the specific execution process refer to the foregoing embodiment, and details are not repeated here.
  • the terminal executes the method steps on the terminal side in the above embodiments, for example, S503, S507, S508 and so on.
  • the specific execution process refer to the foregoing embodiment, and details are not repeated here.
  • the terminal executes the method steps on the terminal side in the above embodiments, such as S402 to S403, S504 to S506, and so on.
  • the specific execution process refer to the foregoing embodiment, and details are not repeated here.
  • the terminal executes the method steps on the terminal side in the above embodiments, such as S503, S509, S601 to S607, and so on.
  • the specific execution process refer to the foregoing embodiment, and details are not repeated here.
  • the above-mentioned memory 1002 stores data for realizing the functions of the communication module 701 , the communication module 702 , the communication module 801 , the communication module 803 , the communication module 901 , the communication module 902 , the communication module 903 and the processing module 802 in FIGS. 7 to 9 .
  • the computer executes the instructions.
  • the device 1001 invokes the computer-executed instructions stored in the memory 1002 to implement, and the specific implementation process and functions refer to the above-mentioned related embodiments.
  • an embodiment of the present application provides a communication system, which is the network side of the communication system shown in FIG. 1, and may include: a certificate management server, a KMS, and an AS; wherein, the certificate management server, KMS and and/or AS, respectively configured to execute the communication method based on the IMS data channel as described in any of the above possible implementation manners.
  • an embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores instructions, and when the instructions are run on a computer, is used to execute the above-mentioned embodiments and any possible implementation thereof
  • the communication method based on the IMS data channel described in the method.
  • the embodiments of the present application provide a computer program or computer program product, which, when the computer program or computer program product is executed on a computer, enables the computer to realize the above-mentioned embodiments and any possible implementation manners thereof.
  • the described communication method based on IMS data channel.
  • Computer-readable media may include computer-readable storage media, which corresponds to tangible media, such as data storage media, or communication media including any medium that facilitates transfer of a computer program from one place to another (eg, according to a communication protocol) .
  • a computer-readable medium may generally correspond to (1) a non-transitory tangible computer-readable storage medium, or (2) a communication medium, such as a signal or carrier wave.
  • Data storage media can be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, code and/or data structures for implementing the techniques described in this application.
  • the computer program product may comprise a computer-readable medium.
  • such computer-readable storage media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, flash memory or may be used to store instructions or data structures desired program code in the form of any other medium that can be accessed by a computer.
  • any connection is properly termed a computer-readable medium.
  • a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave are used to transmit instructions from a website, server, or other remote source
  • the coaxial cable Wire, fiber optic cable, twisted pair, DSL or wireless technologies such as infrared, radio and microwave are included in the definition of media.
  • computer-readable storage media and data storage media do not include connections, carrier waves, signals, or other transitory media, but are instead directed to non-transitory, tangible storage media.
  • magnetic disks and optical disks include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), and Blu-ray disks, where disks typically reproduce data magnetically, while disks reproduce optically with lasers data. Combinations of the above should also be included within the scope of computer-readable media.
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGAs field programmable logic arrays
  • the term "processor,” as used herein may refer to any of the foregoing structure or any other structure suitable for implementation of the techniques described herein.
  • the functions described by the various illustrative logical blocks, modules, and steps described herein may be provided within dedicated hardware and/or software modules configured for encoding and decoding, or in combination with into the combined codec.
  • the techniques may be fully implemented in one or more circuits or logic elements.
  • the techniques of this application may be implemented in a wide variety of devices or apparatuses, including a wireless handset, an integrated circuit (IC), or a set of ICs (eg, a chip set).
  • IC integrated circuit
  • Various components, modules, or units are described herein to emphasize functional aspects of means for performing the disclosed techniques, but do not necessarily require realization by different hardware units. Indeed, as described above, the various units may be combined in codec hardware units in conjunction with suitable software and/or firmware, or by interoperating hardware units (including one or more processors as described above) supply.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供一种基于IMS数据通道的通信方法及设备。其中，该方法可以包括：证书管理服务器接收来自AS的加密票据和第一应用的标识信息；证书管理服务器向KMS发送加密票据和第一应用的标识信息；证书管理服务器接收第一密钥；证书管理服务器向AS第一终端发送第一密钥对应的数据通道应用证书，数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务。在本申请中，证书管理服务器向第一终端发放可靠的数据通道应用证书，并且IMS网络能够获知该数据通道应用证书，避免第一终端手动安装/替换第三方(非通信网络提供)证书和使用不可靠的自签署证书，进而提供可靠地IMS数据通道通信。

Description

一种基于IMS数据通道的通信方法及设备
本申请要求于2020年8月11日提交中国国家知识产权局、申请号为202010803406.9、申请名称为“一种基于IMS数据通道的通信方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信领域，特别涉及一种基于IMS数据通道的通信方法及设备。
背景技术
互联网协议多媒体子系统(internet protocol multimedia subsystem，IMS)数据通道是业界新出现的一个新概念。其主要技术特征是在长期演进语音承载(voice over long term evolution，VoLTE)语音业务基础上叠加第五代无线通信(5th generation wireless systems，5G)技术的数据信道，从而将基于IMS的实时音视频通信升级为实时交互，丰富了IMS使能的业务场景。
目前，IMS数据通道可以认为是一种新增的媒体类型，可以采用网页即时通信(web real time communication，WebRTC)中用到的基于用户数据报协议的数据包传输层安全性协议上的流控制传输协议(stream control transmission protocol over datagram transport layer security over user datagram protocol，SCTP over DTLS over UDP)作为承载协议，这就意味着IMS数据通道的安全机制与音频业务和视频业务所采用的安全机制是不同的，前者使用SCTP over DTLS over UDP协议，后者使用的是安全实时传输协议(secure real time transport protocol，SRTP)。对于SCTP over DTLS over UDP来说，需要安全证书，而对于SRTP来说，则仅需要获得密钥。如果IMS数据通道使用的安全证书由终端或者应用自行生成或安装的话，网络会失去对IMS数据通道的通信内容的控制和监管能力，影响通信的可靠性。
发明内容
本申请提供了一种基于IMS数据通道的通信方法及设备，以提供可靠地IMS数据通道通信。
第一方面，本申请提供一种基于IMS数据通道的通信方法，该方法可以应用于通信网络中的证书管理服务器。在该通信网络中，证书管理服务器可以通过IMS网络的网元，如应服务器(application server，AS)以及呼叫会话控制功能(call session control function，CSCF)与相应的终端(如第一终端)通信。当第一终端上的第一应用将要与第二终端上的第二应用进行IMS数据通道业务时，首先，证书管理服务器接收由AS转发的来自第一终端的加密票据(ticket)和用于标识第一应用的第一应用的标识信息，然后，证书管理服务器向密钥管理服务器(key management system，KMS)发送加密票据和第一应用的标识信息，使得KMS根据加密票据和第一应用的标识信息对第一应用进行验证，并将验证结果通知证书管理服务器；接着，在对第一应用验证成功后，证书管理服务器接收到来自KMS的第一密钥，并根据第一密钥生成相应的数据通道应用证书，最后，证书管理服务器将该数据通道应用证书经由AS发送给第一终端，使得第一应用能够根据该数据通道应用证书与第二应用进行IMS数据通道业务。
在本申请中，证书管理服务器向第一终端发放可靠的数据通道应用证书，并且IMS网络能够获知该数据通道应用证书，避免第一终端手动安装/替换第三方(非通信网络提供)证书和使用不可靠的自签署证书，进而提供可靠地IMS数据通道通信。
在一些可能的实施方式中，第一终端还可以向证书管理服务器发送KMS的地址，如此，证书管理服务器可以根据KMS的地址，向对应的KMS发送加密的票据和第一应用的标识信息。
在另一些可能的实施方式中，证书管理服务器可以由AS向第一终端发送数据通道应用证书和第一应用的标识信息，如此，第一终端就可以知道接收到的数据通道应用证书是分配给第一应用的，进而将该数据通道应用证书与第一应用的标识信息关联保存。
在另一些可能的实施方式中，第一应用的标识信息可以包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
可选的，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在本申请中，上述终端标识可以为用于终端的设备标识，如国际移动用户识别码(international mobile subscriber identity，IMSI)、国际移动设备识别码(international mobile equipment identity，IMEI)等，还可以为使用该终端的用户的用户标识，如互联网协议多媒体公共标识(IP multimedia public identity，IMPU)；应用标识可以为应用标识(application identifier，AID)。
在另一些可能的实施方式中，上述加密票据可以包括：第一应用的标识信息。例如，加密票据可以以MIKEY(multimedia internet keying)-ticket的方式实施。
进一步地，为了提高可靠性，上述加密票据还可以包括：第二密钥的密钥索引，第二密钥与第一密钥相匹配，第二密钥是由KMS为第一应用分配的。
在本申请中，第二密钥的密钥索引可以为第二密钥本身，也可以为第二密钥对应的第一密钥，或者第二密钥的标识等，当然，密钥索引还可以为其他形式，只要能够通过第二密钥的密钥索引唯一确定出第二密钥即可。
第二方面，本申请提供一种基于IMS数据通道的通信方法，包括：KMS获得来自证书管理服务器的第一加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；KMS解密第一加密票据，获得第一加密票据中的标识信息；KMS根据标识信息和第一应用的标识信息对第一应用进行验证；如果对第一应用验证成功，则KMS向证书管理服务器发送第一密钥，第一密钥与KMS为第一应用分配的第二密钥相匹配，第一密钥用于证书管理服务器为第一应用生成数据通道应用证书，数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，KMS可以判断标识信息与第一应用的标识信息是否匹配，其中，如果标识信息与第一应用的标识信息相匹配，则表明对第一应用验证成功，如果标识信息与第一应用的标识信息不匹配，则表明对第一应用验证失败。
在本申请中，通过判断标识信息与第一应用的标识信息是否匹配，来验证加密票据中的标识信息与发送加密票据的第一应用的标识信息是否是一致，进而验证第一应用是否合法。
进一步地，为了提高可靠性，第一加密票据还可以包括：密钥索引；相应地，KMS可以根据标识信息、密钥索引和第一应用的标识信息对第一应用进行验证。
在另一些可能的实施方式中，KMS可以判断标识信息与第一应用的标识信息是否匹 配；如果标识信息与第一应用的标识信息相匹配，则KMS判断密钥索引与第二密钥是否相匹配；其中，如果密钥索引与第二密钥相匹配，则表明对第一应用验证成功；如果密钥索引与第二密钥不匹配，则表明对第一应用验证失败。
在另一些可能的实施方式中，在KMS获得来自证书管理服务器的第一加密票据和第一应用的标识信息之前，上述方法还可以包括：KMS接收来自第一终端的密钥请求；KMS响应密钥请求，为第一应用分配第二密钥和第二加密票据，第二加密票据包括：第一应用的标识信息，或者第一应用的标识信息和第二密钥的密钥索引；KMS向第一终端发送第二密钥和第二加密票据。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，上述方法还可以包括：KMS与第一终端采用通用认证机制(generic bootstrapping architecture，GBA)建立通信通道。
第三方面，本申请提供一种基于IMS数据通道的通信方法，包括：第一终端经由AS向证书管理服务器发送加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；第一终端经由AS接收证书管理服务器发送的数据通道应用证书，数据通道应用证书为证书管理服务器在根据加密票据和第一应用的标识信息对第一应用验证成功后发送；第一终端根据数据通道应用证书与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，上述方法还可以包括：第一终端经由AS向证书管理服务器发送KMS的地址，KMS的地址用于指示证书管理服务器与KMS通信。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，在第一终端向证书管理服务器发送加密票据和第一应用的标识信息之前，上述方法还可以包括：第一终端向KMS请求密钥和票据；第一终端接收KMS为第一应用分配的第二密钥和加密票据，加密票据包括：第一应用的标识信息，或者第一应用的标识信息和第二密钥的密钥索引。
在另一些可能的实施方式中，数据通道应用证书为证书管理服务器根据第一密钥生成的，第一密钥与第二密钥相匹配；相应地，当第二终端对第一应用验证成功时，第一终端通过第一密钥和第二密钥的配合验证数据通道应用证书。
在另一些可能的实施方式中，上述方法还可以包括：第一终端与KMS采用GBA建立通信通道。
第四方面，本申请提供一种基于IMS数据通道的通信方法，包括：AS接收来自第一终端的加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；AS将加密票据和第一应用的标识信息发送给证书管理服务器；AS接收来自证书管理服务器的第一数据通道应用证书，第一数据通道应用证书为证书管理服务器为第一应用分配的，第一数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务；AS保存第一数据通道应用证书，并将第一数据通道应用证书发送给第一终端。
在本申请中，第一终端发起IMS数据通道业务时，IMS网络可以通过检查DTLS握手过程中交换的证书的指纹信息是否为证书管理服务器下发数据通道应用证书，以此来拒绝使用非IMS网络生成的数据通道应用证书，进而在保证终端安全通信的同时，也使得通信IMS网络能够对通信过程的可靠性进行监管。
在一些可能的实施方式中，上述方法还可以包括：AS接收证书管理服务器为第二应用分配的第二数据通道应用证书，第二数据通道应用证书用于第二应用与第一应用进行IMS数据通道业务；AS保存第二数据通道应用证书，并将第二数据通道应用证书发送给第二终端。
在另一些可能的实施方式中，上述方法还可以包括：AS在数DTLS握手过程中获得来自第一终端的数据通道应用证书和来自第二终端的数据通道应用证书；AS将来自第一终端的数据通道应用证书与第一数据通道应用证书进行匹配；AS将来自第二终端的数据通道应用证书与第二数据通道应用证书进行匹配；如果来自第一终端的数据通道应用证书与第一数据通道应用证书匹配，且来自第二终端的数据通道应用证书与第二数据通道应用证书匹配，则允许第一应用与第二应用建立IMS数据通道；如果来自第一终端的数据通道应用证书与第一数据通道应用证书不匹配，和/或来自第二终端的数据通道应用证书与第二数据通道应用证书不匹配，则禁止第一应用与第二应用建立IMS数据通道。
第五方面，本申请提供一种通信装置，该通信装置可以为证书管理服务器中的芯片或者片上系统，还可以为证书管理服务器中用于实现第一方面或第一方面的任一可能的实施方式所述的方法的功能模块。举例来说，该通信装置，包括：第一通信模块，用于接收来自AS的加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；第二通信模块，用于向KMS发送加密票据和第一应用的标识信息，加密票据和第一应用的标识信息用于KMS对第一应用进行验证；接收第一密钥，第一密钥是由KMS在对第一应用验证成功后发送的；第一通信模块，还用于向AS发送第一密钥对应的数据通道应用证书，数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，第一通信模块，还用于获得KMS的地址；第二通信模块，还用于根据KMS的地址，向KMS发送加密票据和第一应用的标识信息。
在另一些可能的实施方式中，第一通信模块，还用于向AS发送数据通道应用证书和第一应用的标识信息。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，加密票据包括：第一应用的标识信息。
在另一些可能的实施方式中，加密票据还包括：第二密钥的密钥索引，第二密钥与第一密钥相匹配，第二密钥是由KMS为第一应用分配的。
第六方面，本申请提供一种通信装置，该通信装置可以为KMS中的芯片或者片上系统，还可以为KMS中用于实现第二方面或第二方面的任一可能的实施方式所述的方法的功能模块。举例来说，该通信装置，包括：第三通信模块，用于获得来自证书管理服务器的第一加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；第一处理模块，用于解密第一加密票据，获得第一加密票据中的标识信息；根 据标识信息和第一应用的标识信息对第一应用进行验证；第三通信模块，还用于如果对第一应用验证成功，则向证书管理服务器发送第一密钥，第一密钥与KMS为第一应用分配的第二密钥相匹配，第一密钥用于证书管理服务器为第一应用生成数据通道应用证书，数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，第一处理模块，用于判断标识信息与第一应用的标识信息是否匹配，其中，如果标识信息与第一应用的标识信息相匹配，则表明对第一应用验证成功，如果标识信息与第一应用的标识信息不匹配，则表明对第一应用验证失败。
在另一些可能的实施方式中，第一加密票据还包括：密钥索引；第一处理模块，用于根据标识信息、密钥索引和第一应用的标识信息对第一应用进行验证。
在另一些可能的实施方式中，第一处理模块，用于判断标识信息与第一应用的标识信息是否匹配；如果标识信息与第一应用的标识信息相匹配，则判断密钥索引与第二密钥是否相匹配；其中，如果密钥索引与第二密钥相匹配，则表明对第一应用验证成功；如果密钥索引与第二密钥不匹配，则表明对第一应用验证失败。
在另一些可能的实施方式中，上述通信装置还包括第四通信模块，用于在第三通信模块获得来自证书管理服务器的第一加密票据和第一应用的标识信息之前，接收来自第一终端的密钥请求；第一处理模块，还用于响应密钥请求，为第一应用分配第二密钥和第二加密票据，第二加密票据包括：第一应用的标识信息，或者第一应用的标识信息和第二密钥的密钥索引；第四通信模块，还用于向第一终端发送第二密钥和第二加密票据。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，第四通信模块，还用于与第一终端采用GBA建立通信通道。
第七方面，本申请提供一种通信装置，该通信装置可以为第一终端中的芯片或者片上系统，还可以为第一终端中用于实现第三方面或第三方面的任一可能的实施方式所述的方法的功能模块。举例来说，该通信装置，包括：第五通信模块，用于向AS发送加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；接收AS发送的数据通道应用证书，数据通道应用证书为证书管理服务器在根据加密票据和第一应用的标识信息对第一应用验证成功后发送；第六通信模块，用于根据数据通道应用证书与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，第五通信模块，还用于向AS发送KMS的地址，KMS的地址用于指示证书管理服务器与KMS通信。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，上述通信装置还可以包括：第七通信模块，还用于在第五通信模块向AS发送加密票据和第一应用的标识信息之前，向KMS请求密钥和票据；接收KMS为第一应用分配的第二密钥和加密票据，加密票据包括：第一应用的标识信息，或者第一应用的标识信息和第二密钥的密钥索引。
在另一些可能的实施方式中，第一终端与KMS采用GBA建立通信通道。
在另一些可能的实施方式中，数据通道应用证书为证书管理服务器根据第一密钥生成的，第一密钥与第二密钥相匹配；第六通信模块，还用于当第二终端对第一应用验证成功时，通过第一密钥和第二密钥的配合验证数据通道应用证书。
第八方面，本申请提供一种通信装置，该通信装置可以为AS中的芯片或者片上系统，还可以为AS中用于实现第四方面或第四方面的任一可能的实施方式所述的方法的功能模块。举例来说，该通信装置，包括：第八通信模块，用于接收来自第一终端的加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；第九通信模块，用于将加密票据和第一应用的标识信息发送给证书管理服务器；接收来自证书管理服务器的第一数据通道应用证书，第一数据通道应用证书为证书管理服务器为第一应用分配的，第一数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务；第二处理模块，用于保存第一数据通道应用证书；第八通信模块，还用于将第一数据通道应用证书发送给第一终端。
在一些可能的实施方式中，第九通信模块，还用于接收证书管理服务器为第二应用分配的第二数据通道应用证书，第二数据通道应用证书用于第二应用与第一应用进行IMS数据通道业务；第二处理模块，还用于保存第二数据通道应用证书；第八通信模块，还用于将第二数据通道应用证书发送给第二终端。
在另一些可能的实施方式中，第八通信模块，还用于在DTLS握手过程中获得来自第一终端的数据通道应用证书和来自第二终端的数据通道应用证书；第二处理模块，还用于将来自第一终端的数据通道应用证书与第一数据通道应用证书进行匹配；将来自第二终端的数据通道应用证书与第二数据通道应用证书进行匹配；如果来自第一终端的数据通道应用证书与第一数据通道应用证书匹配，且来自第二终端的数据通道应用证书与第二数据通道应用证书匹配，则允许第一应用与第二应用建立IMS数据通道；如果来自第一终端的数据通道应用证书与第一数据通道应用证书不匹配，和/或来自第二终端的数据通道应用证书与第二数据通道应用证书不匹配，则禁止第一应用与第二应用建立IMS数据通道。
第九方面，本申请提供一种证书管理服务器，包括：处理器和存储器；处理器与存储器耦合，处理器被配置为读取并执行存储器中的指令，以实现如第一方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
第十方面，本申请提供一种KMS，包括：处理器和存储器；处理器与存储器耦合，处理器被配置为读取并执行存储器中的指令，以实现如第二方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
第十一方面，本申请提供一种终端，包括：处理器和存储器；处理器与存储器耦合，处理器被配置为读取并执行存储器中的指令，以实现如第三方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
第十二方面，本申请提供一种AS，包括：处理器和存储器；处理器与存储器耦合，处理器被配置为读取并执行存储器中的指令，以实现如第四方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
第十三方面，本申请提供一种通信系统，包括：证书管理服务器、KMS以及AS；其中，证书管理服务器，被配置为执行如第一方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法；KMS，被配置为执行如第二方面及其任一可能的实施方式所述的 基于IMS数据通道的通信方法；AS，被配置为执行如第四方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
第十四方面，本申请提供一种计算机可读存储介质，计算机可读存储介质存储有指令，当指令在计算机上运行时，用于执行如上述第一方面、第二方面、第三方面或第四方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
第十五方面，本申请提供一种计算机程序或计算机程序产品，当计算机程序或计算机程序产品在计算机上被执行时，使得计算机实现如上述第一方面、第二方面、第三方面或第四方面及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
应当理解的是，本申请的第五至十五方面与本申请的第一至四方面的技术方案一致，各方面及对应的可行实施方式所取得的有益效果相似，不再赘述。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1为本申请实施例中的WebRTC的协议栈示意图；
图2为本申请实施例中的IMS中不同数据类型的安全传输协议的示意图；
图3为本申请实施例中的通信系统的架构示意图；
图4为本申请实施例中的票据请求流程的示意图；
图5为本申请实施例中的证书请求流程的示意图；
图6为本申请实施例中的IMS数据通道的通信方法的流程示意图；
图7为本申请实施例中的通信装置的一种结构示意图；
图8为本申请实施例中的通信装置的另一种结构示意图
图9为本申请实施例中的通信装置的又一种结构示意图。
图10为本申请实施例中的通信设备的硬件示意图。
具体实施方式
下面结合本申请实施例中的附图对本申请实施例进行描述。以下描述中，参考形成本申请一部分并以说明之方式示出本申请实施例的具体方面或可使用本申请实施例的具体方面的附图。应理解，本申请实施例可在其它方面中使用，并可包括附图中未描绘的结构或逻辑变化。例如，应理解，结合所描述方法的揭示内容可以同样适用于用于执行所述方法的对应设备或系统，且反之亦然。例如，如果描述一个或多个具体方法步骤，则对应的设备可以包含如功能单元等一个或多个单元，来执行所描述的一个或多个方法步骤(例如，一个单元执行一个或多个步骤，或多个单元，其中每一个都执行多个步骤中的一个或多个)，即使附图中未明确描述或说明这种一个或多个单元。另一方面，例如，如果基于如功能单元等一个或多个单元描述具体装置，则对应的方法可以包含一个步骤来执行一个或多个单元的功能性(例如，一个步骤执行一个或多个单元的功能性，或多个步骤，其中每一个执行多个单元中一个或多个单元的功能性)，即使附图中未明确描述或说明这种一个或多个步骤。进一步，应理解的是，除非另外明确提出，本文中所描述的各示例性实施例和/或方面的特征可以相互组合。
众所周知，浏览器本身是不支持相互之间直接建立信道进行通信，都是通过服务器进行中转。例如，现在有两个客户端：甲和乙，它们想要通信，首先需要甲和服务器、乙和服务器之间建立信道。甲给乙发送消息时，甲先将消息发送到服务器上，服务器对甲的消息进行 中转，发送到乙处，反过来也是一样。这样甲与乙之间的一次消息要通过两段信道，通信的效率同时受制于这两段信道的带宽。同时这样的信道并不适合数据流的传输，如何建立浏览器之间的点对点传输，一直困扰着开发者，网页实时通信(web real time communication，WebRTC)应运而生。
WebRTC是一个支持网页浏览器进行实时语音对话或视频对话的技术，旨在使浏览器能为实时通信(RTC)提供简单的接口。简单来说，WebRTC是通过一系列的信令，建立一个浏览器与另一个浏览器之间(peer-to-peer)的信道，这个信道可以发送任何数据，而不需要经过服务器，实现高性能、低延时、点对点通信。图1为本申请实施例中的WebRTC的协议栈示意图，参见图1所示，WebRTC data channel采用的协议栈是基于用户数据报协议的数据包传输层安全性协议上的流控制传输协议(stream control transmission protocol over datagram transport layer security over interactive connectivity establishment or user datagram protocol，SCTP over DTLS over ICE/UDP)，其中底层的UDP实现低时延通信，中间的DTLS实现数据通道安全通信，最后高层的SCTP支持在一个SCTP连接中建立多条不同可靠性的流(stream)。
目前，随着技术发展，出现了一个新的概念——互联网协议多媒体子系统(internet protocol multimedia subsystem，IMS)数据通道，其主要技术特征是在长期演进语音承载(voice over long term evolution，VoLTE)的语音业务(voice call)基础上叠加第五代通信技术数据通道(5G data channel)，从而将基于IMS的实时音视频通信升级为实时交互，丰富了IMS使能的业务场景。在技术上，IMS数据通道可以看作是一种新增的媒体类型，可以采用WebRTC中用到的SCTP over DTLS over UDP作为承载协议。图2为本申请实施例中的IMS中不同数据类型的安全传输协议的示意图，参见图2所示，IMS数据通道采用SCTP over DTLS over UDP，音频(voice)业务采用安全实时传输协议(secure real time transport protocol，SRTP)和视频(video)业务也采用SRTP，其中，SCTP over DTLS over UDP采用安全证书校验机制，SRTP采用安全密钥校验机制。
但是，如果IMS数据通道使用的安全证书由终端或者IMS数据通道应用自行生成或安装的话，网络侧就会失去对IMS数据通道中通信内容的控制和监管能力，影响通信可靠性。
为了解决上述问题，本申请实施例提供一种基于IMS数据通道的通信方法，该方法可以应用于通信系统，该通信系统可以用于实时音视频通信。图3为本申请实施例中的通信系统的架构示意图，参见图3中实线所示，该通信系统300可以包括：终端301、密钥管理服务器(key management system，KMS)302、证书管理服务器303以及应用服务器(application server，AS)304。
其中，终端301中的第一终端可以用于向AS 304发送加密票据(也可以记为第一加密票据)和第一应用的标识信息，加密票据和第一应用的标识信息用于证书管理服务器303验证第一应用；接收AS 304发送的数据通道应用证书，数据通道应用证书为证书管理服务器303在对第一应用验证成功后发送；向终端301中的第二终端发送数据通道应用证书，数据通道应用证书用于第一应用与终端301中的第二终端的第二应用进行IMS数据通道业务；
第二终端可以用于根据数据通道应用证书验证第一应用；如果对第一应用验证成功，则与第一终端之间建立IMS数据通道；根据数据通道应用证书获得第一密钥，通过第一密钥与KMS为第一应用分配的第二密钥的配合验证第一应用的数据通道应用证书，进而第一应用与第二应用在IMS数据通道中与第一应用通信；如果对第一终端验证失败，则流程结束。
KMS 302可以用于获得来自证书管理服务器303的加密票据和第一应用的标识信息；解密加密票据，获得加密票据中的应用标识；根据加密票据中的应用标识和来自证书管理服务器发送的第一应用的标识信息对所述第一应用进行验证；如果验证成功，则向证书管理服务器303发送第一密钥，第一密钥与KMS 302为第一应用分配的第二密钥相匹配，第一密钥用于证书管理服务器303生成相应的数据通道应用证书(也可以记为第一数据通道应用证书)，该数据通道应用证书可以用于第一应用与第二应用进行IMS数据通道业务；
证书管理服务器303可以用于向AS 304发送加密票据和第一应用的标识信息，加密票据和第一应用的标识信息用于KMS 302对第一应用进行验证；接收第一密钥，第一密钥是由KMS 302在对第一应用301验证成功后发送的；向AS 304发送第一密钥对应的数据通道应用证书，数据通道应用证书用于第一应用与第二应用进行IMS数据通道业务。
需要说明的是，本申请实施例中的第一终端和/或第二终端是一种具有无线通信功能的终端设备，可以部署在陆地上，包括室内或室外、手持、可穿戴或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。上述终端设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端装置、增强现实(augmented reality，AR)终端装置、工业控制(industrial control)中的无线终端、无人驾驶(self-driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。终端设备也可以是具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备等。在不同的网络中终端装置可以叫做不同的名称，例如：终端装置、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、5G网络或未来演进网络中的终端设备等。在实际应用中，第一终端和第二终端中需安装浏览器应用，如此，第一终端与第二终端可以通过浏览器应用之间的IMS数据通道实现实时音视频交互。
上述KMS可以部署于网络应用功能(network application function，NAF)上，还可以在第三方服务器上。KMS可以采用通用认证机制(generic bootstrapping architecture，GBA)认证终端301，并在终端301认证通过后与终端301进行安全通信。例如，如果KMS 302部署在NAF上，终端301通过Ua接口与NAF连接，参见图3中虚线所示，终端301通过Ub接口与自身所归属网络中的引导服务器功能(bootstrapping server function，BSF)305连接，KMS 302通过Zn接口与自身所归属网络中的BSF 305连接，上述BSF305通过Zh接口与归属用户服务器(home subscriber server，HSS)306连接。
在一些可能的实施方式中，仍参见图3中虚线所示，上述通信网络中还可以包括IMS网络中的呼叫会话控制功能(call session control function，CSCF)307。其中，终端301可以与CSCF 307连接，CSCF 307通过IMS服务控制(IMS service control，ISC)接口与AS 304连接，AS 304与证书管理服务器303连接，终端301可以通过CSCF 307以及AS 304发送消息给证书管理服务器303，其中，CSCF 307与AS 304之间通过标准会话初始协议(session initiation protocol，SIP)进行交互。
在实际应用中，CSCF可以分为P-CSCF(代理CSCF)和S-CSCF(服务CSCF)。
下面结合上述通信系统的结构来对本申请实施例提供的基于IMS数据通道的通信方法进行说明。
图4为本申请实施例中的票据请求流程的示意图，参见图4所示，该方法可以包括：
S401：第一终端向KMS请求密钥和票据(ticket)；
当第一终端的第一应用，如直播应用、视频通话应用等需要与第二终端的第二应用进行IMS数据通道通信时，首先，第一终端可以向KMS发送REQUEST_INIT消息，以请求第一应用对应的密钥和票据。其中，在REQUEST_INIT消息中可以携带有第一应用的标识信息。
在一些可能的实施方式中，第一应用的标识信息可以唯一标识第一终端的第一应用，那么，第一应用的标识信息可以包括第一终端的终端标识，或者第一终端的终端标识和第一应用的应用标识。举例来说，如果在同一时间内第一终端中仅有一个应用(即第一应用)向KMS请求密钥和票据，则REQUEST_INIT消息中可以携带有第一终端的终端标识(如#UE A)；如果在同一时间内第一终端中存在包括第一应用在内的多个应用向KMS请求密钥和票据，则REQUEST_INIT消息中可以携带有第一终端的终端标识(如#UE A)和多个应用中某一个应用(如第一应用)的应用标识(如#APP A)，或者，REQUEST_INIT消息中可以携带有第一终端的终端标识(如#UE A)和多个应用中各个应用的应用标识(如#APP 1、#APP 2、…、#APP n等)。
在实际应用中，本申请实施例所说的终端标识可以为用于终端的设备标识，如国际移动用户识别码(international mobile subscriber identity，IMSI)、国际移动设备识别码(international mobile equipment identity，IMEI)等，还可以为使用该终端的用户的用户标识，如互联网协议多媒体公共标识(IP multimedia public identity，IMPU)；应用标识可以为应用标识(application identifier，AID)。当然，可以存在其他形式的标识，本申请实施例不做具体限定。
在一些可能的实施方式中，在S401之前，上述方法还可以包括：第一终端与KMS采用GBA建立通信通道。
首先，第一终端向BSF发起GBA初始化请求；BSF从HSS中获取第一终端的认证信息，生成共享密钥Ks以及第一终端的事务标识；BSF将第一终端的认证信息和事务标识发送给第一终端，第一终端对其进行相应的处理后存储；第一终端携带事务标识向KMS(即NAF)发起认证请求；KMS检查自身是否存储有效的密钥，如果没有，则携带事务标识向BSF请求Ks，KMS与第一终端对Ks进行认证鉴权。在认证鉴权成功之后，第一终端获得Ks。进一步地，第一终端根据Ks推导出于第一终端访问KMS的密钥Ks_NAF，后续第一终端与KMS之间的通信可以采用Ks_NAF进行加密保护。
S402：KMS为第一应用分配密钥A(即第二密钥)和加密票据A；
KMS接收来自第一终端的REQUEST_INIT消息(携带第一应用的标识信息)，并响应REQUEST_INIT消息，根据第一应用的标识信息为第一应用分配相应的密钥A和加密票据A。其中，加密票据A的加密机制只有KMS知道。
这里，上述密钥A可以用于对第一应用与第二应用在IMS数据通道中进行加密通信。可选的，密钥A可以为私钥。
上述加密票据A用于通信网络中的其他网元验证第一应用。可选的，加密票据A可以包括：第一应用的标识信息。
进一步地，为了提高可靠性，加密票据A还可以包括：密钥A的密钥索引。在一些可能的实施方式中，密钥A的密钥索引可以为密钥A本身，也可以为密钥A对应的密钥B(公钥)，或者密钥A的标识等，当然，密钥索引还可以为其他形式，只要能够通过密钥A的密钥索引唯一确定出密钥A即可，本申请实施例不做具体限定。
S403：KMS向第一终端发送密钥A和加密票据A。
KMS向第一终端发送REQUEST_RESP消息，并在REQUEST_RESP消息中携带密钥A和加密票据A。
以上便是票据请求(ticket request)流程。
在一些可能的实施方式中，当第一应用需要与第二应用通过IMS数据通道进行加密通信时，第一终端先要建立其与第二终端之间的IMS数据通道，而在建立数据通道之前，第一终端需要先向证书管理服务器申请用于IMS数据通道业务的数据通道应用证书。
那么，图5为本申请实施例中的证书请求流程的示意图，参见图5所示，在S401至S403之后，该方法可以包括：
S501：第一终端向AS发送加密票据B和第一应用的标识信息；
第一终端可以向AS发送SIP消息，该SIP消息中可以携带有加密票据B和第一应用的标识信息，然后，AS再将加密票据B和第一应用的标识信息携带在超文本传输安全协议(hyper text transfer protocol over securesocket layer)，HTTPS)消息中发送给证书管理服务器。可以理解的，由于第一终端还未经过验证，所以加密票据B可以与加密票据A相同(即第一应用合法)，也可以与加密票据A不同(即第一应用非法)。
需要说明的是，在本申请实施例中，第一应用的标识信息均作为明文进行发送。
可选的，第一应用的标识信息可以包括：第一终端的终端标识，如第一终端的IMSI；还可以包括第一应用的应用标识，如AID，此时，第一应用的标识信息可以为IMSI和AID的组合。
需要说明的是，本申请实施例中所说的第一应用合法是指针对于第一应用与第二应用之间的IMS数据通道来说第一应用是合法的，第一应用可以通过IMS数据通道与第二应用进行可靠地IMS数据通道加密通信；同理，第一应用非法是指针对于第一应用与第二应用之间的IMS数据通道来说第一应用是非法的，第一应用不能与第二应用进行IMS数据通道加密通信，但是与此同时第一应用对于第一终端与第二终端之间的其他IMS数据通道来说也可以是合法的。由此可见，对于不同的应用，其合法性是相对于IMS数据通道来说的，这样，能够保证每个IMS数据通道上的加密通信的可靠性。
在实际应用中，S501可以包括：第一终端向AS发送证书请求，其中，AS可以在转发给证书管理服务器的证书请求的字段中携带第一应用的标识信息，那么，第一终端可以省略发送第一应用的标识信息的步骤，也就是说，第一终端可以仅将加密票据B发送给AS，AS自行将加密票据B和第一应用的标识信息一起发送给证书管理服务器。在这种情况下，第一终端在IMS网络中已注册。
具体地，第一终端可以将加密票据B先发送给S-CSCF，再由S-CSCF转发给AS，AS再将第一应用的标识信息(如第一终端的终端标识)以及加密票据B转发给证书管理服务器。
例如，第一终端可以通过如下MESSAGE request消息将加密票据B发送给S-CSCF：
MESSAGE sip:as.home1.net SIP/2.0
Via:SIP/2.0/UDP[5555::aaa:bbb:ccc:ddd]:1357；comp＝sigcomp；Branch＝z9hG4b- Knashds7
Max-Forwards:70
Route:<sip:pcscf1.visited1.net:7531；lr；comp＝sigcomp>,<sip:orig@scscf1.home1.net；lr>
P-Preferred-Identity:"John Doe"<sip:user1_public1@home1.net>
From:<sip:user1_public1@home1.net>；tag＝171828
To:<sip:as.home1.net.net>
Call-ID:cb03a0s09a2sdfglkj490333
Cseq:666 MESSAGE
Content-Type:application/vnd.3gpp.certificate //表示证书请求
Content-Length:<length>
TICKET:TICKET //从REQUEST_RESP中解析出的加密票据B
KMS URI:kms.operator.example:1234 //KMS地址
S502：AS向证书管理服务器发送加密票据B和第一应用的标识信息；
进一步地，第一终端还可以向AS发送KMS地址，AS将KMS地址转发给证书管理服务器，使得证书管理服务器能够基于KMS地址与对应的KMS通信。可选的，上述证书请求中还可以携带KMS地址。
S503：证书管理服务器向KMS发送加密票据B和第一应用的标识信息；
在一些可能的实施方式中，证书管理服务器可以根据第一终端发送的KMS的地址，向对应的KMS发送加密的票据B和第一应用的标识信息。
在实际应用中，证书管理服务器向KMS发送解密请求，该解密请求中可以携带有上述加密票据B和第一应用的标识信息。
S504：KMS解密加密票据B，获得加密票据B中的标识信息；
这里，加密票据B中标识信息可以包括终端标识，或者终端标识和应用标识。可以理解的，由于加密票据B为待验证的票据，那么，该终端标识可以是第一终端的终端标识，也可以不是第一终端的终端标识；同理，加密票据B中的应用标识可以是第一应用的应用标识，也可以不是第一应用的应用标识。
S505：KMS根据加密票据B中的标识信息和第一应用的标识信息对第一应用进行验证，若对第一应用验证成功，执行S506，若对第一应用验证失败，则流程结束；
KMS解密加密票据B后，获得标识信息，如终端标识，然后，KMS可以将该终端标识与证书管理服务器发送的第一应用的标识信息中的第一终端的终端标识进行匹配，以此来验证加密票据B中的终端标识与发送加密票据B的第一终端的终端标识是否是一致的，如果两者一致(或者相匹配)，则表明对第一应用验证成功，即第一应用合法，反之，如果两者不一致(或者不匹配)，则表明对第一应用验证失败，即第一应用非法。
当然，KMS解密加密票据B后，获得的标识信息还可以包括终端标识和应用标识，然后，KMS分别将该终端标识和应用标识与第一应用的标识信息中的第一终端的终端标识和第一应用的应用标识进行匹配，以此来验证加密票据B中的终端标识与发送加密票据B的第一应用的标识信息是否是一致，如果两者一致(或者相匹配)，则表明对第一应用验证成功，即第一应用合法，反之，如果两者不一致(或者不匹配)，则表明对第一应用验证失败，即第一应用非法。
在本申请实施例中，为了进一步提升通信的可靠性，加密票据B中还可以包括密钥索引，那么，S505可以包括：KMS根据加密票据B中的标识信息、密钥索引和第一应用的 标识信息对第一应用进行验证。
KMS首先将加密票据B中的标识信息与第一应用的标识信息进行匹配，如果两者一致(或者相匹配)，KMS将加密票据B中的密钥索引与在S402中为第一应用分配的密钥A进行匹配，例如，假设密钥索引为密钥本身，则将该密钥与密钥A进行比对，判断两者是否一致，或者，假设密钥索引为密钥对应的标识，则确定标识对应的密钥是否为密钥A。如果两者一致(或者相匹配)，则表明对第一应用验证成功，即第一应用合法，反之，如果两者不一致(或者不匹配)，则表明对第一应用验证失败，即第一应用非法。
当然，加密票据B中还可以包含其他信息，本申请实施例对此不做具体限定。
在一些可能的实施方式中，在S504之后，如果对第一应用验证失败，则KMS认为第一应用是非法的，然后KMS通知证书管理服务器，使得证书管理服务器拒绝第一终端的证书请求。
S506：KMS向证书管理服务器发送密钥B(即第一密钥)；
这里，密钥B与KMS在S402为第一应用分配的密钥A相匹配，可以理解的，如果密钥A为私钥，密钥B可以为匹配的公钥。
S507：证书管理服务器根据密钥B，生成数据通道应用证书；
S508：证书管理服务器向AS发送数据通道应用证书；
S509：AS向第一终端发送数据通道应用证书；
证书管理服务器将生成的数据通道应用证书和第一应用的标识信息一起发送给AS，AS再将数据通道应用证书和第一应用的标识信息一起发送给第一终端，如此，第一终端就可以知道接收到的数据通道应用证书是分配给第一应用的，进而将该数据通道应用证书与第一应用的标识信息关联保存。在实际应用中，AS先将数据通道应用证书和第一应用的标识信息转发给S-CSCF，再由S-CSCF转发给第一终端。
例如，AS可以通过如下200(OK)response消息将数据通道应用证书转发给S-CSCF：
SIP/2.0 200 OK
Via:
From:
Call-ID:
Content-Type:application/vnd.3gpp.certificate //表示证书响应
Content-Length:<length>
CERTIFICATE:certificate //证书
需要说明的是，在S508中，AS在接收到来自证书管理服务器的数据通道应用证书之后，可以保存该数据通道应用证书及数据通道应用证书与应用的关联关系，以供后续判定是否允许第一应用与第二应用建立IMS数据通道。
S510：第一终端使用数据通道应用证书与第二终端的第二应用进行IMS数据通道业务。
需要说明的是，上述IMS数据通道业务可以为：第一应用与第二应用之间与IMS数据通道相关的一个或者多个业务，如验证第一应用、判定第一应用与第二应用之间是否允许建立IMS数据通道、建立第一应用与第二应用之间的IMS数据通道、第一应用与第二应用在IMS数据通道上进行加密通信等，当然，还可以包括其他业务，本申请实施例不具体限定。
示例性的，在S510中，第一终端在通过S507获得数据通道应用证书之后，可以将该 数据通道应用证书发送给第二终端，第二终端在收到数据通道应用证书之后，可以根据密钥A和密钥B，对数据通道应用证书进行验证，并在验证通过后，与第一终端在IMS数据通道上进行加密通信，以此来验证第一应用是否允许使用IMS数据通道进行加密通信。如果对第一应用验证成功，第二终端确定第一应用是合法的，那么，第二终端与第一终端建立第一应用与第二应用之间的IMS数据通道，并在该IMS数据通道上进行加密通信，反之，如果对第一应用验证失败，第二终端确定第一应用是非法的，那么，第二终端可以拒绝与第一终端建立第一应用与第二应用之间的IMS数据通道。
至此，便完成了证书申请流程。
举例来说，假设，在同一时间内，UE A(第一终端)的APP1(第一应用)要与UE B(第二终端)的APP2进行IMS数据通道业务，这里，APP1和APP2可以为不同终端上的同一应用，那么，APP1与APP2的应用标识是相同的，即为#APP1，例如，APP1为视频通话应用，APP2为同一个视频通话应用；或者，APP1和APP2还可以为不同终端上的相互匹配的应用，例如，APP1为host端应用，而APP2为client端应用，那么，APP1和APP2的应用标识可以具有至少相同的一部分，如APP1的应用标识可以为#X-APP1，APP2的应用标识可以为#X-APP2。下面以APP1和APP2具有相同应用标识#APP1为例。
第一步、UE A和UE B分别向KMS申请密钥和加密票据。KMS将密钥A(私钥)和加密票据A分配给了APP1；
第二步、UE A向AS发送证书请求，其中，在证书请求中携带有加密票据A、KMS地址以及APP1的应用标识(#APP 1)；由于UE A在IMS网络中已经注册，那么，AS在收到证书请求之后，将该证书请求转发给证书管理服务器，其中，在证书请求中携带有加密票据A、KMS地址、UE的终端标识(#UE A)和#APP 1；
第三步、证书管理服务器在接收到证书请求之后，根据KMS地址，向KMS发送解析请求，请求KMS解析加密票据A，其中，在解析请求中携带有加密票据A、#UE A和#APP 1；
第四步、KMS在接收到解析请求之后，解析加密票据A，得到加密票据A中的#UE A和#APP 1，然后，KMS将加密票据A中的#UE A和#APP 1分别与解析请求携带的#UE A和#APP 1进行比对，两者一致，那么，KMS将#UE A和#APP 1对应的密钥B(即密钥A的公钥)发送给证书管理服务器；
第五步、证书管理服务器可以根据密钥B生成第一应用对应的数据通道应用证书，再将第一应用对应的数据通道应用证书、#UE A和#APP 1发送给AS；
第六步、AS保存第一应用对应的数据通道应用证书、#UE A和#APP 1，并转发给UE A；
进一步地，对UE B同样执行上述第一步至第六步，AS保存第二应用对应的数据通道应用证书、#UE B和#APP 1，并转发给UE B。
第七步、UE A将SDP Offer或者SDP Offer附着的SIP消息MESSAGE A发送给AS，MESSAGE A中携带有#UE A和#APP 1；
第八步、AS从该MESSAGE A中获得#UE A和#APP 1，AS根据#UE A和#APP 1确定是否允许UE A在IMS数据通道上传输APP1的数据，如果允许，则AS向UE B转发MESSAGE A，并指示UE B允许UE A在IMS数据通道上传输APP1的数据；反之，如果禁止，则AS向UE B转发MESSAGE A时，删除#APP1。
第九步、AS接收来自UE B的SDP Answer或者SDP Answer附着的SIP消息MESSAGE  B，#MESSAGE B中携带有#UE B和#APP1；然后，AS在转发MESSAGE B的同时，向UE A指示是否允许UE A在IMS数据通道上传输APP1的数据；进一步地，AS为UE A的APP1与UE B的APP2建立IMS数据通道；
第十步、UE A根据指示，确定是否允许UE A在IMS数据通道上传输APP1的数据。如果允许，则UE A在IMS数据通道上将加密后的APP1的数据发送给UE B。
第十一步、UE B通过解密获得APP1的数据。
在本申请实施例中，证书管理服务器向第一终端发放可靠的数据通道应用证书，并且IMS网络能够获知该数据通道应用证书，避免第一终端手动安装/替换第三方(非通信网络提供)证书和使用不可靠的自签署证书，进而提供可靠地IMS数据通道通信。
在一些可能的实施例中，第一终端在通过上述S501至S510获得数据通道应用证书之后，可以使用该证书发起IMS数据通道业务。在这个过程中，IMS网络想要对第一终端和第二终端的IMS数据通道业务进行监管，避免第一终端和第二终端绕过IMS网络自行通信。那么，图6为本申请实施例中的IMS数据通道的通信方法的流程示意图，参见图6所示，在上述S508之后，该方法可以包括：
S601：AS获得第一应用的数据通道应用证书；
这里，通过S501至S508，证书管理服务器为第一应用分配数据通道应用证书，并经由AS发送给第一终端，在此过程中，AS保存第一应用的数据通道应用证书。
S602：AS获得第二应用的数据通道应用证书；
这里，通过S501至S508，证书管理服务器为第二应用分配数据通道应用证书，并经由AS发送给第二终端，在此过程中，AS保存第二应用的数据通道应用证书。
需要说明的是，第一应用的数据通道应用证书和/或第二应用的数据通道应用证书用于第一应用与第二应用进行IMS数据通道业务的。
S603：AS在DTLS握手过程中获得第一终端与第二终端交换的数据通道应用证书；
这里，在DTLS握手过程中，第一终端和第二终端会分别向AS发送数据通道应用证书，以交换证书。此时，进行交换的数据通道应用证书可以为第一应用和第二应用通过S501至S510获得的数据通道应用证书，也可以为第三方(非通信网络)提供的数据通道应用证书。
S604：AS计算第一终端与第二终端交换的数据通道应用证书对应的第一指纹信息和第二指纹信息；
AS通过DTLS过程获得第一终端与第二终端交换的数据通道应用证书，如来自第一终端的数据通道应用证书和来自第二终端的数据通道应用证书，然后，分别计算这两个证书的指纹信息，得到第一指纹信息和第二指纹信息。
S605：AS将第一指纹信息与第一应用的数据通道应用证书进行匹配，以及将第二指纹信息与第二应用的数据通道应用证书进行匹配；如果第一指纹信息与第一应用的数据通道应用证书匹配，且第二指纹信息与第二应用的数据通道应用证书匹配，则确认IMS数据通道的使用者为合法用户，执行S606，如果第一指纹信息与第一应用的数据通道应用证书不匹配，和/或第二指纹信息与第二应用的数据通道应用证书不匹配，则执行S607；
S606：AS允许第一应用与第二应用建立IMS数据通道；
S607：AS禁止第一应用与第二应用建立IMS数据通道。
进一步地，S605中AS将指纹信息与数据通道应用证书进行匹配可以包括：AS计算数据通道应用证书对应的指纹信息，然后将计算得到的指纹信息与DTLS握手过程中交换的 数据通道应用证书对应的指纹信息进行比对，判定两者是否一致，若两者一致，则表明两者匹配，反之，若两者不一致，则表明两者不匹配。
需要说明的是，上述指纹信息可以为对数据通道应用证书计算得到的摘要信息。
在本申请实施例中，第一终端发起IMS数据通道业务时，IMS网络可以通过检查DTLS握手过程中交换的证书的指纹信息是否为证书管理服务器下发数据通道应用证书，以此来拒绝使用非IMS网络生成的数据通道应用证书，进而在保证终端安全通信的同时，也使得通信IMS网络能够对通信过程的可靠性进行监管。
基于相同的发明构思，本申请实施例提供一种通信装置，该通信装置可以为证书管理服务器中的芯片或者片上系统，还可以为证书管理服务器中用于上述任一可能的实施方式所述的方法的功能模块。举例来说，图7为本申请实施例中的通信装置的一种结构示意图，参见图7所示，该通信装置700，包括：通信模块701，用于接收来自AS的加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；通信模块702，用于向KMS发送加密票据和第一应用的标识信息，加密票据和第一应用的标识信息用于KMS对第一应用进行验证；接收第一密钥，第一密钥是由KMS在对第一应用验证成功后发送的；通信模块701，还用于向AS发送第一密钥对应的数据通道应用证书，数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，通信模块701，还用于获得KMS的地址；第二通信模块，还用于根据KMS的地址，向KMS发送加密票据和第一应用的标识信息。
在另一些可能的实施方式中，通信模块701，还用于向AS发送数据通道应用证书和第一应用的标识信息。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，加密票据包括：第一应用的标识信息。
在另一些可能的实施方式中，加密票据还包括：第二密钥的密钥索引，第二密钥与第一密钥相匹配，第二密钥是由KMS为第一应用分配的。
基于相同的发明构思，本申请实施例提供一种通信装置，该通信装置可以为KMS中的芯片或者片上系统，还可以为KMS中用于实现上述任一可能的实施方式所述的方法的功能模块。举例来说，图8为本申请实施例中的通信装置的另一种结构示意图，参见图8所示，该通信装置800，可以包括：通信模块801，用于获得来自证书管理服务器的第一加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；处理模块802，用于解密第一加密票据，获得第一加密票据中的标识信息；根据标识信息和第一应用的标识信息对第一应用进行验证；通信模块801，还用于如果对第一应用验证成功，则向证书管理服务器发送第一密钥，第一密钥与KMS为第一应用分配的第二密钥相匹配，第一密钥用于证书管理服务器为第一应用生成数据通道应用证书，数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，处理模块802，用于判断标识信息与第一应用的标识信息是否匹配，其中，如果标识信息与第一应用的标识信息相匹配，则表明对第一应用验证成功，如果标识信息与第一应用的标识信息不匹配，则表明对第一应用验证失败。
在另一些可能的实施方式中，第一加密票据还包括：密钥索引；第一处理模块，用 于根据标识信息、密钥索引和第一应用的标识信息对第一应用进行验证。
在另一些可能的实施方式中，处理模块802，用于判断标识信息与第一应用的标识信息是否匹配；如果标识信息与第一应用的标识信息相匹配，则判断密钥索引与第二密钥是否相匹配；其中，如果密钥索引与第二密钥相匹配，则表明对第一应用验证成功；如果密钥索引与第二密钥不匹配，则表明对第一应用验证失败。
在另一些可能的实施方式中，仍参见图8所示，上述通信装置800还包括：通信模块803，用于在通信模块801获得来自证书管理服务器的第一加密票据和第一应用的标识信息之前，接收来自第一终端的密钥请求；处理模块802，还用于响应密钥请求，为第一应用分配第二密钥和第二加密票据，第二加密票据包括：第一应用的标识信息，或者第一应用的标识信息和第二密钥的密钥索引；通信模块803，还用于向第一终端发送第二密钥和第二加密票据。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，通信模块803，还用于与第一终端采用GBA建立通信通道。
基于相同的发明构思，本申请实施例提供一种通信装置，该通信装置可以为第一终端中的芯片或者片上系统，还可以为第一终端中用于实现上述任一可能的实施方式所述的方法的功能模块。举例来说，图9为本申请实施例中的通信装置的又一种结构示意图，参见图9中实线所示，该通信装置900，包括：通信模块901，用于向AS发送加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；接收AS发送的数据通道应用证书，数据通道应用证书为证书管理服务器在根据加密票据和第一应用的标识信息对第一应用验证成功后发送；通信模块902，用于根据数据通道应用证书与第二终端的第二应用进行IMS数据通道业务。
在一些可能的实施方式中，通信模块901，还用于向AS发送KMS的地址，KMS的地址用于指示证书管理服务器与KMS通信。
在另一些可能的实施方式中，第一应用的标识信息包括：第一终端的终端标识；或者，第一终端的终端标识和第一应用的应用标识。
在另一些可能的实施方式中，第一终端的终端标识包括：第一终端的设备标识或者使用第一终端的用户的用户标识。
在另一些可能的实施方式中，参见图9中虚线所示，上述通信装置还可以包括：通信模块903，还用于在通信模块901向AS发送加密票据和第一应用的标识信息之前，向KMS请求密钥和票据；接收KMS为第一应用分配的第二密钥和加密票据，加密票据包括：第一应用的标识信息，或者第一应用的标识信息和第二密钥的密钥索引。
在另一些可能的实施方式中，通信模块903，还用于与KMS采用GBA建立通信通道。
在另一些可能的实施方式中，数据通道应用证书为证书管理服务器根据第一密钥生成的，第一密钥与第二密钥相匹配；通信模块902，还用于当第二终端对第一应用验证成功时，通过第一密钥和第二密钥的配合验证数据通道应用证书。
基于相同的发明构思，本申请实施例提供一种通信装置，该通信装置可以为AS中的芯片或者片上系统，还可以为AS中用于实现上述任一可能的实施方式所述的方法的功能 模块。举例来说，仍参见图8所示，该通信装置，包括：通信模块801，用于接收来自第一终端的加密票据和第一应用的标识信息，第一应用的标识信息用于标识第一终端的第一应用；通信模块803，用于将加密票据和第一应用的标识信息发送给证书管理服务器；接收来自证书管理服务器的第一数据通道应用证书，第一数据通道应用证书为证书管理服务器为第一应用分配的，第一数据通道应用证书用于第一应用与第二终端的第二应用进行IMS数据通道业务；处理模块802，用于保存第一数据通道应用证书；通信模块801，还用于将第一数据通道应用证书发送给第一终端。
在一些可能的实施方式中，通信模块803，还用于接收证书管理服务器为第二应用分配的第二数据通道应用证书，第二数据通道应用证书用于第二应用与第一应用进行IMS数据通道业务；第二处理模块，还用于保存第二数据通道应用证书；通信模块801，还用于将第二数据通道应用证书发送给第二终端。
在另一些可能的实施方式中，通信模块801，还用于在DTLS握手过程中获得来自第一终端的数据通道应用证书和来自第二终端的数据通道应用证书；处理模块802，还用于将来自第一终端的数据通道应用证书与第一数据通道应用证书进行匹配；将来自第二终端的数据通道应用证书与第二数据通道应用证书进行匹配；如果来自第一终端的数据通道应用证书与第一数据通道应用证书匹配，且来自第二终端的数据通道应用证书与第二数据通道应用证书匹配，则允许第一应用与第二应用建立IMS数据通道；如果来自第一终端的数据通道应用证书与第一数据通道应用证书不匹配，和/或来自第二终端的数据通道应用证书与第二数据通道应用证书不匹配，则禁止第一应用与第二应用建立IMS数据通道。
需要说明的是，上述通信模块701、通信模块702、通信模块801、通信模块803、通信模块901、通信模块902以及通信模块903可以为为收发电路、收发接口、收发器等；处理模块802可以为一个或者多个处理器。
基于相同的发明构思，本申请实施例还提供一种终端、证书管理服务器、KSM以及AS，与上述一个或者多个实施例中所述的终端、证书管理服务器、KSM或AS一致。图10为本申请实施例中的通信设备的硬件示意图，参见图10所示，本申请实施例提供的通信设备1000，如终端、证书管理服务器、KSM以及AS，都采用了通用的计算机硬件，包括处理器1001、存储器1002、总线1003、输入设备1004以及输出设备1005。
在一些可能的实施方式中，存储器1002可以包括以易失性和/或非易失性存储器形式的计算机存储媒体，如只读存储器和/或随机存取存储器。存储器1002可以存储操作系统、应用程序、其他程序模块、可执行代码、程序数据、用户开户数据、用户订阅数据等。
输入设备1004可以用于向通信设备1000输入命令和信息，输入设备1004如键盘或指向设备，如鼠标、轨迹球、触摸板、麦克风、操纵杆、游戏垫、卫星电视天线、扫描仪或类似设备。这些输入设备可以通过总线1003连接至处理器1001。
输出设备1005可以用于通信设备1000输出信息，除了监视器之外，输出设备1005还可以为其他外围输出设备，如扬声器和/或打印设备，这些输出设备也可以通过总线1003连接到处理器1001。
通信设备1000可以通过网络接口1006连接到网络中，例如连接到局域网(local area network，LAN)。在联网环境下，通信设备1000中存储的计算机执行指令可以存储在远程存储设备中，而不限于在本地存储。
当终端中的处理器1001执行存储器1002中存储的可执行代码或应用程序时，终端执行以上实施例中的终端一侧的方法步骤，例如执行S401、S501、S510等。具体执行过程参见上述实施例，在此不再赘述。
当证书管理服务器中的处理器1001执行存储器1002中存储的可执行代码或应用程序时，终端执行以上实施例中的终端一侧的方法步骤，例如执行S503、S507、S508等。具体执行过程参见上述实施例，在此不再赘述。
当KMS中的处理器1001执行存储器1002中存储的可执行代码或应用程序时，终端执行以上实施例中的终端一侧的方法步骤，例如执行S402至S403、S504至S506等。具体执行过程参见上述实施例，在此不再赘述。
当AS中的处理器1001执行存储器1002中存储的可执行代码或应用程序时，终端执行以上实施例中的终端一侧的方法步骤，例如执行S503、S509、S601至S607等。具体执行过程参见上述实施例，在此不再赘述。
此外，上述存储器1002中存储有用于实现图7至9中的通信模块701、通信模块702、通信模块801、通信模块803、通信模块901、通信模块902、通信模块903以及处理模块802的功能的计算机执行指令。图7至9中的通信模块701、通信模块702、通信模块801、通信模块803、通信模块901、通信模块902、通信模块903以及处理模块802的功能/实现过程均可以通过图10中的处理器1001调用存储器1002中存储的计算机执行指令来实现，具体实现过程和功能参考上述相关实施例。
基于相同的发明构思，本申请实施例提供一种通信系统，该通信系统为上述图1所示通信系统的网络侧，可以包括：证书管理服务器、KMS以及AS；其中，证书管理服务器、KMS和/或AS，分别被配置为执行如上述任一可能的实施方式所述的基于IMS数据通道的通信方法。
基于相同的发明构思，本申请实施例提供一种计算机可读存储介质，计算机可读存储介质存储有指令，当指令在计算机上运行时，用于执行如上述实施例及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
基于相同的发明构思，本申请实施例提供一种计算机程序或计算机程序产品，当计算机程序或计算机程序产品在计算机上被执行时，使得计算机实现如上述实施例及其任一可能的实施方式所述的基于IMS数据通道的通信方法。
本领域技术人员能够领会，结合本文公开描述的各种说明性逻辑框、模块和算法步骤所描述的功能可以硬件、软件、固件或其任何组合来实施。如果以软件来实施，那么各种说明性逻辑框、模块、和步骤描述的功能可作为一或多个指令或代码在计算机可读媒体上存储或传输，且由基于硬件的处理单元执行。计算机可读媒体可包含计算机可读存储媒体，其对应于有形媒体，例如数据存储媒体，或包括任何促进将计算机程序从一处传送到另一处的媒体(例如，根据通信协议)的通信媒体。以此方式，计算机可读媒体大体上可对应于(1)非暂时性的有形计算机可读存储媒体，或(2)通信媒体，例如信号或载波。数据存储媒体可为可由一或多个计算机或一或多个处理器存取以检索用于实施本申请中描述的技术的指令、代码和/或数据结构的任何可用媒体。计算机程序产品可包含计算机可读媒体。
作为实例而非限制，此类计算机可读存储媒体可包括RAM、ROM、EEPROM、CD-ROM或其它光盘存储装置、磁盘存储装置或其它磁性存储装置、快闪存储器或可用来存储指令或数据结构的形式的所要程序代码并且可由计算机存取的任何其它媒体。并且，任何连接被恰当地称作计算机可读媒体。举例来说，如果使用同轴缆线、光纤缆线、双绞线、数字订户线 (DSL)或例如红外线、无线电和微波等无线技术从网站、服务器或其它远程源传输指令，那么同轴缆线、光纤缆线、双绞线、DSL或例如红外线、无线电和微波等无线技术包含在媒体的定义中。但是，应理解，所述计算机可读存储媒体和数据存储媒体并不包括连接、载波、信号或其它暂时媒体，而是实际上针对于非暂时性有形存储媒体。如本文中所使用，磁盘和光盘包含压缩光盘(CD)、激光光盘、光学光盘、数字多功能光盘(DVD)和蓝光光盘，其中磁盘通常以磁性方式再现数据，而光盘利用激光以光学方式再现数据。以上各项的组合也应包含在计算机可读媒体的范围内。
可通过例如一或多个数字信号处理器(DSP)、通用微处理器、专用集成电路(ASIC)、现场可编程逻辑阵列(FPGA)或其它等效集成或离散逻辑电路等一或多个处理器来执行指令。因此，如本文中所使用的术语“处理器”可指前述结构或适合于实施本文中所描述的技术的任一其它结构中的任一者。另外，在一些方面中，本文中所描述的各种说明性逻辑框、模块、和步骤所描述的功能可以提供于经配置以用于编码和解码的专用硬件和/或软件模块内，或者并入在组合编解码器中。而且，所述技术可完全实施于一或多个电路或逻辑元件中。
本申请的技术可在各种各样的装置或设备中实施，包含无线手持机、集成电路(IC)或一组IC(例如，芯片组)。本申请中描述各种组件、模块或单元是为了强调用于执行所揭示的技术的装置的功能方面，但未必需要由不同硬件单元实现。实际上，如上文所描述，各种单元可结合合适的软件和/或固件组合在编码解码器硬件单元中，或者通过互操作硬件单元(包含如上文所描述的一或多个处理器)来提供。
在上述实施例中，对各个实施例的描述各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
以上所述，仅为本申请示例性的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应该以权利要求的保护范围为准。

Claims (30)

  1. 一种基于互联网协议多媒体子系统IMS数据通道的通信方法，其特征在于，包括：
    证书管理服务器接收来自应用服务器AS的加密票据和第一应用的标识信息，所述第一应用的标识信息用于标识所述第一终端的第一应用；
    所述证书管理服务器向密钥管理服务器KMS发送所述加密票据和所述第一应用的标识信息；
    所述证书管理服务器接收第一密钥；
    所述证书管理服务器向所述AS发送所述第一密钥对应的数据通道应用证书，所述数据通道应用证书用于所述第一应用与第二终端的第二应用进行IMS数据通道业务。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述证书管理服务器获得所述KMS的地址；
    所述证书管理服务器向密钥管理服务器KMS发送所述加密票据和所述第一应用的标识信息，包括：
    所述证书管理服务器根据所述KMS的地址，向所述KMS发送所述加密票据和所述第一应用的标识信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述证书管理服务器向AS所述第一密钥对应的数据通道应用证书，包括：
    所述证书管理服务器向所述AS发送所述数据通道应用证书和所述第一应用的标识信息。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述第一应用的标识信息包括：所述第一终端的终端标识；或者，所述第一终端的终端标识和所述第一应用的应用标识。
  5. 根据权利要求4所述的方法，其特征在于，所述第一终端的终端标识包括：所述第一终端的设备标识或者使用所述第一终端的用户的用户标识。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述加密票据包括：所述第一应用的标识信息。
  7. 根据权利要求6所述的方法，其特征在于，所述加密票据还包括：第二密钥的密钥索引，所述第二密钥与所述第一密钥相匹配，所述第二密钥是由所述KMS为所述第一应用分配的。
  8. 一种基于互联网协议多媒体子系统IMS数据通道的通信方法，其特征在于，包括：
    密钥管理服务器KMS获得来自证书管理服务器的第一加密票据和第一应用的标识信息，所述第一应用的标识信息用于标识第一终端的第一应用；
    所述KMS解密所述第一加密票据，获得所述第一加密票据中的标识信息；
    所述KMS根据所述第一加密票据中的标识信息和所述第一应用的标识信息对所述第一应用进行验证；
    如果对所述第一应用验证成功，则所述KMS向所述证书管理服务器发送第一密钥，所述第一密钥用于所述证书管理服务器为所述第一应用生成数据通道应用证书，所述数据通道应用证书用于所述第一应用与第二终端的第二应用进行IMS数据通道业务。
  9. 根据权利要求8所述的方法，其特征在于，所述KMS根据所述第一加密票据中的标识信息和所述第一应用的标识信息对所述第一应用进行验证，包括：
    所述KMS判断所述第一加密票据中的标识信息与所述第一应用的标识信息是否匹配，其 中，如果所述第一加密票据中的标识信息与所述第一应用的标识信息相匹配，则表明对所述第一应用验证成功，如果所述第一加密票据中的标识信息与所述第一应用的标识信息不匹配，则表明对所述第一应用验证失败。
  10. 根据权利要求8或9所述的方法，其特征在于，所述第一加密票据还包括：密钥索引；
    所述KMS根据所述第一加密票据中的标识信息和所述第一应用的标识信息对所述第一应用进行验证，包括：
    所述KMS根据所述第一加密票据中的标识信息、所述密钥索引和所述第一应用的标识信息对所述第一应用进行验证。
  11. 根据权利要求10所述的方法，其特征在于，所述KMS根据所述第一加密票据中的标识信息、所述密钥索引和所述第一应用的标识信息对所述第一应用进行验证，包括：
    所述KMS判断所述第一加密票据中的标识信息与所述第一应用的标识信息是否匹配；
    如果所述第一加密票据中的标识信息与所述第一应用的标识信息相匹配，则所述KMS判断所述密钥索引与第二密钥是否相匹配，所述第二密钥为所述KMS为所述第一应用分配的；
    其中，如果所述密钥索引与所述第二密钥相匹配，则表明对所述第一应用验证成功；如果所述密钥索引与所述第二密钥不匹配，则表明对所述第一应用验证失败。
  12. 根据权利要求8至11任一项所述的方法，其特征在于，在所述KMS获得来自证书管理服务器的第一加密票据和第一应用的标识信息之前，所述方法还包括：
    所述KMS接收来自所述第一终端的密钥请求；
    所述KMS响应所述密钥请求，为所述第一应用分配所述第二密钥和第二加密票据，所述第二加密票据包括：所述第一应用的标识信息，或者所述第一应用的标识信息和所述第二密钥的密钥索引；
    所述KMS向所述第一终端发送所述第二密钥和所述第二加密票据。
  13. 根据权利要求8至12任一项所述的方法，其特征在于，所述第一应用的标识信息包括：所述第一终端的终端标识；或者，所述第一终端的终端标识和所述第一应用的应用标识。
  14. 根据权利要求13所述的方法，其特征在于，所述第一终端的终端标识包括：所述第一终端的设备标识或者使用所述第一终端的用户的用户标识。
  15. 根据权利要求8至14任一项所述的方法，其特征在于，所述方法还包括：
    所述KMS与所述第一终端采用通用认证机制GBA建立通信通道。
  16. 一种基于互联网协议多媒体子系统IMS数据通道的通信方法，其特征在于，包括：
    第一终端向应用服务器AS向发送加密票据和第一应用的标识信息，所述第一应用的标识信息用于标识所述第一终端的第一应用；
    所述第一终端接收所述AS发送的数据通道应用证书；
    所述第一终端根据所述数据通道应用证书与第二终端的第二应用进行IMS数据通道业务。
  17. 根据权利要求16所述的方法，其特征在于，所述方法还包括：
    所述第一终端向所述AS发送密钥管理服务器KMS的地址，所述KMS的地址用于指示所述证书管理服务器与所述KMS通信。
  18. 根据权利要求16或17所述的方法，其特征在于，所述第一应用的标识信息包括：所述第一终端的终端标识；或者，所述第一终端的终端标识和所述第一应用的应用标识。
  19. 根据权利要求18所述的方法，其特征在于，所述第一终端的终端标识包括：所述第一终端的设备标识或者使用所述第一终端的用户的用户标识。
  20. 根据权利要求16至19任一项所述的方法，其特征在于，在所述第一终端向AS发送加密票据和所述第一应用的标识信息之前，所述方法还包括：
    所述第一终端向KMS请求密钥和票据；
    所述第一终端接收所述KMS为所述第一应用分配的第二密钥和加密票据，所述加密票据包括：第一应用的标识信息，或者所述第一应用的标识信息和所述第二密钥的密钥索引。
  21. 根据权利要求20所述的方法，其特征在于，所述数据通道应用证书为所述证书管理服务器根据第一密钥生成的，所述第一密钥与所述第二密钥相匹配；
    所述第一终端根据所述数据通道应用证书与第二终端的第二应用进行IMS数据通道业务，包括：
    当所述第二终端对所述第一应用验证成功时，所述第一终端通过所述第一密钥和所述第二密钥的配合验证所述数据通道应用证书。
  22. 根据权利要求17至21任一项所述的方法，其特征在于，所述方法还包括：
    所述第一终端与所述KMS采用通用认证机制GBA建立通信通道。
  23. 一种基于互联网协议多媒体子系统IMS数据通道的通信方法，其特征在于，包括：
    应用服务器AS接收来自第一终端的加密票据和第一应用的标识信息，所述第一应用的标识信息用于标识第一终端的第一应用；
    所述AS将所述加密票据和所述第一应用的标识信息发送给证书管理服务器；
    所述AS接收来自证书管理服务器的第一数据通道应用证书，所述第一数据通道应用证书为所述证书管理服务器为所述第一应用分配的，所述第一数据通道应用证书用于所述第一应用与第二终端的第二应用进行IMS数据通道业务；
    所述AS保存所述第一数据通道应用证书，并将所述第一数据通道应用证书发送给所述第一终端。
  24. 根据权利要求23所述的方法，其特征在于，所述方法还包括：
    所述AS接收所述证书管理服务器为所述第二应用分配的第二数据通道应用证书，所述第二数据通道应用证书用于所述第二应用与所述第一应用进行IMS数据通道业务；
    所述AS保存所述第二数据通道应用证书，并将所述第二数据通道应用证书发送给所述第二终端。
  25. 根据权利要求24所述的方法，其特征在于，所述方法还包括：
    所述AS在数据报传输层安全DTLS握手过程中获得来自所述第一终端的数据通道应用证书和来自所述第二终端的数据通道应用证书；
    所述AS将来自所述第一终端的数据通道应用证书与所述第一数据通道应用证书进行匹配；
    所述AS将来自所述第二终端的数据通道应用证书与所述第二数据通道应用证书进行匹配；
    如果来自所述第一终端的数据通道应用证书与所述第一数据通道应用证书匹配，且来自所述第二终端的数据通道应用证书与所述第二数据通道应用证书匹配，则允许所述第一应用与所述第二应用建立IMS数据通道；
    如果来自所述第一终端的数据通道应用证书与所述第一数据通道应用证书不匹配，和/或来自所述第二终端的数据通道应用证书与所述第二数据通道应用证书不匹配，则禁止所述第一应用与所述第二应用建立IMS数据通道。
  26. 一种证书管理服务器，其特征在于，包括：处理器和存储器；处理器与存储器耦合， 处理器被配置为读取并执行存储器中的指令，以实现如权利要求1至7任一项所述的基于互联网协议多媒体子系统IMS数据通道的通信方法。
  27. 一种密钥管理服务器KMS，其特征在于，包括：处理器和存储器；处理器与存储器耦合，处理器被配置为读取并执行存储器中的指令，以实现如权利要求8至15任一项所述的基于互联网协议多媒体子系统IMS数据通道的通信方法。
  28. 一种终端，其特征在于，包括：处理器和存储器；处理器与存储器耦合，处理器被配置为读取并执行存储器中的指令，以实现如权利要求16至22任一项所述的基于互联网协议多媒体子系统IMS数据通道的通信方法。
  29. 一种应用服务器AS，其特征在于，包括：处理器和存储器；处理器与存储器耦合，处理器被配置为读取并执行存储器中的指令，以实现如权利要求23至25任一项所述的基于互联网协议多媒体子系统IMS数据通道的通信方法。
  30. 一种通信系统，其特征在于，包括：证书管理服务器、密钥管理服务器KMS以及应用服务器AS；其中，
    所述证书管理服务器，被配置为执行如权利要求1至7任一项所述的基于IMS数据通道的通信方法；
    所述KMS，被配置为执行如权利要求8至15任一项所述的基于IMS数据通道的通信方法；
    所述AS，被配置为执行如权利要求23至25任一项所述的基于IMS数据通道的通信方法。
PCT/CN2021/107414 2020-08-11 2021-07-20 一种基于ims数据通道的通信方法及设备 WO2022033278A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21855331.1A EP4184821A4 (en) 2020-08-11 2021-07-20 COMMUNICATION METHOD AND DEVICE BASED ON IMS DATA CHANNEL

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010803406.9A CN114079650A (zh) 2020-08-11 2020-08-11 一种基于ims数据通道的通信方法及设备
CN202010803406.9 2020-08-11

Publications (1)

Publication Number Publication Date
WO2022033278A1 true WO2022033278A1 (zh) 2022-02-17

Family

ID=80247643

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/107414 WO2022033278A1 (zh) 2020-08-11 2021-07-20 一种基于ims数据通道的通信方法及设备

Country Status (3)

Country Link
EP (1) EP4184821A4 (zh)
CN (1) CN114079650A (zh)
WO (1) WO2022033278A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024065159A1 (en) * 2022-09-27 2024-04-04 Qualcomm Incorporated Extension of a data channel application id with a data channel tag

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117412254A (zh) * 2022-07-08 2024-01-16 中兴通讯股份有限公司 视频通话控制方法、通信设备以及存储介质
CN117692437A (zh) * 2022-09-05 2024-03-12 华为技术有限公司 通信方法、装置和系统
CN117812056A (zh) * 2022-09-23 2024-04-02 维沃移动通信有限公司 应用程序确定方法、装置、终端及服务器

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104283760A (zh) * 2013-07-04 2015-01-14 华为技术有限公司 一种WebRTC通信方法、相关设备及系统
US20160072778A1 (en) * 2014-09-04 2016-03-10 Westhawk Limited Methods and systems for establishing secure communication between devices via at least one intermediate device
CN106470190A (zh) * 2015-08-19 2017-03-01 中兴通讯股份有限公司 一种Web实时通信平台鉴权接入方法及装置
CN107294968A (zh) * 2017-06-21 2017-10-24 北京奇艺世纪科技有限公司 一种音视频数据的监控方法和系统
CN109792433A (zh) * 2016-09-28 2019-05-21 瑞典爱立信有限公司 用于将设备应用绑定到网络服务的方法和装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101729532B (zh) * 2009-06-26 2012-09-05 中兴通讯股份有限公司 一种ip多媒体子系统延迟媒体信息传输方法及系统
CN102238500B (zh) * 2010-04-21 2014-07-02 中兴通讯股份有限公司 一种实现安全呼叫转移的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104283760A (zh) * 2013-07-04 2015-01-14 华为技术有限公司 一种WebRTC通信方法、相关设备及系统
US20160072778A1 (en) * 2014-09-04 2016-03-10 Westhawk Limited Methods and systems for establishing secure communication between devices via at least one intermediate device
CN106470190A (zh) * 2015-08-19 2017-03-01 中兴通讯股份有限公司 一种Web实时通信平台鉴权接入方法及装置
CN109792433A (zh) * 2016-09-28 2019-05-21 瑞典爱立信有限公司 用于将设备应用绑定到网络服务的方法和装置
CN107294968A (zh) * 2017-06-21 2017-10-24 北京奇艺世纪科技有限公司 一种音视频数据的监控方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4184821A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024065159A1 (en) * 2022-09-27 2024-04-04 Qualcomm Incorporated Extension of a data channel application id with a data channel tag

Also Published As

Publication number Publication date
CN114079650A (zh) 2022-02-22
EP4184821A1 (en) 2023-05-24
EP4184821A4 (en) 2024-01-17

Similar Documents

Publication Publication Date Title
WO2022033278A1 (zh) 一种基于ims数据通道的通信方法及设备
US10560485B2 (en) System and method for connecting a communication to a client
JP5496907B2 (ja) セキュアな通信のための鍵管理
JP6820333B2 (ja) 複数のプレーンにわたるアイデンティティ管理のための方法及びシステム
US9648006B2 (en) System and method for communicating with a client application
CN109302412B (zh) 基于CPK的VoIP通信处理方法、终端、服务器及存储介质
Westerlund et al. Options for securing RTP sessions
US9258700B2 (en) Systems and methods for utilizing IMS data security mechanisms in a circuit switched network
US20140109213A1 (en) Method and Apparatus for Data Transmission
US8713634B2 (en) Systems, methods and computer program products supporting provision of web services using IMS
JP2007528650A (ja) エンティティの第１のｉｄおよび第２のｉｄの検証方法
US20080120705A1 (en) Systems, Methods and Computer Program Products Supporting Provision of Web Services Using IMS
US7940748B2 (en) Systems, methods and computer program products supporting provision of web services using IMS
WO2011022999A1 (zh) 一种终端对视频会议数据进行加密的方法及系统
WO2008040213A1 (fr) Procédé, système et dispositif de chiffrement et de signature de messages dans un système de communication
US10595203B2 (en) Enhanced establishment of IMS session with secure media
CN109120408A (zh) 用于认证用户身份的方法、装置和系统
WO2017197968A1 (zh) 一种数据传输方法及装置
JP2006270431A (ja) 呼制御装置、端末、これらのプログラム、及び通信チャネル確立方法
KR102656508B1 (ko) 사용자 네트워크 인터페이스 프록시를 통한 캐리어 통합
CN114040385A (zh) 一种基于VoLTE的加密通话系统及方法
US20240097903A1 (en) Ipcon mcdata session establishment method
CN102546574B (zh) 基于ip多媒体子系统的流媒体点播方法和装置
JP5746774B2 (ja) セキュアな通信のための鍵管理
CN116980399A (zh) 一种建立实时通信连接中协商信息的方法和装置

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021855331

Country of ref document: EP

Effective date: 20230220

NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21855331

Country of ref document: EP

Kind code of ref document: A1