WO2022100666A1

WO2022100666A1 - Information sending method and apparatus

Info

Publication number: WO2022100666A1
Application number: PCT/CN2021/130084
Authority: WO
Inventors: 李飞; 何承东; 赵绪文
Original assignee: 华为技术有限公司
Priority date: 2020-11-12
Filing date: 2021-11-11
Publication date: 2022-05-19
Also published as: CN114501417B; CN114501417A

Abstract

The present application discloses an information sending method and apparatus. Said method comprises: a second subscription server receiving first identification information from a first server, the first identification information comprising a first identity identifier of a first terminal device and/or a second identity identifier of a second terminal device that are encrypted; the second subscription server sending a first request to a first subscription server, the first request carrying the first identification information; receiving the first identity identifier and/or the second identity identifier from the first subscription server; and obtaining second identification information according to the first identity identifier and/or the second identity identifier, and sending the second identification information to the first server. By encrypting the first identity identifier and/or the second identity identifier and transmitting the encrypted first identity identifier and/or second identity identifier in an air interface and a core network, the risk that the first identity identifier and/or the second identity identifier is leaked in the air interface and the core network can be reduced, thereby improving the security.

Description

Method and device for sending information

This application claims the priority of the Chinese patent application with the application number of 202011262056.6 and the application title of "A Method and Device for Sending Information" filed with the China Patent Office on November 12, 2020, the entire contents of which are incorporated into this application by reference .

technical field

The present application relates to the field of communication technologies, and in particular, to a method and apparatus for sending information.

Background technique

With the development of communication technology, the contact between users is more and more frequent, the problem of user information protection is becoming more and more serious, and there is a risk of user information being leaked. For example, as a kind of important user information, the phone number is easily leaked in the air interface and the core network when the user makes a call, so that the user may receive harassing calls or even fraudulent calls. Therefore, there is a risk of information leakage in the process of making a call by a user.

SUMMARY OF THE INVENTION

The present application provides an information sending method and device, which can reduce the risk of information leakage, thereby improving security.

In a first aspect, the present application provides a method for sending information. The method is applied to a communication system including a first terminal device and a second terminal device; the communication system further includes a first subscription server corresponding to the first terminal device and a corresponding second terminal device. the second subscription server, the first terminal device has a first identity, the second terminal device has a second identity, the first terminal device is the calling party of the communication, and the second terminal device is the called party of the communication; the first The method provided by the aspect may be executed by the second subscription server, or may also be executed by a chip configured in the second subscription server, which is not limited in this application.

The method includes: the second subscription server receives first identification information from the first server, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal device, the third identification The identity is obtained by encrypting the first identity, the fourth identity is the identity obtained by encrypting the second identity, or the first identity information includes one of the first identity and the second identity, and the second identity is encrypted. A fifth identity identifier obtained by encrypting the other one of the identity identifier and the second identity identifier; sending a first request to the first signing server, the first request carrying the first identifier information; the first request is used to request the first identity identifier and Receive the first response from the first subscription server; the first response carries the first identity and/or the second identity; obtain the second identity information according to the first identity and/or the second identity , the second identification information includes the sixth identification of the first terminal device and the seventh identification of the second terminal device, the sixth identification is the identification obtained by encrypting the first identification, and the seventh identification is the identification of the second identification. The identity mark obtained by the encryption of the identity mark, or the second identification information includes one of the first identity mark and the second identity mark, and the eighth identity mark obtained by encrypting the other of the first identity mark and the second identity mark; Send the second identification information to the first server.

It can be seen that by encrypting the first identification of the first terminal device and/or the second identification of the second terminal device, the encrypted first identification and/or the second identification are used for transmission between the air interface and the core network. , avoiding the risk of the first identity and/or the second identity being leaked in the air interface and the core network, thereby improving security.

In a possible implementation, the sixth identification is an identification obtained by encrypting the first identification with a fourth key, and the seventh identification is an identification obtained by encrypting the second identification with a fifth key, The eighth identification is an identification obtained by encrypting the other one of the first identification and the second identification using the sixth key. It can be seen that the first identification of the first terminal device and/or the second identification of the second terminal device are encrypted respectively through multiple encryption methods to ensure user privacy security.

In a possible implementation, the fifth key is the public key of the second terminal device. It can be seen that the network device that obtains the private key corresponding to the public key of the second terminal device by encrypting the first identity and/or the second identity through the public key of the second terminal device can decrypt the seventh identity to obtain the The identity identifier and/or the second identity identifier prevents the first identity identifier and/or the second terminal device from being acquired by other network devices during the routing process, so that the encrypted first identity identifier and/or the second identity identifier can be correctly routed to second terminal equipment.

In a possible implementation, the third identity is an identity obtained by encrypting the first identity with a first key, and the fourth identity is an identity obtained by encrypting the second identity with a second key, The fifth identification is an identification obtained by encrypting the other of the first identification and the second identification with a third key. It can be seen that by encrypting the first identity of the first terminal device and/or the second identity of the second terminal device, the exposure of the first identity and/or the second terminal device between the air interface and the core network is avoided, ensuring that User privacy and security.

In a possible implementation, the fourth identity is an identity obtained by the first terminal device using the second key to encrypt the second identity; the third identity is the first terminal using the first identity for the first identity. The identity identifier obtained by encryption with the key; or, the third identity identifier is the identity identifier obtained by the first signing server encrypting the first identity identifier with the first key. It can be seen that the first identity identifier and the second identity identifier are encrypted at the same time to protect the privacy and security of the calling user information and the called user information.

In a possible implementation, the fifth identity is an identity obtained by the first terminal device using the third key to encrypt the other of the first identity and the second identity, or the fifth identity is the first The signing server encrypts the other one of the first identification and the second identification using the third key to obtain the identification. It can be seen that by encrypting any one of the first identity identifier and/or the second identity identifier, the information sending efficiency is improved while the security is improved.

In a possible implementation, at least one of the fourth key, the fifth key and the sixth key is a shared key between the second signing server and the second terminal device; At least one of the key and the sixth key is a key generated by a long-term key of the second terminal device and a random number. It can be seen that the first identity and/or the second identity are encrypted by the shared key between the second signing server and the second terminal device, and the network device that obtains the shared key can encrypt the sixth identity, the seventh identity or the third identity. 8. Decryption of the identities to obtain the first identity and/or the second identity, to prevent the first identity and/or the second identity from being acquired by other network devices during the routing process, and to realize the encrypted first identity and/or The second identity can be correctly routed to the second terminal device.

In a possible implementation, the first server is a query call session control function of the network where the second terminal device is located, or is a routing proxy node of the network where the second terminal device is located. It can be seen that the routing accuracy can be improved by routing the encrypted first identity identifier and/or the second identity identifier to the second terminal device by the first server.

In a second aspect, the present application provides a method for sending information, the method is applied to a communication system including a first terminal device and a second terminal device; the communication system further includes a second subscription server corresponding to the second terminal device, the first terminal device having a first identity identifier, the second terminal device having a second identity identifier, the first terminal device being the calling party of the communication, and the second terminal device being the called party of the communication; the method provided in the second aspect may be executed by the first subscription server, Alternatively, it may also be executed by a chip configured in the first subscription server, which is not limited in this application.

The method includes: the first server obtains first identification information from the first terminal device, the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal device, and the third identification is The identification is obtained by encrypting the first identification, the fourth identification is the identification obtained by encrypting the second identification, or the first identification information includes one of the first identification and the second identification, and the first identification The fifth identity identifier obtained by encrypting the other of the identity identifier and the second identity identifier; the first server determines the second signing server according to at least one of the parameters in the fourth identity identifier of the second terminal device, and the parameters include the country code and the country purpose code, or include the country code, the country purpose code and the routing indication; the first server sends the first identification information to the second subscription server.

In a possible implementation, the first server receives second identification information from the second signing server, where the second identification information includes a sixth identification of the first terminal device and a seventh identification of the second terminal device, the sixth identification The identification is an identification obtained by encrypting the first identification, the seventh identification is an identification obtained by encrypting the second identification, or the second identification information includes one of the first identification and the second identification, and the An eighth identity identifier obtained by encrypting the other of the first identity identifier and the second identity identifier; the first server sends the second identifier information to the second terminal device.

The above-mentioned first server determines the second subscription server according to the parameters in the fourth identity identifier. Another possible way is that, in the case where the above-mentioned fifth identification is obtained by encrypting the second identification, the first server may determine the second signing server according to at least one of the parameters in the fifth identification. . The parameter may also include a country code and a country destination code, or a country code, a country destination code, and a routing indication.

In a possible implementation, the third identity is an identity obtained by encrypting the first identity with a first key, and the fourth identity is an identity obtained by encrypting the second identity with a second key, The fifth identification is an identification obtained by encrypting the other of the first identification and the second identification with a third key.

In a possible implementation, the fourth identity is an identity obtained by the first terminal device using the second key to encrypt the second identity; the third identity is the first terminal using the first identity for the first identity. The identity identifier obtained by encryption with the key; or, the third identity identifier is the identity identifier obtained by the first signing server encrypting the first identity identifier with the first key.

In a possible implementation, the fifth identity is an identity obtained by the first terminal device using the third key to encrypt the other of the first identity and the second identity, or the fifth identity is the first contract The server encrypts the other one of the first identity and the second identity using the third key to obtain the identity.

In a possible implementation, at least one of the first key, the second key and the third key is a shared key between the first signing server and the first terminal device; At least one of the key and the third key is a key generated by the first signing server according to the long-term key and the random number of the first terminal device; or, one of the first key, the second key and the third key At least one of the keys is a key generated by the first signing server and the first terminal device according to the target algorithm.

In a possible implementation, the first server is a query call session control function of the network where the second terminal device is located, or is a routing proxy node of the network where the second terminal device is located.

The beneficial effects of the second aspect can be found in the beneficial effects of the first aspect.

In a third aspect, the present application provides an information sending method, which is applied to a communication system including a first terminal device and a second terminal device; the communication system further includes a first subscription server and a second terminal device corresponding to the first terminal device the corresponding second subscription server, the first terminal device has a first identity, the second terminal device has a second identity, the first terminal device is a communication calling party, and the second terminal device is a communication called party;

Wherein, the method includes: a first subscription server receives a first request from a second subscription server, the first request is used to request a first identity identifier and/or a second identity identifier, the first request carries first identification information, and the first identifier The information includes the third identity of the first terminal device and the fourth identity of the second terminal. The third identity is the identity obtained by encrypting the first identity, and the fourth identity is obtained by encrypting the second identity. or the first identification information includes one of the first identification and the second identification, and a fifth identification obtained by encrypting the other of the first identification and the second identification; the first signing server Send a first response to the second subscription server, where the first response carries the first identity and/or the second identity.

In a possible implementation, the first signing server uses the first key to decrypt the third identity to obtain the first identity, and/or the first signing server uses the second key to decrypt the fourth identity , obtain the second identity, or the first signing server decrypts the fifth identity by using the third key to obtain the other of the first identity and the second identity.

For the beneficial effects of the third aspect, please refer to the beneficial effects of the first aspect.

In a fourth aspect, the present application provides an information sending method, which is applied to a communication system including a first terminal device and a second terminal device; the first terminal device has a first identity, and the second terminal has a second identity , the first terminal device is the calling party of the communication, and the second terminal device is the called party of the communication;

Wherein, the method includes: the first terminal device determines first identification information, the first identification information includes a third identification of the first terminal and a fourth identification of the second terminal, and the third identification is for the first identification The identity identifier obtained by identifying the encryption, the fourth identity identifier is the identity identifier obtained by encrypting the second identity identifier, or the first identifier information includes one of the first identity identifier and the second identity identifier, and the first identity identifier and the second identity identifier. The other of the two identifications is a fifth identification obtained by encryption; the first terminal device sends the first identification information to the first server.

In a possible implementation, the first signing server is a signing server corresponding to the first terminal device, the third identity identifier is an identity identifier obtained by the first terminal device using the first key to encrypt the first identifier, and the fourth identity The identifier is an identity identifier obtained by encrypting the second identity identifier with the second key by the first terminal device; or, the third identity identifier is an identity identifier obtained by the first signing server using the first key encryption for the first identity identifier, The four identifications are the identifications obtained by the first terminal device encrypting the second identifications with the second key.

In a possible implementation, the first subscription server is a subscription server corresponding to the first terminal device, and the fifth identity is that the first terminal device uses a third key for the other of the first identity and the second identity The encrypted identification, or the fifth identification, is an identification obtained by the first signing server encrypting the other of the first identification and the second identification with the third key.

For the beneficial effects of the fourth aspect, reference may be made to the beneficial effects of the first aspect.

In a fifth aspect, the present application provides an information sending method, which is applied to a communication system including a first terminal device and a second terminal device; the first terminal device has a first identity, and the second terminal has a second identity , the first terminal device is the calling party of the communication, and the second terminal device is the called party of the communication;

The method includes: the second terminal device receives second identification information from the first server, the second identification information includes a sixth identification of the first terminal device and a seventh identification of the second terminal device, and the sixth identification is The identity mark obtained by encrypting the first identity mark, the seventh identity mark is the identity mark obtained by encrypting the second identity mark, or the second identification information includes one of the first identity mark and the second identity mark, and the first An eighth identity identifier obtained by encrypting the other of the identity identifier and the second identity identifier; the second terminal device decrypts the second identifier information to obtain the first identity identifier and/or the second identity identifier.

In a possible implementation, the second terminal device uses the fourth key to decrypt the sixth identification to obtain the first identification, and uses the seventh key to decrypt the seventh identification to obtain the second identification, or uses The sixth key decrypts the eighth identification to obtain the other of the first identification and the second identification.

In a possible implementation, the seventh key is a private key corresponding to the public key of the second terminal device.

In a possible implementation, at least one of the fourth key, the fifth key and the sixth key is a shared key between the second signing server and the second terminal device; At least one of the key and the sixth key is a key generated by a long-term key of the second terminal device and a random number.

In a possible implementation, the first server is a query call session control function entity of the network where the second terminal device is located, or is a routing proxy node of the network where the second terminal device is located.

For the beneficial effects of the fifth aspect, reference may be made to the beneficial effects of the first aspect.

The above method embodiments have been described in various aspects. On the premise that they are not mutually exclusive, some information involved can be used in various aspects, such as specific features related to each key.

The present application provides a communication device having some or all of the functions of the first to fifth aspects described above. For example, the functions of the apparatus may have the functions of some or all of the embodiments of the terminal device in this application, and may also have the functions of independently implementing any one of the embodiments of this application. The functions can be implemented by hardware, or by executing corresponding software by hardware. The hardware or software includes one or more units or modules corresponding to the above functions.

In a possible design, the structure of the communication device may include a processing unit and a communication unit, and the processing unit is configured to support the communication device to perform the corresponding functions in the above method. The communication unit is used to support communication between the communication device and other devices. The communication device may also include a storage unit for coupling with the processing unit and the communication unit, which stores program instructions and data necessary for the communication device.

In a sixth aspect, the present application provides a communication device, the communication device having part or all of the functions of the second subscription server of the first aspect above. The communication device includes:

A communication unit, configured to receive first identification information from the first server, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal, and the third identification is a pair of the first identification The encrypted identification, the fourth identification is the identification obtained by encrypting the second identification, or the first identification information includes one of the first identification and the second identification, and the first identification and the second identification. another encrypted fifth identification in the identification;

a processing unit, configured to send a first request to the first subscription server through the communication unit according to the first identification information, where the first request carries the first identification information; the first request is used to request the first identification and/or the second identification identification;

a communication unit, further configured to receive a first response from the first subscription server; the first response carries the first identity and/or the second identity;

The processing unit is further configured to obtain second identification information according to the first identification and/or the second identification, and the second identification information includes the sixth identification of the first terminal device and the seventh identification of the second terminal device, and the second identification information includes the sixth identification of the first terminal device and the seventh identification of the second terminal device. The sixth identification is an identification obtained by encrypting the first identification, and the seventh identification is an identification obtained by encrypting the second identification, or the second identification information includes one of the first identification and the second identification, and an eighth identity identity obtained by encrypting the other of the first identity identity and the second identity identity; the communication unit is further configured to send the second identity information to the first server.

For the relevant content of this embodiment, reference may be made to the relevant content of the above-mentioned first aspect, which will not be described in detail here.

The beneficial effects of the sixth aspect may refer to the beneficial effects of the first aspect.

In a seventh aspect, the present application provides a communication device, the communication device having part or all of the functions of the first server of the second aspect above. The communication device includes:

a communication unit, configured to obtain first identification information from the first terminal device, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal device, and the third identification is for the first identification The identity identifier obtained by identifying the encryption, the fourth identity identifier is the identity identifier obtained by encrypting the second identity identifier, or the first identifier information includes one of the first identity identifier and the second identity identifier, and the first identity identifier and the second identity identifier. A fifth identity identity obtained by encryption from another of the two identity identifiers;

The processing unit is configured to determine the second subscription server according to at least one of the parameters in the fourth identification of the second terminal device or the fifth identification of the second terminal device, the parameters include a country code and a country purpose code, or include Country code, country destination code and routing instructions;

The communication unit is further configured to send the first identification information to the second subscription server.

For the relevant content of this embodiment, reference may be made to the relevant content of the above-mentioned second aspect, which will not be described in detail here.

For the beneficial effects of the seventh aspect, reference may be made to the beneficial effects of the second aspect.

In an eighth aspect, the present application provides a communication device, which has part or all of the functions of the first subscription server of the third aspect. The communication device may include:

a communication unit, configured to receive a first request from a second subscription server, where the first request is used to request a first identity and/or a second identity, the first request carries first identity information, and the first identity information includes the first terminal The third identity of the device and the fourth identity of the second terminal device, the third identity is the identity obtained by encrypting the first identity, and the fourth identity is the identity obtained by encrypting the second identity, or The first identification information includes one of the first identification and the second identification, and a fifth identification obtained by encrypting the other of the first identification and the second identification;

The processing unit is configured to send a first response to the second subscription server according to the first request, where the first response carries the first identity and/or the second identity.

For the relevant content of this embodiment, reference may be made to the relevant content of the above-mentioned third aspect, which will not be described in detail here.

For the beneficial effects of the eighth aspect, reference may be made to the beneficial effects of the third aspect.

In a ninth aspect, the present application provides a communication apparatus, the communication apparatus having part or all of the functions of the first terminal device of the fourth aspect above. The communication device includes:

a processing unit, configured to determine first identification information, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal, and the third identification is an identity obtained by encrypting the first identification identification, the fourth identification is an identification obtained by encrypting the second identification, or the first identification information includes one of the first identification and the second identification, and the first identification and the second identification. Another encrypted fifth identity identifier;

The communication unit is used for sending the first identification information to the first server.

For the relevant content of this embodiment, reference may be made to the relevant content of the above-mentioned fourth aspect, which will not be described in detail here.

For the beneficial effects of the ninth aspect, reference may be made to the beneficial effects of the fourth aspect.

According to a tenth aspect, the present application provides a communication device, the communication device having part or all of the functions of the second terminal device of the fifth aspect. The communication device includes:

A communication unit, configured to receive second identification information from the first server, where the second identification information includes a sixth identification of the first terminal device and a seventh identification of the second terminal device, and the sixth identification is for the first identification The encrypted identification, the seventh identification is the identification obtained by encrypting the second identification, or the second identification information includes one of the first identification and the second identification, and the first identification and the second identification. Another eighth identity identifier obtained by encryption in the identity identifier;

A processing unit, configured to decrypt the second identification information to obtain the first identification and/or the second identification.

For the relevant content of this embodiment, reference may be made to the relevant content of the fifth aspect above, which will not be described in detail here.

For the beneficial effects of the tenth aspect, reference may be made to the beneficial effects of the fifth aspect.

In various implementation processes of the present application, the communication unit in each apparatus may be a transceiver, and the processing unit may be a processor.

In various implementation processes of the present application, the processor in each device may be used to perform, for example, but not limited to, baseband related processing, and the transceiver may be used to perform, for example, but not limited to, radio frequency transmission and reception. The above-mentioned devices may be respectively arranged on chips that are independent of each other, or at least part or all of them may be arranged on the same chip. For example, processors can be further divided into analog baseband processors and digital baseband processors. Among them, the analog baseband processor can be integrated with the transceiver on the same chip, and the digital baseband processor can be set on a separate chip. With the continuous development of integrated circuit technology, more and more devices can be integrated on the same chip. For example, a digital baseband processor can be integrated with a variety of application processors (such as but not limited to graphics processors, multimedia processors, etc.) on the same chip. Such a chip may be called a System on Chip. Whether each device is independently arranged on different chips or integrated on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the implementation form of the foregoing device.

In an eleventh aspect, the present application provides a communication apparatus, the communication apparatus includes a processor, and when the processor calls a computer program in a memory, the method of the first aspect is executed. The communication device may be a second subscription server.

In a twelfth aspect, the present application provides a communication apparatus, the communication apparatus includes a processor, and when the processor calls a computer program in a memory, the method in the second aspect is executed. The communication device may be the first server.

In a thirteenth aspect, the present application provides a communication device, the communication device includes a processor, and when the processor calls a computer program in a memory, the method of the third aspect is executed. The communication device may be the first subscription server.

In a fourteenth aspect, the present application provides a communication apparatus, the communication apparatus includes a processor, when the processor calls a computer program in a memory, as in the method in the fourth aspect. The communication apparatus may be a first terminal device.

In a fifteenth aspect, the present application provides a communication apparatus, the communication apparatus includes a processor, when the processor calls a computer program in a memory, as in the method in the fifth aspect. The communication apparatus may be a second terminal device.

The communication apparatuses in the above aspects may include a processor and a memory, where the memory is used for storing computer-executed instructions; the processor is used for executing the computer-executed instructions stored in the memory, so that the communication apparatuses perform the methods corresponding to the various aspects. Optionally, the memory can be inside the processor or outside the processor.

These communication means may include a processor, a memory, and a transceiver for receiving channels or signals, or transmitting channels or signals; a memory for storing program code; a processor for invoking program code from the memory to execute various corresponding method.

These communication devices may also include a processor and an interface circuit, the interface circuit is used to receive code instructions and transmit them to the processor; the processor executes the code instructions to execute the methods corresponding to the various aspects.

In a sixteenth aspect, the present application provides a computer-readable storage medium for storing instructions, and when the instructions are executed, the method of any one of the first to fifth aspects is implemented.

In a seventeenth aspect, the present application provides a computer program product comprising instructions which, when executed, cause the method of any one of the first to fifth aspects to be implemented.

Description of drawings

Fig. 1 is a kind of schematic flow chart of terminal equipment registration authentication;

2 is a schematic flowchart of a method for sending information;

3 is a schematic diagram of a communication system architecture provided by an embodiment of the present application;

4 is a schematic flowchart of a method for sending information provided by an embodiment of the present application;

5 is a schematic flowchart of a first signing server encrypting a first identity identifier;

6 is a schematic flowchart of a first terminal device sending first identification information to a first server;

FIG. 7 is a schematic flow chart of information sending between a second terminal device and a first server;

8 is a schematic flowchart of a first server sending second identification information to a second terminal device;

9 is a schematic flowchart of a terminal device registration authentication provided by an embodiment of the present application;

FIG. 10 is a schematic flowchart of another terminal device registration authentication provided by an embodiment of the present application;

11 is a schematic flowchart of another terminal device registration authentication provided by an embodiment of the present application;

FIG. 12 is a schematic structural diagram of a communication device provided by an embodiment of the present application;

FIG. 13 is a schematic structural diagram of another communication device provided by an embodiment of the present application;

FIG. 14 is a schematic structural diagram of another communication apparatus provided by an embodiment of the present application.

Detailed ways

The terms "first" and "second" in the description, claims and drawings of the present application are used to distinguish different objects, rather than to describe a specific order. Furthermore, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes unlisted steps or units, or optionally also includes For other steps or units inherent to these processes, methods, products or devices.

Reference herein to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor a separate or alternative embodiment that is mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

In this application, "at least one (item)" means one or more, "plurality" means two or more, "at least two (item)" means two or three and three In the above, "and/or" is used to describe the relationship of related objects, indicating that there can be three kinds of relationships, for example, "A and/or B" can mean: only A exists, only B exists, and both A and B exist three A case where A and B can be singular or plural. The character "/" generally indicates that the associated objects are an "or" relationship. "At least one item(s) below" or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (a) of a, b or c, can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c" ", where a, b, c can be single or multiple.

In order to better understand the embodiments of the present application, the following professional terms involved in the embodiments of the present application are introduced:

(1) Internet Protocol Multimedia Subsystem (IMS)

IMS is a multimedia communication network that uses Session Initiation Protocol (SIP) as call control signaling. As a telecom next-generation core network, IMS enables operators to provide users with multimedia based on Internet-based applications, services and protocols. business. Various types of terminal equipment may establish end-to-end Internet Protocol (Internet Protocol, IP) communication through IMS, and obtain the required quality of service, wherein the terminal equipment can be a user terminal (User equipment, UE), this The embodiment of the application takes that the terminal device is a UE as an example.

(2) Call session control function (CSCF)

The CSCF network element is responsible for the signaling control in the process of handling multimedia call sessions in the IMS. The CSCF network element is mainly responsible for the control of functions such as registration authentication, session control, routing management, network management and charging related to user services. The network elements of CSCF include: proxy call session control function (Proxy CSCF, P-CSCF), query call session control function (Interrogating CSCF, I-CSCF), serving call session control function (Serving CSCF, S-CSCF).

P-CSCF network element: the unified entry point of the IMS visited network, the main functions include: forwarding the SIP registration request initiated by the terminal device to the I-CSCF, and forwarding the SIP message sent by the UE to the S-CSCF.

I-CSCF network element: the entry point of the IMS network, the main functions include: in the registration process, the I-CSCF allocates an S-CSCF to the user according to the information obtained from the HSS, and forwards the registration request to the S-CSCF. During the session, the I-CSCF queries the HSS, obtains the address of the S-CSCF from the HSS, and forwards the SIP request or response to the S-CSCF according to the S-CSCF address obtained from the HSS.

S-CSCF network element: in the core position in IMS network session control, the main functions include: in the registration process, accept the registration request forwarded by the P-CSCF, interact with the home subscriber server (Home subscriber server, HSS), complete For user authentication and authentication, update the user's registration status information on the HSS. After the registration authentication is passed, the user-related information is downloaded from the HSS, the service-related information is provided for the terminal device, and the session of the terminal device is controlled. Obtain the address of the I-CSCF, and forward the SIP request or response to the I-CSCF, etc.

(3) Home subscriber server (HSS)

The home subscriber server HSS can be called a subscription server, which is the core database in the IMS network, used to store information related to users and services in the IMS domain, and complete call/session processing with other terminal devices and network elements in the IMS network. The HSS is an important part of the IMS control layer and is used to handle the main user database of the IMS network entity of the call/session. The HSS communicates with an application server (Application server, AS) and a call session control function (Call session control function, CSCF) server. The main functions of HSS include (1) storing user information and service information (including user identification, identity identification and addressing information, user security information, user location information, and user subscription information, where the identification identification can be a phone number); (2) Interact with the I-CSCF, complete the assignment of the S-CSCF, and obtain the relevant information serving the P-CSCF; (3) Generate the authentication vector information, interact with the S-CSCF, complete the user authentication, and obtain the user (4) Interact with the application server AS, respond to the service information query of the AS, accept the AS customized data change notification, and synchronize the service data to the HSS superior.

(4) User ID

User identities used in IMS include but are not limited to IP multimedia private identity (IP multimedia private identity, IMPI) and IP multimedia public identity (IP multimedia public identity, IMPU). IMPI and IMPU are Uniform Resource Identifiers (URIs), which can be numbers, such as phone number Uniform Resource Identifiers (for example, 15551234567), or character identifiers, such as SIP Uniform Resource Identifier SIP-URI (for example, John.doe@example.com). Wherein, when the IMPI adopts a SIP-URI, it can be represented by "identity identifier@home network domain name" or "identity identifier@home network domain name". Wherein, the identity identifier may be a phone number, user name, etc. assigned to the user. If the home network domain name is an IMS user of gx.cn and his phone number is 077123456, the IMPI of the user is "077123456@gx.cn". The IMPI includes routing information such as a mobile country code (MCC), a mobile network code (MNC), and a mobile subscriber identification number (MSIN). In the embodiment of the present application, the user identifier is IMPI as an example.

(5) The process of initial registration authentication initiated by terminal equipment

Referring to FIG. 1 , the UE sends a registration (Register) request to the P-CSCF, and the registration request carries the UE's user identity (such as IMPI), contact address, SIP, access network type, encryption algorithm and other information;

After receiving the registration request, the P-CSCF saves the user ID and other necessary information, obtains the I-CSCF address, forms a new registration request, and sends the registration request carrying the user ID and I-CSCF address to the queried I-CSCF address. ;

The I-CSCF queries the registration status of the user in the HSS according to the user ID. If it is not registered, it selects an S-CSCF to process the registration request of the UE. The I-CSCF sends the registration request carrying the address of the S-CSCF to the S-CSCF to continue processing. ;

After receiving the registration request, the S-CSCF checks whether the user is initially registered, and if so, sends a user authentication request to the HSS;

The HSS calculates the authentication vector for user authentication, and sends a user authentication response carrying the authentication vector to the S-CSCF.

The S-CSCF receives the authentication vector of the HSS and sends the unauthorized information to the UE through the I-CSCF and the P-CSCF. The unauthorized information can be 401 Unauthorized, and the unauthorized information includes the authentication vector.

The UE generates an authentication response according to the authentication vector, and generates a new registration request to send the authentication response to the P-CSCF;

After receiving the authentication response, the P-CSCF sends a registration request for user authentication to the S-CSCF through the I-CSCF, and the registration request carries the authentication response.

The S-CSCF verifies the received authentication response, and after confirming the user authentication, sends a server allocation request (which can be Diameter SAR) to the HSS, which is used to request the user registration information IFC rules.

The HSS updates the user registration information and saves the S-CSCF domain name information, and returns the IFC rules to the S-CSCF through the server allocation response (which can be Diameter SAA).

The S-CSCF sends a 200 OK message to the UE, and the initial registration and authentication of the UE's identity is completed.

When both UE1 and UE2 belong to the same IMS network, a session can be established after completing the initial registration and authentication of the identities as described above.

(6) The flow of establishing a session between the first terminal and the second terminal

Referring to Figure 2, UE1 and UE2 belong to the calling home domain and the called home domain, respectively, and the calling home domain also includes a network element Domain Name System (DNS) server, telephone number mapping (E.164 number uri mapping, ENUM) server, P-CSCF1, S-CSCF1, HSS1, the called home domain also includes I-CSCF2, P-CSCF2, S-CSCF2, HSS2. The UE1 has a first identity, and the UE2 has a second identity, and the identity is used to identify the terminal device, which may be an identity of a phone number, an Internet voice and video call, and other services.

The UE1 sends a session request to the S-CSCF1 through the P-CSCF1, wherein the session request carries the information of the first identity and the second identity.

After receiving the session request, S-CSCF1 sends a domain name resolution request to DNS and/or ENUM to obtain the IP address of I-CSCF2;

The I-CSCF2 receives the session request, and requests the HSS2 to send the IP address of the S-CSCF2 bound to the UE2, and the session request carries the information of the first identity and the second identity;

The I-CSCF2 obtains the IP address of the S-CSCF2 according to the domain name information of the S-CSCF2 returned by the HSS2, and sends a session request to the S-CSCF2, where the session request carries the information of the first identity and the second identity;

S-CSCF2 forwards the session request to UE2 through P-CSCF2, and the session request carries the first identity and second identity information;

UE2 receives the session request and establishes a session process with UE1.

In order to better understand the embodiments of the present application, the following first introduces the communication system architecture involved in the embodiments of the present application:

Referring to FIG. 3 , FIG. 3 is a schematic diagram of a communication system architecture provided by an embodiment of the present application. The communication system may include a first terminal device 301 and a second terminal device 305, a first subscription server 304 corresponding to the first terminal device 301, a second subscription server 303 corresponding to the second terminal device 305, and a second terminal The first server 302 in the network where the device 305 is located. The number and form of devices shown in FIG. 3 are used as examples and do not constitute a limitation to the embodiments of the present application. For example, an actual application may include two or more first terminal devices and the like.

The first terminal device 301 and the first subscription server 304 are network devices in the calling home domain, and the first server 302, the second subscription server 303 and the second terminal device 305 are network devices in the called home domain. The first subscription server 304 receives the service request initiated by the first terminal device 301, addresses the second subscription server 303 through the first server 302, and through the second subscription server 303, enables the first terminal device 301 and the second terminal device 305 to establish connect.

The terminal device involved in the embodiments of the present application may be a device with a wireless transceiver function, and may be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it may also be deployed on water (such as ships, etc.); Can be deployed in the air (eg, on airplanes, balloons, satellites, etc.). UEs include handheld devices, in-vehicle devices, wearable devices or computing devices with wireless communication capabilities. Exemplarily, the UE may be a mobile phone, a tablet computer, or a computer with a wireless transceiver function. The terminal device may also be a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a smart vehicle (smart vehicle) terminal device, a wireless terminal in industrial control, and a wireless terminal in unmanned driving. , UAV, UAV controller, wireless terminal in telemedicine, wireless terminal in smart grid, wireless terminal in smart city, wireless terminal in smart home, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

The subscription server involved in the embodiment of the present application is a home subscriber server (Home subscriber server, HSS). For convenience of description, the first subscription server 304 may be referred to as HSS1 for short, and the second subscription server 303 may be referred to as HSS2 for short.

The first server may be the query call session control function I-CSCF network element of the network where the second terminal device is located (the called home domain network), and for the convenience of description, referred to as I-CSCF2 for short, and the first server may also be the second terminal device. The routing agent node (Diameter routing agent, DRA) of the network where it is located is referred to as DRA2 for the convenience of description.

Applied in this application, the first terminal device 301 sends first identification information to the first server 302, where the first identification information includes the third identification of the first terminal and the fourth identification of the second terminal, the third The identification is an identification obtained by encrypting the first identification, the fourth identification is an identification obtained by encrypting the second identification, or the first identification information includes one of the first identification and the second identification, and A fifth identity that is obtained by encrypting the other of the first identity and the second identity; after the first server 302 obtains the first identity information from the first terminal device 301, the second signing server 303 is determined, and the first identity The information is sent to the second subscription server 303; the second subscription server 303 receives the first identification information from the first server 302, and sends a first request to the first subscription server 304, where the first request carries the first identification information; the first subscription server 304 After receiving the first request from the second subscription server, it sends a first response to the second subscription server, and the first response carries the first ID and/or the second ID; the second subscription server 303 receives the first response from the first subscription server 304 After a response, obtain second identification information according to the first identification and/or the second identification, and send the second identification information to the first server 302, where the second identification information includes the sixth identification of the first terminal device and the second identification The seventh identity of the terminal device, the sixth identity is the identity obtained by encrypting the first identity, the seventh identity is the identity obtained by encrypting the second identity, or the second identity information includes the first identity and one of the second identifiers, and an eighth identifier obtained by encrypting the other one of the first identifier and the second identifier; the first server 302 sends the second identifier information to the second terminal device 305 .

By encrypting the first identity of the first terminal device and/or the second identity of the second terminal, and using the encrypted first identity and/or the second identity for transmission between the air interface and the core network, avoiding The risk of the first identity identifier and/or the second identity identifier being leaked in the air interface and the core network is avoided, thereby improving security.

The technologies described in the embodiments of this application can be used in various communication systems, such as a fourth-generation (4th generation, 4G) communication system, a 4.5G communication system, a 5G communication system, a system that integrates multiple communication systems, or a communication system that evolves in the future .

It can be understood that the communication system described in the embodiments of the present application is for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and does not constitute a limitation on the technical solutions provided by the embodiments of the present application. The evolution of the architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

The information sending method provided by the embodiments of the present application will be described in detail below. It should be noted that the names of messages between network elements or the names of parameters in the messages in the following embodiments of the present application are just an example, and other names may also be used in specific implementations, which are not specified in the embodiments of the present application. limited. It should also be noted that, in the drawings of the embodiments of the present application, the steps shown in the respective embodiments and the sequence between the steps are used as examples, and do not constitute limitations to the embodiments of the present application. It should be understood that the specific implementation of performing some steps in the figures or the order of adjusting the steps falls within the protection scope of the present application.

Please refer to FIG. 4. FIG. 4 is a schematic flowchart of an information sending method provided by an embodiment of the present application. The execution subject of steps S401-402 is the first terminal device, or a chip in the first terminal device. The execution subject of steps S403 to S404 and step S409 is the first server, or a chip in the first server. The execution subject of step S405 and step S407 to step S408 is the second subscription server, or a chip in the second subscription server. The execution body of step S406 is the first subscription server, or a chip of the first subscription server. The execution body of step S410 is the second terminal device, or a chip of the second terminal device. The following description will be given by taking the first terminal device, the first server, the second subscription server, the first subscription server and the second terminal device as the execution subjects of the information sending method as an example. For convenience of description, in the embodiments of this application, the first terminal device is referred to as UE1, the first server is referred to as I-CSCF2 in the called home domain, the second subscription server is HSS2, the first subscription server is HSS1, and the second terminal device is referred to as Take UE2 as an example. The method may include but is not limited to the following steps:

S401. UE1 determines first identification information.

The first identification information includes the third identification of UE1 and the fourth identification of UE2 (or one of the first identification and the second identification, and the fifth identification). The identity identifier is used to identify the terminal equipment, and it can be a business identity identifier such as a phone number, network voice and video calls, etc. Wherein, the telephone number may be composed of a country code (Country code, CC), (National destination code, NDC) and a subscriber number (Subscribe number, SN). For example, 86 (China country code)+139 (country destination code)+1234 (user number). UE1 is the calling device in the calling home domain, and UE2 is the called device in the called home domain.

In an implementation manner, UE1 has a first identity, and UE2 has a second identity. The third identification is an identification obtained by encrypting the first identification, the fourth identification is an identification obtained by encrypting the second identification, or the first identification information includes one of the first identification and the second identification , and a fifth identity that is obtained by encrypting the other of the first identity and the second identity. The UE1 determines the first identification information according to the first identification and/or the second identification.

The third identity is the identity obtained by encrypting the first identity with the first key, the fourth identity is the identity obtained by encrypting the second identity with the second key, and the fifth identity is the first The other one of the identity identifier and the second identity identifier is an identity identifier obtained by encrypting with the third key.

Optionally, at least one of the first key, the second key, and the third key is the shared key k1 of the first signing server and the first terminal device, and the shared key can be a long-term key K or a Long-term key K and keys derived from other parameters, such as keys generated with random numbers. For example, symmetric encryption is performed on the second identity identifier CC2+NDC2+SN2 of the second terminal device according to the shared key k1, and the obtained fourth identity identifier is CC2+NDC2+Routing indicator (RI)+ciphertext (SN2 removes the route instruct).

Optionally, at least one of the first key, the second key, and the third key is the public key of the home network where the first subscription server is located, obtained by the first terminal device, or a key generated by further derivation with other parameters. key. For example, asymmetric encryption is performed on the second identification CC2+NDC2+SN2 of the second terminal device according to the key generated by deriving the public key and the one-time private key of the home network, and the fourth identification is CC2+NDC2+ protection scheme. Identification (protection scheme ID) + home network public key identification (home public key ID) + elliptic curve cryptography one-time public key (ECC ephemeral public key) + SN2 + message authentication code (MAC), or CC (callee) + NDC ( Callee)+RI+protection scheme ID+home public key ID+ECC ephemeral public key+ciphertext (SN2 removes the routing indication part)+MAC.

Optionally, at least one of the first key, the second key and the third key is a key generated by the first signing server and the first terminal device according to the target algorithm. The key generated by the target algorithm may be a random number generated according to a private algorithm of the first terminal device or the first subscription server.

UE1 generates first identification information according to the third identification and the fourth identification (or one of the first identification and the second identification, and the fifth identification), and the first identification information includes the third identification of UE1 and the fifth identification. The fourth identity of UE2 (or one of the first identity and the second identity, and the fifth identity). The UE1 determines the first identification information, which may be implemented in one of the following ways:

Manner 1: The third identity may be an identity obtained by encrypting the first identity by the HSS1 with the first key, or may be an identity obtained by the first UE1 encrypting the first identity by using the first key. The fourth identity is an identity obtained by UE1 encrypting the second identity with the second key. Manner 2: The first identification information generated by the UE1 includes one of the first identification and the second identification, and a fifth identification obtained by encrypting the other of the first identification and the second identification. Alternatively, the first identification information generated by the UE1 includes one of the first identification and the second identification, and the HSS1 encrypts the other of the first identification and the second identification to obtain a fifth identification. That is to say, the first identification information includes any one of the following: a third identification and a fourth identification, or a fifth identification and a second identification, or a first identification and a fifth identification. By encrypting the first identity identifier and/or the second identity identifier, the risk of the identity identifier being leaked during propagation in the air interface and the core network can be reduced, thereby improving security.

Optionally, the third identity identifier may be an identity identifier obtained by HSS1 encrypting the first identity identifier with a first key, and the fourth identity identifier is an identity identifier obtained by UE1 encrypting the second identity identifier with a second key.

Optionally, the third identity is an identity obtained by UE1 encrypting the first identity with a first key, and the fourth identity is an identity obtained by UE1 encrypting the second identity with a second key. When the UE1 does not receive the third identity sent by the P-CSCF1, the UE1 encrypts the first identity according to the first key, and encrypts the second identity according to the second key. For example, UE1 encrypts the first identity identifier CC1+NDC1+SN1 according to the random number generated by the private algorithm.

Optionally, the fifth identity can be an identity obtained by UE1 encrypting the other one of the first identity and the second identity using a third key, or the fifth identity is HSS1's pairing of the first identity and the second identity. The other one of the two identities uses the third key to encrypt the obtained identities. That is, the UE1 or the HSS1 encrypts any one of the first identity identifier or the second identity identifier.

As shown in Figure 5, the specific steps for HSS1 to encrypt the first identification to obtain the third identification or the fifth identification are as follows:

The UE1 initiates a registration request to the network through the P-CSCF1 and the S-CSCF1, and the registration request carries the user identity.

HSS1 receives the registration request, obtains the first identity according to the user identity, and uses the first key to encrypt the first identity to obtain the third identity or fifth identity, and HSS1 sends a registration response to S-CSCF1, The registration response carries the third identity of UE1 (or the fifth identity of UE1), and the registration response may be SAA.

S-CSCF1 receives the registration response, saves the correspondence between UE1's third identity (or fifth identity) and user identity, P-CSCF1's IP address, and the application server AS address list, and sends 200 OK information to P-CSCF1, The 200OK information carries the correspondence between the third identity identifier and the user identifier.

The third identity (or fifth identity) of the P-CSCF1 to the UE1 is related to the user identity and/or the IP address of the S-CSCF1 and/or the IP address of the UE1 and/or the Internet Protocol Security ((Internet Protocol Security, IPSec) The corresponding relationship of the security association (Security Association, SA) is saved, and 200OK information is sent to the UE1, and the 200OK information can optionally carry the third identity (or fifth identity) of the UE1.

S402: UE1 sends first identification information to the first server.

The first server can be the query call session control function I-CSCF2 of the network where the UE2 is located (the called home domain network), or a routing agent node (Diameter routing agent, DRA) of the network where the UE2 is located, for the convenience of description, abbreviated as DRA2. In the embodiment of the present application, the first server is I-CSCF2 as an example.

As shown in Figure 6, the specific steps for the first terminal device to send the first identification information to the first server are:

UE1 sends a session request to P-CSCF1, where the session request (which may be Invite) carries the first identification information. The first identification information includes a third identification and a fourth identification, or a first identification and a fifth identification, or a second identification and a fifth identification.

P-CSCF1 receives the first identification information, finds the address of S-CSCF1 according to the correspondence between UE1's third identification (or fifth identification) and S-CSCF1, and sends the first identification information or user identification to the S-CSCF1.

Optionally, if the third identity or fifth identity included in the first identification information is generated by HSS1, then P-CSCF1 verifies the binding relationship between the third identity or the fifth identity and the IPSec SA, If the verification is passed, the IP address of the S-CSCF1 is found according to the stored correspondence between the third identity identifier or the fifth identity identifier and the S-CSCF1. If the third identity or fifth identity carried by the first identification information is generated by UE1, then P-CSCF1 finds the first Identity and IP address of S-CSCF1.

The S-CSCF1 saves the third identity (or fifth identity) of the UE1 and the corresponding relationship with the user identity for local verification. Or, if the S-CSCF1 does not store the correspondence between the third identity identifier or the fifth identity identifier and the user identifier, the correspondence relation is sent to the HSS1 for verification.

If the fourth identity (or fifth identity) of UE2 is not in the SIP-URI format, S-CSCF1 sends the fourth identity (or fifth identity) of UE2 to the telephone number mapping server ENUM, and the ENUM server sends the fourth identity (or fifth identity) of UE2 according to the The CC2, NDC2 and RI in the four identities obtain the called home domain name, and obtain the IP address of the first server I-CSCF2 corresponding to the fourth identity (or fifth identity) of UE2 in the called home domain from the DNS server . And return the IP address of I-CSCF2 to S-CSCF1.

The S-CSCF1 sends a session request to the first server I-CSCF2 according to the IP address of the I-CSCF2, where the session request carries the first identification information.

S403: After acquiring the first identification information from the UE1, the first server determines the second subscription server according to at least one of the parameters in the fourth identification of the UE2 (or the fifth identification of the UE2).

The first server I-CSCF2 receives the first identification information from the UE1, and according to at least one of the country code CC2, the national destination code NDC2 and the routing indication RI in the fourth identification of the UE2 or the fifth identification of the UE2, determines the first identification information. 2. The IP address of the subscription server HSS2.

S404. The first server sends the first identification information to HSS2.

As shown in FIG. 7 , the I-CSCF2 sends the first identification information to the HSS2.

S405. HSS2 receives the first identification information from the first server, and sends a first request to HSS1.

As shown in Figure 7, HSS2 receives the first identification information from I-CSCF2, and sends a first request to the Interworking Function (IWF) or Diameter Edge Agent (DEA), where the first request carries the first identification information.

The IWF (or DEA) finds the address of HSS1 according to CC1, NDC1 and/or RI in the third identity (or fifth identity) of UE1, and sends a first request to HSS1. The first request carries the first identification information, and the first request is used to request the first identification and/or the second identification. Specifically, if the first identification information carries a third identification (or a fifth identification) encrypted with the first identification, the first request is used to request the first identification. If the first identification information carries the fourth identification (or the fifth identification) encrypted with the second identification, the first request is used to request the second identification.

S406. After receiving the first request from HSS2, HSS1 sends a first response to HSS2, where the first response carries the first identity and/or the second identity.

As shown in FIG. 7 , HSS1 receives the first request from HSS2 and generates a first response, where the first response carries the first identity and/or the second identity. If the first request carries the first identification information for requesting the first identification, the generated first response carries the first identification. If the first request carries the first identification information for requesting the second identification, the generated first response carries the second identification.

Optionally, when the first identification carries the third identification and the fourth identification, HSS1 uses the first key to decrypt the third identification to obtain the first identification CC1+NDC1+SN1, which is used by the first signing server. The second key decrypts the fourth identity to obtain the second identity CC2+NDC2+SN2. The HSS1 generates the first identification information according to the first identification and the second identification.

When the first identification carries the fifth identification, HSS1 uses the third key to decrypt the fifth identification to obtain the other of the first identification and the second identification. The HSS1 generates the first response according to the first identity or the second identity.

HSS1 sends the first response to the IWF (or DEA).

The IWF (or DEA) sends the first response to HSS2.

S407. After receiving the first response from HSS1, HSS2 obtains the second identification information according to the first identification and/or the second identification.

HSS2 receives the first response sent by HSS1, and encrypts the first identification and/or the second identification to obtain second identification information. The second identification information includes the sixth identification of the first terminal device and the seventh identification of the second terminal device, the sixth identification is the identification obtained by encrypting the first identification, and the seventh identification is the identification of the second identification The identity identifier obtained by identification encryption, or the second identification information includes one of the first identity identifier and the second identity identifier, and an eighth identity identifier obtained by encrypting the other of the first identity identifier and the second identity identifier.

In an implementation manner, the sixth identification is an identification obtained by encrypting the first identification with a fourth key, and the seventh identification is an identification obtained by encrypting the second identification with a fifth key. The eighth identification is an identification obtained by encrypting the other one of the first identification and the second identification using the sixth key.

Optionally, at least one of the fourth key, the fifth key, and the sixth key is the shared key k2 of HSS2 and UE2, and the shared key can be the long-term key K or according to the long-term key K and other Parameter-derived keys, such as keys generated with random numbers. For example, the second identity identifier CC2+NDC2+SN2 is symmetrically encrypted according to the fourth key (shared key k2), and the seventh identity identifier is obtained as CC2+NDC2+Routing indicator (RI)+ciphertext (SN2 removes Routing Instructions section). Encrypting the identity identifier according to the long-term key of UE2 and the key generated by the random number can ensure that the identity identifier obtained by each encryption changes.

Optionally, at least one of the fourth key, the fifth key and the sixth key is the obtained public key of the home network where the second subscription server is located by UE2 or a key generated by further derivation with other parameters. For example, perform asymmetric encryption on UE2's second identity identifier CC2+NDC2+SN2 according to the key derived from the public key of UE2's home network and the one-time private key, and obtain the seventh identity identifier as CC (called)+NDC (Callee)+RI+protection scheme ID+home public key ID+ECC ephemeral public key+ciphertext (SN2 removes the routing indication part)+MAC.

S408. HSS2 sends the second identification information to the first server.

As shown in Figure 8, HSS2 obtains the IP address of S-CSCF2 according to the second identity of UE2, and sends the second identification information and the IP address of S-CSCF2 and/or the random number required for encryption to I-CSCF2 through the response information. CSCF2.

S409: After receiving the second identification information from the HSS2, the first server sends the second identification information and/or the random number required for encryption to the UE2.

As shown in FIG. 8 , the I-CSCF2 receives the second identification information, and forwards the second identification information and/or the random number required for encryption to the S-CSCF2 according to the IP address of the S-CSCF2.

The S-CSCF2 obtains the IP address of the P-CSCF2 according to the correspondence between the seventh identity identifier (or the eighth identity identifier) of the UE2 and the P-CSCF2, and sends the second identification information and/or the random number required for encryption to P-CSCF2.

The P-CSCF2 obtains the IP address of the UE2 according to the correspondence between the seventh identity identifier (or the eighth identity identifier) of the UE2 and the UE2, and sends the second identifier information and/or the random number required for encryption to the UE2.

S410. After receiving the second identification information from the first server, the UE2 decrypts the second identification information to obtain the first identification and/or the second identification.

UE2 uses the fourth key to decrypt the sixth identity to obtain the first identity, uses the seventh key to decrypt the seventh identity to obtain the second identity, or uses the sixth key to decrypt the eighth identity, Obtain the other of the first identity and the second identity. Decrypting the seventh identification of the second terminal device or the eighth identification of the second terminal device to obtain the second identification, and verifying whether the second terminal is the terminal device corresponding to the second identification information according to the second identification is beneficial to The security of the transmission of the second identity identifier in the air interface and the core network is improved.

Optionally, the seventh key is a private key corresponding to the public key (ie, the fifth key) of the UE2. At least one of the fourth key and the sixth key is a shared key between UE2 and HSS2. At least one of the fourth key and the sixth key is a key generated by a long-term key of UE2 and a random number. For example, UE2 uses the fourth key, the seventh key or the sixth key to decrypt the sixth identity identifier to obtain the first identity identifier CC1+NDC1+SN1, and decrypt the seventh identity identifier to obtain the second identity identifier CC2 +NDC2+SN2.

In the embodiment shown in FIG. 4 , by encrypting the first identification of the first terminal device and/or the second identification of the second terminal device, the encrypted first identification and/or the second identification are used. The transmission in the air interface and the core network avoids the risk of the first identity and/or the second identity being leaked in the air interface and the core network, thereby improving security.

The three specific implementations of terminal device registration authentication are described in detail below:

Manner 1: The UE encrypts the first user identifier by using the public key of the home domain network to obtain the second user identifier. The network element Domain Name System (DNS) server, the routing agent node (Diameter routing agent, DRA), and the home subscriber server (Home Subscriber Server, HSS) configure the routing information and the IP addresses of other network elements in the home domain network respectively. corresponding relationship. The UE uses the second user identity to perform the process of registering the identity identity, and the DNS, DRA and HSS address the corresponding network element based on the plaintext routing information in the second user identity. The HSS decrypts the second user identifier, and acquires and saves the correspondence between the second user identifier and the first user identifier. Use the second user ID as the user ID for authentication to complete the ID registration. Wherein, the user identity includes but is not limited to IP multimedia private identity (IP multimedia private Identity, IMPI) and IP multimedia public identity (IP multimedia public identity, IMPU), and the embodiment of this application takes the user identity as IMPI as an example. IMPI is composed of Mobile Country Code (MCC), Mobile Network Code (MNC) and Routing Indicator (RI).

Referring to FIG. 9, the UE encrypts the IMPI using the public key of the home domain network to obtain IMPI* (or IMPI* and RouteInfo). Optionally, the UE encrypts part of the information in the first user identifier, which may be to encrypt the part of the first user identifier IMPI except for the MCC, MNC and RI to obtain the second user identifier IMPI*. For example, the UE newly generates an Eph public and private key pair, the network side public key (public key of HN, HN PubK) and the terminal side private key (Eph Private key of UE, Eph PriK), combined with the terminal side private key and the network side public key, Generate the original key one-time public key key (Eph shared Key) for encryption, and then generate the master key one-time encryption key (Eph enc Key) and one-time message authentication code key (Eph by Eph shared Key deduction) MAC Key). Use Eph enc Key to encrypt the part of the first user identity IMPI except MCC, MNC and RI, and generate the second user identity IMPI* as MCC+MNC+RI+Protection Scheme ID+HN PK ID+scheme output (Scheme Output) (one-time public key (Eph PubK), ciphertext value (ciphertext value), message authentication code (MAC)). The UE may also perform overall encryption of the IMPI. For example, the second user identifier IMPI* generated according to the key is Protection Scheme ID+HN PK ID+Scheme Output(Eph PubK, ciphertext value, MAC). At this time, the MCC, MNC and RI in the second user identity are used as the routing information RouteInfo.

DNS, DRA, and HSS are respectively configured with routing information MCC, MNC and RI in the second user identity, or the corresponding relationship between RouteInfo and each network element address (MCC+MNC+RI/RouteInfo, network element address) is configured. For example, when the UE encrypts part of the information in the first user identity, the corresponding relationship between the DNS configuration routing information and the I-CSCF address is (MCC+MNC+RI, I-CSCF address). The corresponding relationship between the routing information configured by the DRA and the HSS address is (MCC+MNC+RI, HSS address). The corresponding relationship between HSS configuration IMPI, each network element address and related information is (IMPI, S-CSCF address), (IMPI, user registration information (Initial filter criteria, IFC) rule), (IMPI, AS corresponds to user data), Among them, the IFC rules include the application server AS list. When the UE performs overall encryption on the first user identity, the corresponding relationship between the DNS configuration routing information and the I-CSCF address is (RouteInfo, I-CSCF address). The corresponding relationship between the DRA configuration routing information and the HSS address is (RouteInfo, HSS address).

The UE sends a registration Register request to the P-CSCF, where the registration request carries the second user identifier IMPI*, or the second user identifier IMPI* and routing information RouteInfo.

After receiving the registration request, the P-CSCF sends a query request DNS query for querying the address of the I-CSCF to the DNS, and the query request DNS query carries the second user identifier IMPI*, or the second user identifier IMPI* and routing information RouteInfo.

The DNS obtains the I-CSCF address according to the MCC+MNC+RI included in the second user identity (or according to the routing information Route Info), and sends a query response to the P-CSCF, where the query response carries the I-CSCF address.

The P-CSCF receives the query response returned by the DNS and sends a registration request Register to the I-CSCF.

The I-CSCF receives the registration request Register, and sends a user authorization request (which may be a Diameter UAR) to the routing proxy node DRA. The user authorization request carries IMPI*, or IMPI* and RouteInfo.

According to the MCC+MNC+RI contained in the second user identifier in the user authorization request (or according to the routing information Route Info), the DRA queries the corresponding relationship between the routing information and the HSS address (MCC+MNC+RI/RouteInfo, HSS address), and obtains the HSS address.

The DRA sends a user authorization request to the HSS, where the user authorization request carries the second user identifier IMPI*.

The HSS receives the IMPI*, the HSS decrypts the second user identifier IMPI* using the private key of the home network, obtains the first user identifier IMPI, queries and saves the correspondence between the first user identifier and the second user identifier (IMPI*, IMPI), and obtains the S-CSCF address. For example, the UE uses the Eph PubK and HN PriK contained in the second user identity IMPI* to generate the Eph shared Key, and then derives the Eph dec Key and the Eph MAC Key from the Eph shared Key. The HSS uses the Eph dec Key to decrypt the part other than the MCC, MNC and RI in the second user identity to generate IMPI. The HSS obtains the S-CSCF address according to the first user identity. Optionally, after receiving the second user identifier, the HSS determines that the second user identifier is an encrypted user identifier according to information such as the length, structure or included algorithm identifier of the second user identifier, and then decrypts it using the private key of the home network to obtain: The first user ID. The HSS sends a user authentication response (which may be Diameter UAA) to the I-CSCF through the DRA, and the user authentication response carries the S-CSCF address.

The I-CSCF sends a registration request to the S-CSCF according to the received S-CSCF address, and the registration request carries IMPI*.

The S-CSCF sends a multimedia authentication request (which may be Diameter MAR) to the HSS, and the multimedia authentication request carries the second user identity.

The HSS receives the multimedia authentication request, queries and saves the correspondence between the first user identifier and the second user identifier (IMPI*, IMPI) according to IMPI*, obtains the first user identifier IMPI, and calculates the authentication vector for user authentication.

The HSS sends a multimedia authentication response (which may be Diameter MAA) to the S-CSCF, and the multimedia authentication response carries an authentication vector.

The S-CSCF sends unauthorized information (which may be 401 Unauthorized) to the I-CSCF, and the unauthorized information carries IMPI* (or IMPI* and routing information RouteInfo) and authentication vector.

The I-CSCF sends unauthorized information to the P-CSCF, and the unauthorized information carries IMPI* (or IMPI* and routing information RouteInfo) and an authentication vector.

The P-CSCF sends unauthorized information to the UE, and the unauthorized information carries IMPI* (or IMPI* and routing information RouteInfo) and an authentication vector.

The UE receives the unauthorized information, calculates the authentication vector according to the shared key and security algorithm between the UE and the HSS, and generates an authentication response; the UE sends a registration request to the P-CSCF, and the registration request carries IMPI* (or IMPI* and routing information RouteInfo). ), and the authentication response.

After receiving the registration request, the P-CSCF sends a query request for querying the address of the I-CSCF to the DNS. The query request carries IMPI* (or IMPI* and routing information RouteInfo) and an authentication response. The P-CSCF receives the query response returned by the DNS according to the routing information, and the query response carries the address of the I-CSCF; the P-CSCF sends a registration request to the I-CSCF, and the registration request carries IMPI* (or IMPI* and routing information RouteInfo), and the authentication response .

The I-CSCF receives the registration request, obtains the HSS address through the DRA, and sends a user authorization request (which may be a Diameter UAR) to the HSS, and the user authorization request carries the IMPI.

After receiving the IMPI, the HSS queries and saves the correspondence between the first user identifier and the second user identifier (IMPI*, IMPI), obtains the first user identifier IMPI, and obtains the S-CSCF address according to the IMPI.

The HSS sends a user authentication response (which may be Diameter UAA) to the I-CSCF through the DRA, and the user authentication response includes the S-CSCF address.

The I-CSCF sends a registration request to the S-CSCF according to the received S-CSCF address, and the registration request carries the second user identifier and the authentication response.

The S-CSCF verifies the authentication response and completes the registration and authentication of the UE.

After registering and authenticating the UE, the S-CSCF sends a server allocation request (which may be Diameter SAR) to the HSS, and the server allocation request carries the second user identity.

The HSS queries the stored correspondence between the first user ID and the second user ID (IMPI*, IMPI) according to the server allocation request, obtains the first user ID, and obtains the user service registration information IFC rules according to the first user ID. The IFC rules include application The server list AS list is used to decide whether to trigger the application server AS.

The HSS sends a server allocation response (which may be Diameter SAA) to the S-CSCF, and the server allocation response carries the IFC rules (including the AS list).

The S-CSCF saves the correspondence between the second user identifier IMPI*, the P-CSCF address, and the IFC rules (including the AS list), and obtains the IFC rules (including the AS list).

The S-CSCF sends a 200 OK message to the I-CSCF.

The I-CSCF sends a 200 OK message to the P-CSCF.

The P-CSCF saves the correspondence between the second user identity, the UE address, the S-CSCF address, and the Internet Protocol security IPSec link; and sends a 200 OK message to the UE. Thus, a session connection between the S-CSCF and the UE is established.

The S-CSCF sends a registration request Register to the AS according to the server list AS list in the saved IFC rules, and the registration request carries the second user identifier.

The AS sends a registration request to the HSS with the first user identifier IMPI, and the registration request carries the second user identifier IMPI*.

The HSS obtains the first user identifier IMPI according to the second user identifier IMPI* query (IMPI*, IMPI) carried in the registration request, and then returns the first user identifier to the AS.

The AS receives the first user identifier IMPI sent by the HSS, obtains user data corresponding to the AS, and sends a 200OK message to the S-CSCF, where the 200OK message carries the user data. Thereby, the connection between the inside of the network is established, and the authentication of the identity of the terminal device is completed.

In the embodiment shown in FIG. 9 , the terminal device encrypts the first user identifier by using the public key of the home domain network to obtain the second user identifier, and retains the routing information as plaintext. In the identity registration process, each network element addresses the corresponding next-hop network element according to the routing information in the second user identity. The subscription server decrypts the second user identifier using the private key of the home network, and saves the correspondence between the second user identifier and the first user identifier. In the subsequent registration process, both the terminal device and each network element use the encrypted second user identifier, which avoids leakage of the user identifier during transmission over the air interface and each network element, thereby improving security.

Manner 2: After the S-CSCF verifies the authentication response and completes the registration authentication of the UE, the S-CSCF or the HSS generates a third user identifier T-IMPI corresponding to the first user identifier and the second user identifier. The HSS stores the correspondence between the third user identifier and the first user identifier (T-IMPI, IMPI), which is used to deliver the T-IMPI to the UE during the information transmission process, and the UE receives and stores the T-IMPI. Specific steps are as follows:

As shown in Figure 10, the UE encrypts the first user identifier IMPI to generate the second user identifier IMPI*, the HSS decrypts the IMPI* to obtain the IMPI, and saves the correspondence between the first user identifier and the second user identifier (IMPI*, IMPI ), the HSS generates an authentication vector, and the steps and methods for the UE to return an authentication response, refer to the above-mentioned method 1 about the UE encrypting the IMPI to generate IMPI*, and the HSS decrypts the IMPI* to obtain the IMPI, and saves the corresponding relationship (IMPI*, IMPI), The HSS generates the authentication vector, and the UE returns the description of the authentication response, which will not be repeated here.

The S-CSCF verifies the authentication response, and after completing the registration and authentication of the UE, the S-CSCF generates a third user identity T-IMPI, or the HSS generates a third user identity T-IMPI. The specific steps are ①, ②:

① The S-CSCF verifies the authentication response, and after completing the registration and authentication of the UE, the S-CSCF generates a third user identity T-IMPI. The S-CSCF stores the correspondence between the third user identifier T-IMPI and the second user identifier IMPI* (T-IMPI, IMPI*). The S-CSCF sends a server allocation request to the HSS, and the server allocation request carries the third user identifier T-IMPI and the second user identifier IMPI*.

The HSS obtains the first user identity IMPI according to the corresponding relationship (T-IMPI, IMPI*), saves the corresponding relationship (T-IMPI, IMPI) between the third user identity T-IMPI and the first user identity IMPI, and according to the first user identity IMPI Identify IMPI to obtain user registration information (Initial Filter Criteria, IFC) rules, the IFC rules include the application server list AS list.

② The S-CSCF verifies the authentication response, and after completing the registration authentication for the UE, the S-CSCF sends a server allocation request to the HSS, and the server allocation request carries the second user identifier IMPI*.

According to the corresponding relationship (IMPI*, IMPI) between the second user identifier IMPI* and the first user identifier IMPI, the HSS obtains the first user identifier IMPI, generates the third user identifier T-IMPI, and saves the third user identifier T-IMPI and The first user identifies the corresponding relationship of the IMPI (T-IMPI, IMPI). Obtain the IFC rules according to IMPI, and the IFC rules include the application server list AS list.

The T-IMPI includes routing information such as MCC, MNC, and RI. Optionally, the T-IMPI may be generated based on the routing information RouteInfo and the encrypted part in the second user identifier IMPI*. Alternatively, the T-IMPI may be generated based on the routing information RouteInfo in the second user identity IMPI* and a randomly generated character string. Optionally, the T-IMPI may also be generated by the HSS based on the routing information and the remainder in the first user identity IMPI; or, the T-IMPI may be a character string randomly generated by the HSS based on the routing information in the first user identity IMPI and the remainder. or the T-IMPI may be generated based on other methods, which is not limited in the present invention.

The HSS sends the server allocation response Diameter SAA to the S-CSCF, and the server allocation response Diameter SAA carries the IFC rules (including the AS list) and the third user identity T-IMPI.

The S-CSCF saves the correspondence between the third user identifier T-IMPI, the P-CSCF address, and the IFC rules (including the AS list) (T-IMPI, P-CSCF IP, IFC rules (including the AS list)).

The S-CSCF sends a 200 OK message to the I-CSCF, and the 200 OK message carries the T-IMPI.

The I-CSCF sends a 200 OK message to the P-CSCF, and the 200 OK message carries the T-IMPI.

The P-CSCF maintains the correspondence between the third user identity and/or the UE address and/or the S-CSCF address and/or the Internet Protocol secure IPSec link (T-IMPI and/or UE IP and/or S-CSCF IP and/or IPSec link); send 200 OK information to the UE, optionally, the 200 OK information carries the third user identity T-IMPI. Thus, a session connection between the S-CSCF and the UE is established.

The UE saves the T-IMPI.

In the embodiment shown in FIG. 10 , after completing the registration and authentication of the UE, the S-CSCF or the HSS generates a third user identity corresponding to the first user identity or the second user identity, and uses the third user identity as a temporary user identity It is issued to the UE for subsequent registration by the UE using the third user identifier, which can avoid the need to encrypt and decrypt the first user identifier or the second user identifier again in the subsequent registration process, thereby improving information sending efficiency.

Mode 3: As shown in Figure 11, when the UE registers for the first time, the HSS generates a third user identity T-IMPI, and saves the correspondence between the third user identity T-IMPI and the first user identity IMPI (T-IMPI, IMPI), The HSS sends the third user identity T-IMPI to the UE, and the third user identity T-IMPI is used as the user identity in the subsequent UE registration process. The specific method is as follows:

The UE sends a registration request to the P-CSCF, where the registration request carries the third user identity T-IMPI.

After receiving the registration request, the P-CSCF sends a query request for querying the address of the I-CSCF to the DNS. The query request carries the third user identifier, receives the query response returned by the DNS and carries the address of the I-CSCF, and sends the registration request to the I-CSCF. ask.

The I-CSCF receives the registration request, and sends a user authorization request to the DRA, carrying the third user identifier T-IMPI.

The DRA obtains the HSS address according to the routing information of the third user identifier in the user authorization request, and sends the user authorization request to the HSS, carrying the T-IMPI.

The HSS receives the user authorization request, obtains the first user identifier IMPI according to the correspondence between the third user identifier T-IMPI and the first user identifier IMPI (T-IMPI, IMPI), and obtains the S-CSCF address according to the first user identifier.

The HSS sends a user authentication response to the I-CSCF through the DRA, and the user authentication response carries the S-CSCF address. The HSS receives the multimedia authentication request from the S-CSCF, queries and saves the correspondence between the third user identifier and the first user identifier (T-IMPI, IMPI) according to the T-IMPI, obtains the first user identifier IMPI, and calculates the IMPI for the user Authentication vector for authentication. The unauthorized information carrying the T-IMPI and the authentication vector is sent to the UE through each network element.

The UE calculates the authentication vector according to the shared key and security algorithm of the UE and the HSS, generates an authentication response, and sends a user authorization request to the HSS through the I-CSCF, and the user authorization request carries the T-IMPI.

The HSS receives the user authorization request, obtains the first user identifier IMPI according to the correspondence between the third user identifier T-IMPI and the first user identifier IMPI (T-IMPI, IMPI), and obtains the S-CSCF address according to the IMPI.

The HSS sends a user authentication response to the I-CSCF through the DRA, and the user authentication response carries the S-CSCF address.

The I-CSCF sends a registration request to the S-CSCF according to the received S-CSCF address, and the registration request carries the T-IMPI and the authentication response.

After authenticating the UE, the S-CSCF sends a server allocation request to the HSS, and the server allocation request carries the T-IMPI.

The HSS queries the stored correspondence between the first user identifier and the third user identifier (T-IMPI, IMPI) according to the server allocation request, and obtains the first user identifier. The user registration information (Initial Filter Criteria, IFC) rule is obtained according to the first user identifier, and the IFC rule includes the application server list AS list.

The HSS sends the server allocation response Diameter SAA to the S-CSCF, and the server allocation response Diameter SAA includes the IFC rules (including the AS list).

The S-CSCF saves the correspondence between the third user identity, the P-CSCF address, and the IFC rules (including the AS list), and obtains the IFC rules (including the AS list).

The S-CSCF sends a 200 OK message to the I-CSCF.

The I-CSCF sends a 200 OK message to the P-CSCF.

The P-CSCF sends a 200 OK message to the UE, thereby establishing a session connection between the S-CSCF and the UE.

The S-CSCF sends a registration request to the AS according to the server list AS list in the saved IFC rules, and the registration request carries the T-IMPI.

The AS requests the HSS for the first user identity.

The HSS queries the correspondence between the third user identifier and the first user identifier (T-IMPI, IMPI) according to the T-IMPI included in the request, obtains the first user identifier, and then returns the first user identifier to the AS.

The AS receives the first user identifier sent by the HSS, obtains user data corresponding to the AS, and sends a 200OK message to the S-CSCF, where the 200OK message carries the user data. Thereby, the connection between the inside of the network is established, and the registration of the identity of the terminal device is completed.

In the embodiment shown in FIG. 11 , in the process of terminal device registration and authentication, the third user identifier is used as the user identifier, and the HSS obtains the first user identifier according to the corresponding relationship between the third user identifier and the first user identifier, avoiding the need for The process of encrypting and decrypting the first user identifier can improve the information sending efficiency.

The communication apparatus shown in FIG. 12 may be used to execute part or all of the functions of the second subscription server in the method embodiments described in the foregoing FIG. 4 to FIG. 11 . Wherein, the communication device may also be a chip system. The communication apparatus shown in FIG. 12 may include a communication unit 1201 and a processing unit 1202 . The communication unit 1201 is used to implement the sending and receiving operations of the second subscription server in the above information sending method of this application; the processing unit 1202 is used to implement the data processing function of the second subscription server in the above information sending method of this application.

The communication apparatus shown in FIG. 12 may be used to execute part or all of the functions of the first subscription server in the method embodiments described in the foregoing FIG. 4 to FIG. 11 . Wherein, the communication device may also be a chip system. The communication apparatus shown in FIG. 12 may include a communication unit 1201 and a processing unit 1202. The communication unit 1201 is used to implement the sending and receiving operations of the first subscription server in the above information sending method of this application; the processing unit 1202 is used to implement the data processing function of the first subscription server in the above information sending method of this application.

The communication apparatus shown in FIG. 12 may be used to execute part or all of the functions of the first server in the method embodiments described in the foregoing FIG. 4 to FIG. 11 . Wherein, the communication device may also be a chip system. The communication apparatus shown in FIG. 12 may include a communication unit 1201 and a processing unit 1202 . The communication unit 1201 is used to implement the sending and receiving operation of the first server in the above information sending method of the present application; the processing unit 1202 is used to implement the data processing function of the first server in the above information sending method of the present application.

The communication apparatus shown in FIG. 12 may be used to execute part or all of the functions of the first terminal device in the method embodiments described in the foregoing FIG. 4 to FIG. 11 . Wherein, the communication device may also be a chip system. The communication apparatus shown in FIG. 12 may include a communication unit 1201 and a processing unit 1202 . The communication unit 1201 is used to implement the sending and receiving operation of the first terminal device in the above information sending method of the present application; the processing unit 1202 is used to implement the data processing function of the first terminal device in the above information sending method of the present application.

The communication apparatus shown in FIG. 12 may be used to execute part or all of the functions of the second terminal device in the method embodiments described in FIG. 4 to FIG. 11 . Wherein, the communication device may also be a chip system. The communication apparatus shown in FIG. 12 may include a communication unit 1201 and a processing unit 1202 . The communication unit 1201 is used to implement the transceiving operation of the second terminal device in the above information sending method of the present application; the processing unit 1202 is used to implement the data processing function of the second terminal device in the above information sending method of the present application.

As shown in FIG. 13, a communication apparatus 1300 provided by an embodiment of the present application is used to implement the second subscription server, or the first server, or the first subscription server, or the function of the first terminal device, or the second terminal device; or the apparatus may be an apparatus for the second subscription server, or the first server, or the first subscription server, or the first terminal device, or the second terminal device . The means for the second subscription server may be a system-on-chip or a chip within the second subscription server. The means for the first server may be a system-on-a-chip or a chip within the first server. The means for the first subscription server may be a chip system or chip within the first subscription server. The means for the first terminal device may be a chip system or a chip in the first terminal device. The means for the second terminal device may be a system-on-a-chip or a chip in the second terminal device. Wherein, the chip system may be composed of chips, and may also include chips and other discrete devices.

The communication device 1300 includes at least one processor 1302 for implementing the data processing function of the second subscription server in the above information sending method of the present application; or for realizing the data processing function of the first server in the above information sending method of the present application; Or used to realize the data processing function of the first subscription server in the above information sending method of this application; or used to implement the data processing function of the first terminal device in the above information sending method of this application; or used to implement the above information of this application The data processing function of the second terminal device in the sending method.

The apparatus 1300 may further include a communication interface 1301 for implementing the sending and receiving operations of the second subscription server in the above information sending method of the present application; or for realizing the sending and receiving operations of the first server in the above information sending method of the present application; or for Realize the sending and receiving operation of the first subscription server in the above information sending method of the present application; or be used to realize the sending and receiving operation of the first terminal device in the above information sending method of the present application; or be used to realize the first in the above information sending method of the present application. Two terminal equipment send and receive operations.

In this embodiment of the present application, the communication interface may be a transceiver, a circuit, a bus, a module or other types of communication interfaces, which are used to communicate with other devices through a transmission medium. For example, the communication interface 1301 is used by the apparatus in the apparatus 1300 to communicate with other devices. The processor 1302 uses the communication interface 1301 to send and receive data, and is used to implement the methods of the above method embodiments.

The apparatus 1300 may also include at least one memory 1303 for storing program instructions and/or data. Memory 1303 and processor 1302 are coupled. The coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules. The processor 1302 may cooperate with the memory 1303 . The processor 1302 may execute program instructions stored in the memory 1303 . At least one of the at least one memory may be included in the processor.

The specific connection medium between the communication interface 1301 , the processor 1302 , and the memory 1303 is not limited in the embodiments of the present application. In the embodiment of the present application, the memory 1303, the processor 1302, and the communication interface 1301 are connected by a bus 1304 in FIG. 13. The bus is represented by a thick line in FIG. 13, and the connection between other components is only for schematic illustration. , is not limited. The bus can be divided into address bus, data bus, control bus and so on. For ease of presentation, only one thick line is used in FIG. 13, but it does not mean that there is only one bus or one type of bus.

When the device 1300 is specifically a device used for a station, a first station, a second station or an access point, for example, when the device 1300 is a chip or a chip system, the communication interface 1301 may output or receive baseband signals. When the apparatus 1300 is specifically a station, a first station, a second station or an access point, the output or reception of the communication interface 1301 may be a radio frequency signal. In this embodiment of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, which can implement or The methods, steps and logic block diagrams disclosed in the embodiments of this application are executed. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.

As an example, FIG. 14 is a schematic structural diagram of another communication apparatus 1400 provided by an embodiment of the present application. The communication apparatus 1400 may be a second subscription server, or a first server, or a first subscription server, or a first terminal device, or a second terminal device. The communication apparatus 1400 may perform the operations performed by the second subscription server, or the first server, or the first subscription server, or the first terminal device, or the second terminal device in the foregoing method embodiments.

For convenience of explanation, FIG. 14 only shows the main components of the communication device 1400 . As shown in FIG. 14, the communication device 1400 includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device. The processor is mainly used to process the communication protocol and communication data, control the entire communication device 1400, execute software programs, and process data of the software programs, for example, to support the communication device 1400 to execute the flow described in FIG. 4-FIG. 11 . The memory is mainly used to store software programs and data. The radio frequency circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal. Antennas are mainly used to send and receive radio frequency signals in the form of electromagnetic waves. The communication device 1400 may also include an input and output device, such as a touch screen, a display screen, a keyboard, etc., which are mainly used for receiving data input by the user and outputting data to the user. It should be noted that some types of communication devices 1400 may not have an input/output device.

After the communication device 1400 is powered on, the processor can read the software program in the storage unit, interpret and execute the software program, and process the data of the software program. When data needs to be sent wirelessly, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit. The radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal through the antenna in the form of electromagnetic waves. When data is sent to the communication device 1400, the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data .

Those skilled in the art can understand that, for the convenience of description, FIG. 14 only shows one memory and one processor. In an actual communication device 1400, there may be multiple processors and memories. The memory may also be referred to as a storage medium or a storage device, etc., which is not limited in this embodiment of the present application.

As an optional implementation manner, the processor may include a baseband processor and a central processing unit (CPU). The baseband processor is mainly used to process communication protocols and communication data, and the CPU is mainly used to process the entire communication The apparatus 1400 controls, executes a software program, and processes data of the software program. Optionally, the processor may also be a network processor (NP) or a combination of CPU and NP. The processor may further include a hardware chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (programmale logic device, PLD) or a combination thereof. The above PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination thereof. The memory may include volatile memory (volatile memory), such as random-access memory (RAM); the memory may also include non-volatile memory (non-volatile memory), such as flash memory (flash memory) , a hard disk drive (HDD) or a solid-state drive (SSD); the memory may also include a combination of the above-mentioned types of memory.

Exemplarily, in this embodiment of the present application, as shown in FIG. 14 , an antenna and a radio frequency circuit with a transceiver function can be regarded as the communication unit 1401 of the communication device 1400 , and a processor with a processing function can be regarded as a part of the communication device 1400 . Processing unit 1402.

The communication unit 1401 may also be referred to as a transceiver, a transceiver, a transceiver device, a transceiver unit, etc., and is used to implement a transceiver function. Optionally, the device for implementing the receiving function in the communication unit 1401 may be regarded as a receiving unit, and the device for implementing the transmitting function in the communication unit 1401 may be regarded as a transmitting unit, that is, the communication unit 1401 includes a receiving unit and a transmitting unit. Exemplarily, the receiving unit may also be referred to as a receiver, a receiver, a receiving circuit, and the like, and the transmitting unit may be referred to as a transmitter, a transmitter, or a transmitting circuit, or the like.

In some embodiments, the communication unit 1401 and the processing unit 1402 may be integrated into one device or separated into different devices. In addition, the processor and the memory may also be integrated into one device or separated into different devices.

The communication unit 1401 may be configured to perform the transceiving operations of the communication apparatus 1400 in the above method embodiments. The processing unit 1402 may be configured to perform data processing operations of the communication apparatus 1400 in the above method embodiments.

Embodiments of the present application further provide a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is executed on a processor, the method flow of the foregoing method embodiment is implemented.

The embodiment of the present application further provides a computer program product, when the computer program product runs on the processor, the method flow of the above method embodiment is realized.

It should be noted that, for the sake of simple description, the foregoing method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Because in accordance with the present application, certain operations may be performed in other orders or concurrently. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

The descriptions of the embodiments provided in this application may refer to each other, and the descriptions of the various embodiments have their own emphasis. For the parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments. For the convenience and brevity of description, for example, regarding the functions and operations of each device and device provided in the embodiments of the present application, reference may be made to the related descriptions of the method embodiments of the present application, and also between the method embodiments and the device embodiments. There may be mutual reference, combination or reference.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features thereof can be equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the embodiments of the present application. scope.

Claims

A method for sending information, characterized in that the method is applied to a communication system including a first terminal device and a second terminal device; the communication system further includes a first subscription server corresponding to the first terminal device and the A second subscription server corresponding to a second terminal device, the first terminal device has a first identity, the second terminal device has a second identity, the first terminal is a communication calling party, the first Two terminal devices are called parties of communication; the method includes:

The second subscription server receives first identification information from the first server, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal, the third identification The identifier is the identity identifier obtained by encrypting the first identifier, the fourth identifier is the identifier obtained by encrypting the second identifier, or the first identifier information includes the first identifier and the second identifier. One of the identification marks, and the fifth identification mark obtained by encrypting the other of the first identification mark and the second identification mark;

The second subscription server sends a first request to the first subscription server, where the first request carries the first identification information; the first request is used to request the first identification and/or the first identification second identification;

the second subscription server receives a first response from the first subscription server; the first response carries the first identity and/or the second identity;

The second subscription server obtains second identification information according to the first identification and/or the second identification, and the second identification information includes the sixth identification of the first terminal device and the second terminal The seventh identity of the device, the sixth identity is the identity obtained by encrypting the first identity, the seventh identity is the identity obtained by encrypting the second identity, or the second identity The identification information includes one of the first identification and the second identification, and an eighth identification obtained by encrypting the other of the first identification and the second identification;

The second subscription server sends the second identification information to the first server.
The method according to claim 1, wherein the sixth identity is an identity obtained by encrypting the first identity with a fourth key, and the seventh identity is an identity of the second The identity identifier is an identity identifier obtained by encrypting the fifth key, and the eighth identity identifier is an identity identifier obtained by encrypting the other one of the first identity identifier and the second identity identifier using the sixth key.
The method according to claim 2, wherein the fifth key is a public key of the second terminal device.
A method for sending information, characterized in that the method is applied to a communication system including a first terminal device and a second terminal device; the communication system further includes a second subscription server corresponding to the second terminal device, the The first terminal device has a first identity identifier, the second terminal device has a second identity identifier, the first terminal device is a communication calling party, and the second terminal device is a communication called party; the method includes :

The first server acquires first identification information from the first terminal device, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal device, the third identification The identifier is the identity identifier obtained by encrypting the first identifier, the fourth identifier is the identifier obtained by encrypting the second identifier, or the first identifier information includes the first identifier and the second identifier. One of the identification marks, and the fifth identification mark obtained by encrypting the other of the first identification mark and the second identification mark;

The first server determines the second subscription server according to at least one of the parameters in the fourth identity of the second terminal device, and the parameters include a country code and a country purpose code, or include a country code, a country destination codes and routing instructions;

The first server sends the first identification information to the second subscription server.
The method according to claim 4, wherein the method further comprises:

The first server receives second identification information from the second signing server, the second identification information includes the sixth identification of the first terminal device and the seventh identification of the second terminal device, the first The six identifications are the identifications obtained by encrypting the first identifications, the seventh identifications are the identifications obtained by encrypting the second identifications, or the second identification information includes the first identifications and the One of the second identifications, and an eighth identification obtained by encrypting the other of the first identification and the second identification;

The first server sends the second identification information to the second terminal device.
A method for sending information, characterized in that the method is applied to a communication system including a first terminal device and a second terminal device; the communication system further includes a first subscription server corresponding to the first terminal device and the A second subscription server corresponding to a second terminal device, the first terminal device has a first identity, the second terminal device has a second identity, the first terminal is a communication calling party, the first Two terminal devices are called parties of communication; the method includes:

The first subscription server receives a first request from the second subscription server, where the first request is used to request the first identity and/or the second identity, and the first request carries the first Identification information, the first identification information includes the third identification of the first terminal device and the fourth identification of the second terminal device, and the third identification is an identity obtained by encrypting the first identification ID, the fourth ID is the ID obtained by encrypting the second ID, or the first ID information includes one of the first ID and the second ID, and the first ID The fifth identity mark obtained by another encryption in the mark and the second identity mark;

The first subscription server sends a first response to the second subscription server, where the first response carries the first identity and/or the second identity.
The method according to claim 6, wherein the method further comprises:

The first signing server uses the first key to decrypt the third identity to obtain the first identity, and/or the first signing server uses the second key to decrypt the fourth identity Decryption is performed to obtain the second identification, or the first signing server decrypts the fifth identification using a third key to obtain the other of the first identification and the second identification.
A method for sending information, characterized in that the method is applied to a communication system including a first terminal device and a second terminal device; the first terminal device has a first identity, and the second terminal device has a second identification, the first terminal device is the calling party of the communication, and the second terminal device is the called party of the communication; the method includes:

The first terminal device determines first identification information, the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal device, and the third identification is for all The identity mark obtained by encrypting the first identity mark, the fourth identity mark is the identity mark obtained by encrypting the second identity mark, or the first identification information includes the first identity mark and the second identity mark. One, and the fifth identity that is obtained by encrypting the other in the first identity and the second identity;

The first terminal device sends the first identification information to the first server.
The method according to any one of claims 1 to 8, wherein the third identity is an identity obtained by encrypting the first identity with a first key, and the fourth identity is The identity mark obtained by encrypting the second identity mark with the second key, and the fifth identity mark is the identity obtained by encrypting the other one of the first identity mark and the second identity mark with the third key logo.
The method according to any one of claims 1 to 9, wherein the fourth identity is an identity obtained by encrypting the second identity by the first terminal device with a second key;

The third identity is an identity obtained by the first terminal device using a first key to encrypt the first identity; or, the third identity is the corresponding to the first terminal. The first signing server encrypts the first identification with an identification obtained by encrypting the first key.
The method according to any one of claims 1 to 10, wherein the fifth identification is that the first terminal device uses a third identification for the other of the first identification and the second identification The identity identifier obtained by key encryption, or the fifth identity identifier is that the first signing server corresponding to the first terminal device uses a third encryption key for the other of the first identity identifier and the second identity identifier. The identity ID obtained by encryption key.
The method according to claim 7 and any one of claims 9 to 11, wherein at least one of the first key, the second key and the third key is the first signing server and the the shared key of the first terminal device;

Or, at least one of the first key, the second key and the third key is a key generated by the first signing server according to the long-term key and the random number of the first terminal device;

Alternatively, at least one of the first key, the second key and the third key is a key generated by the first signing server and the first terminal device according to a target algorithm.
A method for sending information, characterized in that the method is applied to a communication system including a first terminal device and a second terminal device; the first terminal device has a first identity, and the second terminal device has a second identification, the first terminal device is the calling party of the communication, and the second terminal device is the called party of the communication; the method includes:

The second terminal device receives second identification information from the first server, where the second identification information includes a sixth identification of the first terminal device and a seventh identification of the second terminal device, the sixth identification The identifier is an identity identifier obtained by encrypting the first identity identifier, and the seventh identifier is an identity identifier obtained by encrypting the second identifier, or the second identifier information includes the first identifier and the second identifier. One of the identification marks, and the eighth identification mark obtained by encrypting the other of the first identification mark and the second identification mark;

The second terminal device decrypts the second identification information to obtain the first identification and/or the second identification.
The method according to claim 13, wherein the second terminal device decrypts the second identification information to obtain the first identification and/or the second identification, comprising:

The second terminal device uses the fourth key to decrypt the sixth identity to obtain the first identity, and uses the seventh key to decrypt the seventh identity to obtain the second identity, Or use the sixth key to decrypt the eighth identification to obtain the other of the first identification and the second identification.
The method according to claim 14, wherein the seventh key is a private key corresponding to the public key of the second terminal device.
The method according to any one of claim 2 and claim 14, wherein at least one of the fourth key, the fifth key and the sixth key is the second signing server and the the shared key of the second terminal device;

Alternatively, at least one of the fourth key, the fifth key and the sixth key is a key generated by a long-term key of the second terminal device and a random number.
The method according to any one of claims 1 to 16, wherein the first server is a query call session control function of the network where the second terminal device is located, or is a function of the query call session control function of the network where the second terminal device is located. Routing proxy node.
An information sending apparatus, characterized in that the information sending apparatus is applied to a second subscription server corresponding to a second terminal device, the second subscription server is included in a communication system, and the communication system further includes a first subscription server. A terminal device, a second terminal device, and a first subscription server corresponding to the first terminal device; the first terminal device has a first identity, the second terminal has a second identity, and the first terminal The device is a communication calling party, the second terminal device is a communication called party, and the information sending device includes:

a communication unit, configured to receive first identification information from a first server, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal, and the third identification The identity is an identity obtained by encrypting the first identity, the fourth identity is an identity obtained by encrypting the second identity, or the first identity information includes the first identity and the first identity. One of the two identifications, and a fifth identification obtained by encrypting the other of the first identification and the second identification;

The communication unit is further configured to send a first request to the first subscription server, where the first request carries the first identification information; the first request is used to request the first identification and/or the second identity identifier;

The communication unit is further configured to receive a first response from the first subscription server; the first response carries the first identity and/or the second identity;

A processing unit, configured to obtain second identification information according to the first identification and/or the second identification, where the second identification information includes the sixth identification of the first terminal device and the second identification of the second terminal device The seventh identity is the identity obtained by encrypting the first identity, the seventh identity is the identity obtained by encrypting the second identity, or the second identity The information includes one of the first identification and the second identification, and an eighth identification obtained by encrypting the other of the first identification and the second identification;

The communication unit is further configured to send the second identification information to the first server.
The device according to claim 18, wherein the sixth identity is an identity obtained by encrypting the first identity with a fourth key, and the seventh identity is an identity of the second The identity identifier is an identity identifier obtained by encrypting the fifth key, and the eighth identity identifier is an identity identifier obtained by encrypting the other one of the first identity identifier and the second identity identifier using the sixth key.
The apparatus according to claim 19, wherein the fifth key is a public key of the second terminal device.
An information sending apparatus, characterized in that, the information sending apparatus is applied in a first server, and the apparatus includes:

a processing unit, configured to obtain the first identification information from the first terminal device;

The first terminal device is included in a communication system, and the communication system further includes a second terminal device and a second subscription server corresponding to the second terminal device; the first terminal device has a first identity, the The second terminal device has a second identity, the first terminal device is the calling party of the communication, and the second terminal device is the called party of the communication;

The first identification information includes the third identification of the first terminal device and the fourth identification of the second terminal, and the third identification is an identification obtained by encrypting the first identification, so The fourth identification is an identification obtained by encrypting the second identification, or the first identification information includes one of the first identification and the second identification, and the first identification and the second identification. A fifth identity identity obtained by encryption from another of the two identity identifiers;

The processing unit is further configured to determine the second subscription server according to at least one of the parameters in the fourth identity of the second terminal device, where the parameters include a country code and a country purpose code, or include a country code, country destination code and routing instructions;

A communication unit, configured to send the first identification information to the second subscription server.
The device of claim 21, wherein:

The communication unit is further configured to receive second identification information from the second subscription server, where the second identification information includes the sixth identification of the first terminal device and the seventh identification of the second terminal device, The sixth identification is an identification obtained by encrypting the first identification, the seventh identification is an identification obtained by encrypting the second identification, or the second identification information includes the first identification. One of the identity mark and the second identity mark, and the eighth identity mark obtained by encrypting the other of the first identity mark and the second identity mark;

The communication unit is further configured to send the second identification information to the second terminal device.
An information sending apparatus, characterized in that the information sending apparatus is applied in a first subscription server corresponding to a first terminal device, and the first subscription server corresponding to the first terminal device is included in a communication system, and the communication The system further includes the first terminal device, the second terminal device, and a second subscription server corresponding to the second terminal device, the first terminal device has a first identity, and the second terminal device has a second identity identification, the first terminal device is a communication calling party, and the second terminal device is a communication called party; the apparatus includes:

A communication unit, configured to receive a first request from the second subscription server, where the first request is used to request the first identity and/or the second identity, and the first request carries the first identity information, the first identification information includes the third identification of the first terminal device and the fourth identification of the second terminal, and the third identification is the identification obtained by encrypting the first identification , the fourth identification is an identification obtained by encrypting the second identification, or the first identification information includes one of the first identification and the second identification, and the first identification and another encrypted fifth identification in the second identification;

The communication unit is further configured to send a first response to the second subscription server, where the first response carries the first identity and/or the second identity.
The apparatus of claim 23, wherein the apparatus further comprises:

A processing unit, configured to decrypt the third identity by using the first key to obtain the first identity, and/or the first signing server uses the second key to perform decryption on the fourth identity Decryption to obtain the second identification, or the first signing server decrypts the fifth identification using a third key to obtain the other of the first identification and the second identification.
An information sending apparatus, characterized in that the information sending apparatus is applied to a first terminal device, the first terminal device is included in a communication system, and the communication system further includes a second terminal device; the first terminal device The terminal equipment has a first identity identifier, the second terminal equipment has a second identity identifier, the first terminal equipment is a communication calling party, and the second terminal equipment is a communication called party; the apparatus includes:

a processing unit, configured to determine first identification information, where the first identification information includes a third identification of the first terminal device and a fourth identification of the second terminal, and the third identification is for the The identity mark obtained by encrypting the first identity mark, the fourth identity mark is the identity mark obtained by encrypting the second identity mark, or the first identification information includes one of the first identity mark and the second identity mark , and the fifth identity that is obtained by encrypting another of the first identity and the second identity;

A communication unit, configured to send the first identification information to the first server.
The device according to any one of claims 18 to 25, wherein the third identity is an identity obtained by encrypting the first identity with a first key, and the fourth identity is The identity mark obtained by encrypting the second identity mark with the second key, and the fifth identity mark is the identity obtained by encrypting the other one of the first identity mark and the second identity mark with the third key logo.
The apparatus according to any one of claims 18 to 26, wherein the fourth identity is an identity obtained by encrypting the second identity by the first terminal device with a second key;

The third identity is an identity obtained by the first terminal device using a first key to encrypt the first identity; or, the third identity is the corresponding to the first terminal. The first signing server encrypts the first identification with an identification obtained by encrypting the first key.
The apparatus according to any one of claims 18 to 27, wherein the fifth identity is that the first terminal device uses a third identity for the other of the first identity and the second identity The identity identifier obtained by key encryption, or the fifth identity identifier is that the first signing server corresponding to the first terminal device uses a third encryption key for the other of the first identity identifier and the second identity identifier. The identity ID obtained by encryption key.
The apparatus according to claim 24 or any one of claims 26 to 28, wherein at least one of the first key, the second key and the third key is the first signing server a shared key with the first terminal device;

Or, at least one of the first key, the second key and the third key is a key generated by the first signing server according to the long-term key and the random number of the first terminal device;

Or, at least one of the first key, the second key and the third key is a key generated by the first signing server and the first terminal device according to a target algorithm.
An information sending apparatus, characterized in that the information sending apparatus is applied in a second terminal device, the second terminal device is included in a communication system, and the communication system further includes a first terminal device; the first terminal device The terminal equipment has a first identity identifier, the second terminal equipment has a second identity identifier, the first terminal equipment is a communication calling party, and the second terminal equipment is a communication called party; the apparatus includes:

a communication unit, configured to receive second identification information from the first server, where the second identification information includes the sixth identification of the first terminal device and the seventh identification of the second terminal device, the sixth identification It is an identity mark obtained by encrypting the first identity mark, the seventh identity mark is an identity mark obtained by encrypting the second identity mark, or the second identification information includes the first identity mark and the second identity mark. One of the identifications, and the eighth identification that is obtained by encrypting the other of the first identification and the second identification;

A processing unit, configured to decrypt the second identification information to obtain the first identification and/or the second identification.
The device according to claim 30, wherein the processing unit decrypts the second identification information to obtain the first identification and/or the second identification, specifically:

Use the fourth key to decrypt the sixth identification to obtain the first identification, use the seventh key to decrypt the seventh identification to obtain the second identification, or use the sixth key Decrypt the eighth identification to obtain the other of the first identification and the second identification.
The apparatus according to claim 31, wherein the seventh key is a private key corresponding to the public key of the second terminal device.
The apparatus according to any one of claim 19 and claim 31, wherein at least one of the fourth key, the fifth key and the sixth key is the second signing server and the the shared key of the second terminal device;

Alternatively, at least one of the fourth key, the fifth key and the sixth key is a key generated by a long-term key and a random number of the second terminal device.
The apparatus according to any one of claims 18 to 33, wherein the first server is a query call session control function of the network where the second terminal device is located, or is a function of the query call session control function of the network where the second terminal device is located. Routing proxy node.
A communication device, characterized in that the communication device includes a processor, and when the processor executes a computer program in a memory, the method according to any one of claims 1 to 17 is executed.
A communication device, comprising: a processor and a memory;

the memory for storing computer programs;

The processor is configured to execute a computer program stored in the memory, and when the program is executed, causes the communication device to implement the method according to any one of claims 1-17.
A computer-readable storage medium, characterized in that it is used for storing a computer program, when the computer program runs on a computer, the computer causes the computer to execute the method according to any one of claims 1 to 17 .
A computer program product, characterized in that it comprises computer instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1-17.