CN102185827B - Firewall-penetrating method of voice in VOIP (Voice Over Internet Protocol) system - Google Patents

Abstract

The invention discloses a method for voice penetration through a firewall in a VOIP system, and belongs to the technical field of realizing network communication technology. The IP terminal decides whether to start the encryption negotiation mechanism through the configuration interface; when the encryption negotiation mechanism takes effect, the IP terminal connects to the VOIP server to obtain the encryption key through the encryption mechanism, and encrypts the signaling data packets sent by itself using the encryption mechanism; The terminal receiving the message identifies whether the received message is encrypted through the encryption negotiation mechanism, and uses the encryption mechanism to decrypt the encrypted message while encrypting it before sending it out. This method can ensure normal voice communication when there is an uncontrollable voice firewall setting in the bearer network.

Description

A Method of Voice Penetrating Firewall in VOIP System

technical field

The invention relates to a method for voice penetration through a firewall in a VOIP system, belongs to the technical field of realizing network communication technology, and particularly relates to a solution to the problem of abnormal voice communication caused by uncontrollable voice firewall settings in the bearer network of the VOIP communication system technical field of solutions.

Background technique:

One of the main features of VOIP communication technology is the separation of control and bearer (VoIP is the abbreviation of Voice over Internet Protocol, which refers to the transmission of voice signals in the form of data packets in the IP network environment after the analog voice signals are compressed and packaged. , popularly speaking, it means Internet telephony, Internet telephony or IP telephony for short.) Therefore, most of the actual VOIP system application deployment uses the user's existing network resources as the bearer network of the VOIP system. For VOIP users who need remote intercommunication of VOIP phones, it is often realized by renting the network of other network operators. However, the network application environment of network operators is generally more complicated. For example, some network operators will set up firewalls at the access points of their networks for network security and stability or other purposes, so as to restrict certain applications or The data flow of some specific network applications. For VOIP applications, very few network operators will deploy voice firewalls in their networks to limit VOIP data transmission (Figure 1).

Common voice firewall principles are as follows:

1. By analyzing the SIP signaling session in the VOIP communication process, the network addresses to be used by the two parties participating in the communication process are obtained, and then the data packets sent from or to these addresses are discarded, tampered with or forged, As a result, the communication cannot be carried out normally (as shown in Figure 2).

2. By analyzing the data packets and according to the characteristics of the voice data packets, determine the network addresses of the two parties participating in the voice communication, and then discard, tamper or forge the data packets sent from these addresses, so that the communication cannot be carried out normally (as shown in Figure 3) .

Contents of the invention

The present invention provides a method for voice penetration through a firewall in a VOIP system in view of the prior art, so that the existing voice firewall cannot determine the network address of a terminal participating in voice communication by analyzing the characteristics of VOIP signaling or VOIP voice data packets. In this way, the purpose of preventing the voice firewall from working normally and ensuring the normal progress of voice communication is realized.

The method that the present invention adopts for achieving described purpose is:

A method for voice penetration through a firewall in a VOIP system, wherein an IP terminal decides whether to enable an encryption negotiation mechanism through a configuration interface; when the encryption negotiation mechanism takes effect, the IP terminal connects to a VOIP server to obtain an encrypted key through an encryption mechanism, and The signaling data packet sent by itself is encrypted using this encryption mechanism; the terminal receiving the message identifies whether the received message is encrypted through the encryption negotiation mechanism, and if the received message is encrypted, the encrypted message is encrypted using The encryption mechanism is used for decryption processing, and correspondingly, the message sent by the terminal receiving the message is encrypted by the encryption mechanism and then sent;

The encryption negotiation mechanism follows the following rules:

(a) For the terminal that initiates the call, decide whether to enable the encryption mechanism for the initiated call according to the encryption configuration of the terminal; if the terminal is configured as encrypted, the encryption mechanism will be used during the call process, otherwise the encryption mechanism will not be used during the call process;

(b) For the terminal receiving the call, determine whether the subsequent process of the received call needs to be encrypted according to the encryption mark of the received call request message; if the received call request message has an encryption mark, the call process uses an encryption mechanism , otherwise the call process does not use the encryption mechanism;

(c) When the terminal that initiates or accepts the call determines to use the encryption mechanism, the SDP that sends the SIP signaling carries the a=x-encrypt:on attribute encryption flag, otherwise it carries the a=x-encrypt attribute encryption flag;

(d) When the terminal initiating or accepting the call receives the SDP message of the SIP signaling carrying the a=x-encrypt:on attribute encryption flag, the terminal determines that the voice of this call uses the encryption mechanism, otherwise the encryption mechanism is not used ;

The encryption mechanism includes signaling encryption/decryption process, voice encryption/decryption process and key acquisition mechanism.

The encryption process of the signaling encryption/decryption process is:

The first step, the terminal uses the key acquisition mechanism to obtain the encryption key. For the SIP message to be sent, the byte is used as the unit. According to the order of the message bytes, the odd-numbered bytes and even-numbered bytes are respectively Use different encryption keys to execute the encryption algorithm Dm=Do XOR De in bytes; where Dm is the ciphertext byte, Do is the plaintext byte, and De is the key byte;

Second step, add insert message header to the SIP message processed through the first step, make described message comprise encryption sign successively by byte order, ciphertext length and ciphertext three parts;

The encryption mark is two bytes, indicating that the message is an encrypted message, which is a fixed value, the first byte is a hexadecimal number EF, and the second byte is a hexadecimal number FE;

The length of the ciphertext is two bytes, indicating the length of the ciphertext;

The ciphertext is a SIP message processed by the encryption algorithm;

The decryption process of the signaling encryption/decryption process is:

The terminal uses the key acquisition mechanism to obtain the decryption key, determines the ciphertext length of the received SIP message according to the third and fourth bytes of the message header, and removes the four bytes of the message header to obtain the complete ciphertext. For the ciphertext in bytes, according to the order of the ciphertext bytes, use different decryption keys for odd-numbered bytes and even-numbered bytes to perform the following decryption algorithm: Do=Dm XOR De; where Do is the plaintext Byte, Dm is the ciphertext byte, De is the key byte.

The encryption process of this voice encryption/decryption process is:

The terminal uses a random number generation algorithm to generate a random number within 0-10 as the padding byte length of the encrypted message;

The terminal uses a random number generation algorithm to generate a random number within 0-255 as the padding byte of the encrypted message, and generates all padding bytes in sequence according to the length of the padding byte;

The formed encrypted message includes encrypted message header and voice data encapsulated in RTP format;

The encrypted message header includes three parts in order of bytes: encryption mark, padding data length and padding data;

The encryption is marked as two bytes, the content is a fixed value, the first byte is the hexadecimal number EE, and the second byte is the hexadecimal number FF;

The padding data length is one byte, the content is a random value, and the range is any natural number within 0-10;

The length of the filling data is defined by the filling data length byte; the content of each byte of the filling data is a random value, any natural number ranging from 0 to 255;

The voice data encapsulated in RTP format is a normal voice message in VIOP communication;

The decryption process of this voice encryption/decryption process is:

The terminal determines the random byte length of the message header according to the third byte of the message header for the received voice encrypted message, removes the bytes of the message header part, and obtains the voice data encapsulated in RTP format, and the decryption is completed.

The key acquisition mechanism described is:

The VOIP key consists of two bytes, and each byte ranges from any natural number between 0-255; the first byte is an odd key odd_key, which is used to encrypt odd-numbered bytes of SIP signaling plaintext or to Decrypt the odd-numbered bytes of the SIP signaling ciphertext; the second byte is the even-numbered key even_key, which is used to encrypt the even-numbered bytes of the SIP signaling plaintext or to decrypt the even-numbered bytes of the SIP signaling ciphertext;

The two-byte information is stored in the key configuration file of the VOIP server in the form of decimal text, and the configuration management software of the VOIP server provides the function of modifying the key through the user interface interface; at the same time, the IP terminal can use the private The protocol obtains the two-byte key from the VOIP configuration management software.

The contents of the key configuration file are odd key odd_key=170 and even key even_key=85.

The private protocol is composed of a request message and a response message; the request message is generated by the encrypted IP terminal and sent to the management software of the VOIP server; the response message is generated by the management software of the VOIP server after receiving the request message, and the response message includes The key information is obtained and sent to the requesting party.

In the private protocol, the request message sent by the IP terminal to the VOIP configuration management software is getkey\r\n; in the private protocol, the response message sent by the VOIP configuration management software to the IP terminal is okodd_key=170,even_key=85\r\ n.

The steps for the terminal that initiates the call to implement the encryption mechanism are:

(1) The user configures the terminal as an encrypted communication mode through the configuration interface interface on the IP terminal;

(2) The user initiates a call after inputting the called terminal number through the terminal;

(3) The IP terminal judges whether it is configured as an encrypted communication mode; if so, the terminal uses the key acquisition mechanism to obtain the key and then executes step 4; otherwise, executes step 5;

(4), the terminal generates a SIP message for initiating a call, inserts the a=x-encrypt:on attribute in the SDP attribute of the message, and performs step 6 after performing the signaling encryption process on the SIP message;

(5) The terminal generates a SIP message for initiating a call, and inserts the a=x-encrypt attribute into the SDP attribute of the message; perform step 6;

(6) The terminal sends the processed signaling message to the called terminal;

(7) The terminal receives the encrypted call response message from the called terminal, and executes the signaling decryption process;

(8) The terminal judges whether there is a=x-encrypt:on attribute in the call response message SDP; if there is, it is determined that the voice of this call needs to be encrypted; otherwise, it is determined that the voice of this call does not need to be encrypted;

(9) Call establishment; according to the judgment in step 8, perform or not perform the voice encryption/decryption process on the voice; start to send/receive the voice.

The steps for the terminal receiving the call to implement the encryption mechanism are:

(1) The IP terminal receives the SIP call request message;

(2) Determine whether the SIP message received by the terminal has an encryption mark; if so, the terminal uses the key acquisition mechanism to obtain the key and decrypt the message; otherwise, the normal SIP call process is executed, and the program is terminated;

(3) The terminal checks whether there is a=x-encrypt:on attribute in the SDP of the received SIP message; if it is determined that the voice of this call needs to be encrypted, go to step 4; otherwise, it is determined that the voice of this call does not need to be encrypted, Execute step 5;

(4) The terminal generates a SIP message for receiving and answering the call, inserts the a=x-encrypt:on attribute in the SDP attribute of the message, executes the signaling encryption process, and performs step 6;

(5) The terminal generates a SIP message for receiving and answering the call, inserts the a=x-encrypt attribute into the SDP attribute of the message, and performs step 6;

(6) The terminal sends the processed signaling message to the calling terminal;

(7) Call establishment; according to the judgment in step 3, the voice encryption/decryption process is performed or not performed on the voice, and the voice is sent/received.

Adopting the method of the present invention is because the IP terminal starts the encryption negotiation mechanism through the configuration interface; The encryption mechanism is used to encrypt; the terminal receiving the message identifies whether the received message is encrypted through the encryption negotiation mechanism, and if the received message is encrypted, the encrypted message is decrypted using the encryption mechanism, Correspondingly, the message sent by the terminal receiving the message is encrypted by the encryption mechanism and then sent out; by this method, the existing voice firewall cannot determine the voice communication by analyzing the characteristics of signaling or voice data packets The network address of the terminal, so that the voice firewall cannot work normally, and the normal progress of voice communication is guaranteed.

Description of drawings

FIG. 1 is a schematic diagram of a network structure in which a voice firewall is deployed in the prior art;

Fig. 2 is a schematic diagram of the principle of voice firewall intercepting voice packets according to signaling in the prior art;

Fig. 3 is a schematic diagram of the principle of intercepting voice packets according to voice packet characteristics in the voice firewall in the prior art;

Fig. 4 is the flow chart that the terminal that initiates the call of the present invention implements encryption mechanism;

Fig. 5 is a flow chart of the encryption mechanism implemented by the calling terminal of the present invention.

Detailed ways

In the prior art IP telephony system, VOIP call signaling is described using SDP protocol (SessionDescription Protocol-an application layer control protocol used to describe multimedia sessions); SDP description is composed of many text lines, and the format of the text line is < Type>=<value>, <type> is a letter, and <value> is a structured text string whose format depends on <type>; <type>=<value>[CRLF].

The <type> used to describe the terminal media capability attribute in SDP is mostly represented by the letter a, so the general form of the SDP terminal media capability attribute description text line is as follows:

a=attribute or a=attribute:value

Among them, attribute is a media capability attribute, expressed in the form of a text string, and value is its value; and the setting of the media capability attribute attribute can be determined according to user needs. That is to say, it doesn't matter what attribute name is chosen, as long as it is easy to distinguish, what is important is the setting and judgment of the value inside.

The present invention is a method for voice penetration through a firewall in a VOIP system. The IP terminal decides whether to start the encryption negotiation mechanism through the configuration interface; when the encryption negotiation mechanism takes effect, the IP terminal connects to the VOIP server to obtain an encrypted key through the encryption mechanism. And use the encryption mechanism to encrypt the signaling data packet sent by itself; the terminal receiving the message identifies whether the received message is encrypted through the encryption negotiation mechanism, if the received message is encrypted, the encrypted message The text is decrypted using the encryption mechanism described above, and correspondingly, the message sent by the terminal receiving the message is sent after being encrypted using the encryption mechanism described above;

The encryption negotiation mechanism follows the following rules:

(a) For the terminal that initiates the call, decide whether to enable the encryption mechanism for the initiated call according to the encryption configuration of the terminal; if the terminal is configured as encrypted, the encryption mechanism will be used during the call process, otherwise the encryption mechanism will not be used during the call process;

(b) For the terminal receiving the call, determine whether the subsequent process of the received call needs to be encrypted according to the encryption mark of the received call request message; if the received call request message has an encryption mark, the call process uses an encryption mechanism , otherwise the call process does not use the encryption mechanism;

(c) When the terminal initiating or accepting the call determines that the call needs to be encrypted using an encryption mechanism, the SDP (a message describing the media attributes of the local end) sent by the SIP signaling (a VOIP call signaling) carries "a=x -encrypt: on" attribute encryption mark, otherwise carry "a=x-encrypt" attribute encryption mark;

(d) When the terminal initiating or accepting the call receives the SDP message of SIP signaling carrying the "a=x-encrypt: on" attribute encryption mark, the terminal determines that the voice of this call uses an encryption mechanism, and the voice needs to be encrypted , otherwise no encryption mechanism is used;

When the terminal determines that the call process needs to be encrypted, it uses this encryption mechanism. The encryption mechanism includes signaling encryption/decryption process, voice encryption/decryption process and key acquisition mechanism.

Signaling encryption/decryption process:

In this process, for the SIP message in the encrypted call, the terminal sending the message implements the encryption process, and the terminal receiving the message implements the decryption process.

(1) Encryption process:

1. The terminal uses the "key acquisition mechanism" to obtain the encryption key. For the SIP message to be sent, the byte is used as the unit, and the odd-numbered byte and the even-numbered byte are used according to the sequence of the message bytes. The same encryption algorithm with different encryption keys performs the following encryption algorithms:

Dm=Do XOR De(Dm: ciphertext bytes, Do: plaintext bytes, De: key bytes)

The VOIP key consists of two bytes, and the value of each byte is any natural number between 0-255. The first byte is an odd key odd_key, which is used to encrypt odd-numbered bytes of SIP signaling plaintext or to Decrypt the odd-numbered bytes of the SIP signaling ciphertext, and the second byte is the even-numbered key even_key, which is used to encrypt the even-numbered bytes of the SIP signaling plaintext or to decrypt the even-numbered bytes of the SIP signaling ciphertext. These two bytes of information are stored in the key configuration file of the VOIP server in the form of decimal text, and the configuration management software of the VOIP server can provide the function of modifying the key through the user interface interface. At the same time, the IP terminal can obtain the two-byte key from the VOIP configuration management software through the private protocol of the VOIP system. For example: the content in the key configuration file in the VOIP system can be defined as follows:

odd_key=170

even_key=85

The protocol between the IP terminal and the VOIP configuration management software can be defined in the form of text lines as follows:

①. Request message (sent from IP terminal to VOIP configuration management software): getkey\r\n;

②. Response message (sent to IP terminal by VOIP configuration management software): ok odd_key=170, even_key=85\r\n;

2. Add headers to the SIP message processed in the first step, and the encrypted message after adding is as follows:

encryption mark Ciphertext length ciphertext

Encryption mark: two bytes, indicating that the message is an encrypted message, which is a fixed value, the first byte is EF (hexadecimal value), the second byte is FE (hexadecimal value);

Ciphertext length: two bytes, indicating the length of the ciphertext;

Ciphertext: SIP message processed by encryption algorithm;

(2) Decryption process:

The terminal uses the "key acquisition mechanism" to obtain the encryption key, determines the ciphertext length of the received SIP message according to the 3 and 4 bytes of the message header, and removes the four bytes of the message header to obtain the complete ciphertext. For the ciphertext, use the byte as the unit, according to the order of the ciphertext bytes, use the same decryption algorithm and different decryption keys to execute the following decryption algorithm for odd-numbered bytes and even-numbered bytes:

Do=Dm XOR De(Do: plaintext bytes, Dm: ciphertext bytes, De: key bytes)

Voice encryption/decryption process:

In this process, the voice message in encrypted communication is encrypted by the terminal sending the message, and decrypted by the terminal receiving the message.

(1) Encryption process:

The terminal uses the "random number generation algorithm" to generate a random (natural number) number within 0-10 as the padding byte length of the encrypted message;

The terminal uses the "random number generation algorithm" to generate a random (natural number) number within 0-255 as the filling byte of the encrypted message, and generates all filling bytes in turn according to the length of the filling byte;

Assemble the encrypted message according to the following structure:

Encryption mark: two bytes, the content is a fixed value, the first byte EE (hexadecimal value), the second byte FF (hexadecimal value)

Padding data length: one byte, the content is a random value, range: any natural number between 0-10 (including 0 and 10);

Filling data: its length is defined by the "filling data length" field, and the content of each byte is a random value, any natural number between 0-255 (including 0 and 10);

Voice data encapsulated in RTP format: normal voice message in VIOP communication; RTP is the abbreviation of Real-time Transport Protocol (Real-time Transport Protocol), which represents a network transmission protocol and is a common protocol in audio and video uploading.

(2) Decryption process:

The terminal determines the random byte length of the message header according to the third byte of the message header, removes the message header byte, and obtains the voice data encapsulated in RTP format, and the decryption is completed.

Key acquisition mechanism:

For the signaling encryption/decryption process, the terminal needs to first obtain encryption and decryption keys, which are divided into encryption and decryption keys for odd-number bytes and encryption and decryption keys for even-number bytes. In the present invention, these keys are stored in the VOIP switchboard (server), configured and read by the VOIP switchboard configuration management software, and terminals that need encrypted communication request the key from the VOIP switchboard configuration management software through a private protocol.

The private protocol in this paper refers to a protocol defined between the IP terminal that has realized the encryption function and the management software of the VOIP server in order to realize the function that the IP terminal obtains the key from the VOIP server. This protocol does not follow any existing public protocol standards in the communication field, and is completely defined for the realization of this specific function. The protocol consists of a request message and a response message: the request message is generated by the IP terminal that has implemented the encryption function and sent to the management software of the VOIP server; the response message is generated by the management software of the VOIP server after receiving the request message, and the response message includes key information and is sent to the requesting party.

The process of implementing the encryption mechanism for initiating calls and receiving calls in the present invention is described below in conjunction with the accompanying drawings and embodiments. The initiating terminal is IP phone A, and the receiving terminal is IP phone B;

Figure 4 is a flow chart of implementing an encryption mechanism for a terminal that initiates a call;

1. The user configures the IP phone A terminal as an encrypted communication mode;

2. The user uses IP phone A to input the called number of IP phone B to initiate a call;

3. The IP phone A terminal judges whether it is configured as an encrypted communication mode, if so, the IP phone A terminal uses the "key acquisition mechanism" to obtain the key, and performs step 4; otherwise, performs step 5;

4. IP phone A terminal generates a SIP message for initiating a call, inserts the "a=x-encrypt: on" attribute into the SDP attribute of the message, performs the "signaling encryption process" on the SIP message, and performs step 6;

5. IP phone A terminal generates a SIP message for initiating a call, inserts the "a=x-encrypt" attribute into the SDP attribute of the message, and performs step 6;

6. The IP phone A terminal sends the processed signaling message to the called terminal IP phone B;

7. The IP phone A terminal receives the call response message encrypted by the called terminal IP phone B, and executes the "signaling decryption process";

8. The terminal A of the IP phone judges whether there is an attribute "a=x-encrypt: on" in the SDP of the call response message. If it is confirmed that the call is confirmed, the voice needs to be encrypted, otherwise it is determined that the voice of this call does not need to be encrypted;

9. Call establishment (IP phone A and IP phone B); start to send/receive voice, and according to the judgment in step 8, perform or not perform voice encryption and decryption on the voice.

Figure 5 is a flow chart of implementing an encryption mechanism for a terminal receiving a call;

1. The terminal of IP phone B receives the SIP call request message of IP phone A;

2. Whether the SIP message received by the IP phone B terminal has an encryption mark to determine whether the subsequent call process needs signaling encryption. If so, the IP phone A terminal uses the "key acquisition mechanism" to obtain the key, and the IP phone B uses the SIP signaling Decryption; otherwise, execute the normal SIP call process (subsequent steps of the process are omitted);

3. IP phone terminal B checks whether there is an attribute "a=x-encrypt: on" in the SDP of the received SIP message. If it is confirmed that the call is confirmed, the voice needs to be encrypted, and the step 4 is performed; otherwise, the voice of the call is confirmed. Encryption is not required, go to step 5;

4. IP phone B terminal generates a SIP message to answer the received call, inserts the "a=x-encrypt: on" attribute into the SDP attribute of the message, executes the "signaling encryption process", and performs step 6;

5. The IP phone terminal B generates a SIP message to answer the received call, inserts the "a=x-encrypt" attribute into the SDP attribute of the message, and performs step 6;

6. The terminal of IP phone B sends the processed signaling message to the calling terminal of IP phone A;

7. Call establishment; start to send/receive voice, and according to the judgment in step 3, perform or not perform voice encryption and decryption process on voice.

The operation process in the actual application process:

The calling terminal sets the encrypted communication function and initiates a call;

The calling terminal generates a call request signaling message, the media negotiation part of the message is set with a media encryption flag, and the signaling message is encrypted and sent;

The voice firewall of the network operator receives the encrypted signaling message sent by the caller. Since the message is encrypted with a private encryption protocol, the firewall cannot analyze it, so the media network address of the caller cannot be obtained through the signaling message;

The called terminal receives the encrypted signaling message, judges the message encryption according to the message header, decrypts the message according to the decryption algorithm, processes the decrypted message according to the normal call flow, and obtains the caller's set media After encrypting the request, it is determined that the voice needs to be encrypted for this communication, and a response message is generated, and the encrypted response is sent to the caller;

The voice firewall of the network operator receives the encrypted call response signaling message sent by the called party. Since the message is encrypted with a private encryption protocol, the firewall cannot analyze it, so it cannot obtain the called media network through the signaling message. address;

The calling party receives the encrypted response message from the called party, judges the message encryption according to the message header, decrypts the message according to the decryption algorithm, and processes the decrypted message in accordance with the normal call flow. After setting the media encryption request, it is determined that the voice needs to be encrypted for this communication, and the call is established at this point;

The calling party and the called party start sending encrypted voice data packets;

The voice firewall of the network operator receives the encrypted voice data packets of the calling party and the called party. Since the encrypted voice data packets cannot obtain the characteristics of normal voice packets (RTP packet header, fixed length), the firewall cannot determine the received packets. Whether it is a voice packet, it cannot be interfered;

The calling party and the called party respectively receive the voice packets of the other party, and after the voice packets are decrypted, they are processed according to normal voice data, and both parties can hear the voice of the other party normally.

Claims (9)

1. A method for voice penetration firewall in a VOIP system, characterized in that an IP terminal decides whether to start an encryption negotiation mechanism through a configuration interface; key, and use the encryption mechanism to encrypt the signaling data packets sent by itself; the terminal receiving the message identifies whether the received message is encrypted through the encryption negotiation mechanism, and if the received message is encrypted, the The encrypted message is decrypted by using the encryption mechanism, and correspondingly, the message sent by the terminal receiving the message is encrypted by the encryption mechanism and then sent; The encryption negotiation mechanism follows the following rules: (a) For the terminal that initiates the call, decide whether to enable the encryption mechanism for the initiated call according to the encryption configuration of the terminal; if the terminal is configured to be encrypted, the encryption mechanism will be used during the call process, otherwise the encryption mechanism will not be used during the call process; (b) For the terminal receiving the call, determine whether the subsequent process of the received call needs to be encrypted according to the encryption mark of the received call request message; if the received call request message has an encryption mark, the call process uses an encryption mechanism , otherwise the call process does not use the encryption mechanism; (c) When the terminal that initiates or accepts the call determines to use the encryption mechanism, the SDP that sends the SIP signaling carries the a=x-encrypt:on attribute encryption flag, otherwise it carries the a=x-encrypt attribute encryption flag; (d) When the terminal initiating or accepting the call receives the SDP message of the SIP signaling carrying the a=x-encrypt:on attribute encryption flag, the terminal determines that the voice of this call uses the encryption mechanism, otherwise the encryption mechanism is not used ; The encryption mechanism includes signaling encryption/decryption process, voice encryption/decryption process and key acquisition mechanism. 2. the method for voice penetration firewall in the VOIP system as claimed in claim 1, is characterized in that: The encryption process of the signaling encryption/decryption process is: The first step, the terminal uses the key acquisition mechanism to obtain the encryption key. For the SIP message to be sent, the byte is used as the unit. According to the order of the message bytes, the odd-numbered bytes and even-numbered bytes are respectively Use different encryption keys to execute the encryption algorithm Dm=Do XOR De in bytes; where Dm is the ciphertext byte, Do is the plaintext byte, and De is the key byte; Second step, add insert message header to the SIP message processed through the first step, make described message comprise encryption sign successively by byte order, ciphertext length and ciphertext three parts; The encryption mark is two bytes, indicating that the message is an encrypted message, which is a fixed value, the first byte is a hexadecimal number EF, and the second byte is a hexadecimal number FE; The length of the ciphertext is two bytes, indicating the length of the ciphertext; The ciphertext is a SIP message processed by the encryption algorithm; The decryption process of the signaling encryption/decryption process is: The terminal uses the key acquisition mechanism to obtain the decryption key, determines the ciphertext length of the received SIP message according to the third and fourth bytes of the message header, and removes the four bytes of the message header to obtain the complete ciphertext. For the ciphertext in bytes, according to the order of the ciphertext bytes, use different decryption keys for odd-numbered bytes and even-numbered bytes to perform the following decryption algorithm: Do=Dm XOR De; where Do is the plaintext Byte, Dm is the ciphertext byte, De is the key byte. 3. the method for voice penetration firewall in the VOIP system as claimed in claim 1, is characterized in that: The encryption process of this voice encryption/decryption process is: The terminal uses a random number generation algorithm to generate a random number within 0-10 as the padding byte length of the encrypted message; The terminal uses a random number generation algorithm to generate a random number within 0-255 as the padding byte of the encrypted message, and generates all padding bytes in sequence according to the length of the padding byte; The formed encrypted message includes encrypted message header and voice data encapsulated in RTP format; The encrypted message header includes three parts in order of bytes: encryption mark, padding data length and padding data; The encryption is marked as two bytes, the content is a fixed value, the first byte is the hexadecimal number EE, and the second byte is the hexadecimal number FF; The padding data length is one byte, the content is a random value, and the range is any natural number within 0-10; The length of the filling data is defined by the filling data length byte; the content of each byte of the filling data is a random value, any natural number ranging from 0 to 255; The voice data encapsulated in RTP format is a normal voice message in VIOP communication; The decryption process of this voice encryption/decryption process is: The terminal determines the random byte length of the message header according to the third byte of the message header for the received voice encrypted message, removes the bytes of the message header part, and obtains the voice data encapsulated in RTP format, and the decryption is completed. 4. the method for voice penetration firewall in the VOIP system as claimed in claim 1, is characterized in that described key acquisition mechanism is: The VOIP key consists of two bytes, and each byte ranges from any natural number between 0-255; the first byte is an odd key odd_key, which is used to encrypt odd-numbered bytes of SIP signaling plaintext or to Decrypt the odd-numbered bytes of the SIP signaling ciphertext; the second byte is the even-numbered key even_key, which is used to encrypt the even-numbered bytes of the SIP signaling plaintext or to decrypt the even-numbered bytes of the SIP signaling ciphertext; The two-byte information is stored in the key configuration file of the VOIP server in the form of decimal text, and the configuration management software of the VOIP server provides the function of modifying the key through the user interface interface; at the same time, the IP terminal can use the private The protocol obtains the two-byte key from the VOIP configuration management software. 5. the method for voice penetration firewall in the VOIP system as claimed in claim 4 is characterized in that the content in the key configuration file is odd key odd_key=170 and even key even_key=85. 6. the method for voice penetration firewall in the VOIP system as claimed in claim 4 is characterized in that this private agreement is made of request message and response message; Request message is produced and sent to the management of VOIP server by the IP terminal that has realized encryption function Software; the response message is generated by the management software of the VOIP server after receiving the request message, and the response message contains key information and is sent to the requesting party. 7. the method for voice penetration firewall in the VOIP system as claimed in claim 6 is characterized in that the request message sent to the VOIP configuration management software by the IP terminal is getkey\r\n in the private protocol; The response message sent by the VOIP configuration management software to the IP terminal is ok odd_key=170, even_key=85\r\n. 8. the method for voice penetration firewall in the VOIP system as claimed in claim 1, is characterized in that the terminal that this initiates a call implements the step of encryption mechanism is: (1) The user configures the terminal as an encrypted communication mode through the configuration interface interface on the IP terminal; (2) The user initiates a call after inputting the called terminal number through the terminal; (3) The IP terminal judges whether it is configured as an encrypted communication mode; if so, the terminal uses the key acquisition mechanism to obtain the key and then executes step 4; otherwise, executes step 5; (4), the terminal generates a SIP message for initiating a call, inserts the a=x-encrypt:on attribute into the SDP attribute of the message, and performs step 6 after performing the signaling encryption process on the SIP message; (5) The terminal generates a SIP message for initiating a call, and inserts the a=x-encrypt attribute into the SDP attribute of the message; perform step 6; (6) The terminal sends the processed signaling message to the called terminal; (7) The terminal receives the encrypted call response message from the called terminal, and executes the signaling decryption process; (8) The terminal judges whether there is a=x-encrypt:on attribute in the call response message SDP; if there is, it is determined that the voice of this call needs to be encrypted; otherwise, it is determined that the voice of this call does not need to be encrypted; (9) Call establishment; according to the judgment in step 8, perform or not perform the voice encryption/decryption process on the voice; start to send/receive the voice. 9. the method for speech penetration firewall in the VOIP system as claimed in claim 1, is characterized in that the terminal that this receives calling implements the step of encryption mechanism is: (1) The IP terminal receives the SIP call request message; (2) Determine whether the SIP message received by the terminal has an encryption mark; if so, the terminal uses the key acquisition mechanism to obtain the key and decrypt the message; otherwise, the normal SIP call process is executed, and the program is terminated; (3) The terminal checks whether there is a=x-encrypt:on attribute in the SDP of the received SIP message; if it is determined that the voice of this call needs to be encrypted, go to step 4; otherwise, it is determined that the voice of this call does not need to be encrypted, Execute step 5; (4) The terminal generates a SIP message for receiving and answering the call, inserts the a=x-encrypt:on attribute into the SDP attribute of the message, performs the signaling encryption process, and performs step 6; (5) The terminal generates a SIP message for receiving and answering the call, inserts the a=x-encrypt attribute into the SDP attribute of the message, and performs step 6; (6) The terminal sends the processed signaling message to the calling terminal; (7) Call establishment; according to the judgment in step 3, the voice encryption/decryption process is performed or not performed on the voice, and the voice is sent/received.

Images