CN1881869B - A method for realizing encrypted communication - Google Patents

Abstract

The invention discloses a method for realizing encrypted communication. When two communication nodes communicate, the first communication node sends its own media capability information and communication encryption capability information to the second communication node; the media capability information represents the media capabilities of the communication nodes. Capability, the communication encryption capability information represents that the communication node has encrypted communication capability; the second communication node judges whether it has communication encryption capability and exists with the first communication node according to the media capability information and communication encryption capability information from the first communication node If there is an intersecting media capability, the first and second communication nodes determine the same data encryption key, and use the media capability and the determined data encryption key to perform encrypted communication. The method of the invention ensures that even if the communication information between the first and second communication nodes is obtained illegally, the person who obtains the information illegally cannot analyze or directly read out the content contained in the obtained information, thereby improving communication security and user satisfaction.

Description

A method for realizing encrypted communication

technical field

The invention relates to the communication field, in particular to a method for realizing encrypted communication.

Background technique

Currently, the RFC 2833 protocol describes how to transmit dual-tone multi-frequency signals (DTMF) and other network signaling and events in real-time transport protocol (RTP) packets.

Among the above-mentioned information transmitted by applying RFC 2833, a considerable part of the information requires high security. Such as: transaction data of commercial departments such as banks, user personal information, etc. Encryption should be carried out when transmitting these information with high security requirements, so that the transmitted information cannot be correctly analyzed even if it is obtained illegally.

However, the current application of RFC 2833 does not encrypt the transmitted information when transmitting information, and the security of communication using RFC 2833 is low. In this case, if the information is obtained illegally during transmission, the person who obtains the information illegally can directly read the content contained in the obtained information, which is likely to have a negative impact on the legal owner of the information, thereby reducing user satisfaction.

In fact, there are still many other types of communication protocols that cannot realize encrypted communication of information, and the security of communication using these communication protocols is also very low, which is likely to have an adverse effect on the legal owner of information, thereby reducing user satisfaction .

Contents of the invention

In view of this, the main purpose of the present invention is to provide a method for implementing encrypted communication, so as to improve communication security.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

The invention discloses a method for realizing encrypted communication, which is used for encrypting RFC 2833 protocol data packets, comprising the following steps:

a. When two communication nodes communicate, the first communication node sends its own media capability information and communication encryption capability information to the second communication node;

b. According to the media capability information and communication encryption capability information from the first communication node, the second communication node judges whether it has the communication encryption capability and the media capability that overlaps with the first communication node. If so, the first and second communications The nodes determine the same data encryption key, and use the media capability and the determined data encryption key that have an intersection to perform encrypted communication.

In step b, the judging method includes:

The second communication node acquires the media capability it has, and compares whether there is an intersection between the acquired media capability and the media capability corresponding to the media capability information from the first communication node, and if there is an intersection, the second communication node determines that it has the same media capability as the first communication node. Communication nodes have overlapping media capabilities;

The second communication node inquires communication configuration parameters related to communication encryption capability among its own communication configuration parameters, and if the queried communication configuration parameters support communication encryption, the second communication node determines that it has communication encryption capability.

The media capability information is a communication protocol name, then the method for the second communication node to determine whether it has a media capability that overlaps with the first communication node is:

The second communication node obtains the communication protocol supported by itself, and compares whether there is an intersection between the name of the obtained communication protocol and the communication protocol name from the first communication node, and if there is an intersection, the second communication node determines that it has an intersection with the first communication node Intersecting media capabilities.

The communication configuration parameter related to communication encryption capability is encryption enablement, then in step b, the method for the second communication node to judge whether it has communication encryption capability is:

The second communication node queries the encryption enablement in its own communication configuration parameters, and if the queried encryption enablement is set to an enabled state, the second communication node determines that it has communication encryption capability.

The communication encryption capability information is a random number generated by the first communication node or a preset public key, then in step b, the method for the first and second communication nodes to determine the data encryption key includes:

The second communication node applies a preset encryption policy to encrypt the random number or public key from the first communication node, and uses the encryption result as a data encryption key for subsequent communication with the first communication node; the first communication node applies a preset The encryption strategy encrypts the random number generated by itself or the public key sent to the second communication node, and uses the encryption result as the data encryption key for subsequent communication with the second communication node.

The communication encryption capability information is the encryption result obtained after the first communication node applies a preset encryption policy to encrypt the random number generated by it and the preset public key, then in step b, the first and second communications Methods for nodes to determine data encryption keys include:

The second communication node applies a preset encryption policy and public key to decrypt the communication encryption capability information from the first communication node, and uses the decryption result as a data encryption key for subsequent communications with the first communication node; the first communication node The encryption result is used as a data encryption key for subsequent communication with the second communication node.

The communication encryption capability information is a random number generated by the first communication node or a preset public key, then in step b, the method for the first and second communication nodes to determine the data encryption key includes:

The second communication node directly uses the random number or public key from the first communication node as the data encryption key for subsequent communication with the first communication node; the first communication node directly sends the random number or public key generated by itself to the second communication node The public key is used as a data encryption key for subsequent communication with the second communication node.

In step b, the encrypted communication includes:

The first/second communication node encrypts the data sent to the second/first communication node by applying the data encryption key and the preset encryption policy, and sends the encrypted encrypted data to the second/first communication node The node; the second/first communication node applies the data encryption key and the encryption policy to decrypt the encrypted data from the first/second communication node.

Before step b or in step b, a media channel for communication is further established between the first communication node and the second communication node.

The first communication node and the second communication node are communication terminals, gateways or media controller units MCU.

The first communication node interacts with the second communication node using the session initiation protocol SIP or the H323 protocol.

Compared with the prior art, in the method for implementing encrypted communication provided by the present invention, the media capability and encrypted communication capability for supporting encrypted communication are determined through negotiation between the first communication node and the second communication node; in the first and second communication When both nodes have communication encryption capabilities and overlapping media capabilities, the first and second communication nodes determine the same data encryption key, and use the media capabilities and the determined data encryption key to perform encrypted communication.

It can be seen that even if the information transmitted between the first and second communication nodes is obtained illegally, the method of the present invention can ensure that the illegally obtained information cannot correctly parse or directly read out the content contained in the obtained information, avoiding the legalization of the information. Possibly detrimental to the owner, improving communication security and user satisfaction.

Description of drawings

Fig. 1 is a flow chart of implementing encrypted communication in the present invention.

Detailed ways

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments.

In the method for implementing encrypted communication provided by the present invention, the first communication node sends its own media capability information and communication encryption capability information to the second communication node; the media capability information represents the media capability of the communication node, and the communication The encryption capability information represents that the communication node has encrypted communication capability; the second communication node judges whether it has the communication encryption capability and the media capability that overlaps with the first communication node according to the media capability information and communication encryption capability information from the first communication node, If so, the first and second communication nodes determine the same data encryption key, and use the media capability and the determined data encryption key to perform encrypted communication. Wherein, the first communication node may be a calling communication node, and the second communication node may be a called communication node.

Referring to Fig. 1, Fig. 1 realizes the flow chart of encrypted communication for the present invention, and this flow process comprises the following steps:

Step 101: The same public key and encryption strategy are preset in the calling and called communication nodes. The calling communication node sends a call establishment request to the called communication node, and the call establishment request can be implemented by a Setup message of the Q931 protocol.

Step 102: After receiving the call establishment request from the calling communication node, the called communication node sends a call processing response to the calling communication node, notifying the calling communication node that the call is being processed. The call processing response can be realized by the CallProceeding message of the Q931 protocol.

Step 103: The called communication node sends a ringing message to the calling communication node, notifying the calling communication node that the called communication node is ringing. The ringing message may be implemented by an Alerting message of the Q931 protocol.

Step 104: When the called communication node accepts the call from the calling communication node by off-hook, etc., the called communication node sends a call response response to the calling communication node.

Step 105: A connection establishment process is performed between the calling and called communication nodes, so as to establish a communication connection for supporting communication between the calling and called communication nodes.

The specific connection establishment process usually includes: the called communication node sends a connection establishment request including at least the communication identification of the called communication node to the calling communication node; after the calling communication node receives the connection establishment request from the called communication node, it determines and The communication node corresponding to the communication identification included in the connection establishment request communicates, and sends a connection establishment response containing the communication identification of the calling communication node to the called communication node; the called communication node receives the connection establishment response from the calling communication node After that, it is determined to communicate with the communication node corresponding to the communication identification contained in the connection establishment response. Of course, if the call setup request in step 101 carries the communication identification of the calling communication node, the called communication node determines to communicate with the communication node corresponding to the communication identification after receiving the communication identification, and the calling communication node does not need to The communication identifier is carried in the above connection establishment response.

The above connection establishment process can be implemented by the Connect message of the Q931 protocol, or by the H245 protocol. If implemented by the H245 protocol, the communication identifier includes an H245 Internet Protocol (IP) address and a listening port number supported by the H245 protocol.

Step 106: When the calling communication node has communication encryption capability, the calling communication node initiates a communication encryption capability negotiation process with the called communication node. The operations included in the negotiation process mainly include: the calling communication node sends a communication encryption capability negotiation request to the called communication node, and the communication encryption capability negotiation request includes at least media capability information and communication encryption capability information of the calling communication node. Wherein, the media capability information represents the media capability of the calling communication node. Specifically, the media capability information represents the media encoding and decoding capability of the calling communication node during data communication; the communication encryption capability information represents the calling communication Nodes have encrypted communication capabilities. The communication encryption capability information may be represented by an extension field.

After the called communication node receives the communication encryption capability negotiation request from the calling communication node, it judges whether it has the communication encryption capability and the intersecting media capability with the calling communication node. Send a communication encryption capability negotiation response, which may carry the media capability information and communication encryption capability information of the called communication node; otherwise, the called communication node sends a negotiation failure message to the calling communication node, and the calling communication node After receiving the negotiation failure message, the node stops subsequent operations related to encrypted communication with the called communication node. The communication encryption capability and the respective media capabilities are usually preset in the calling and called communication nodes.

It can be seen that the process shown in FIG. 1 is an example of successful communication encryption capability negotiation.

There are many ways for the called communication node to judge whether it has communication encryption capability, such as: adding encryption enablement in the communication configuration parameters of the called communication node, and setting the encryption enablement as enabling in advance by the operator or prohibited. Then, when the called communication node queries its own communication configuration parameters, if it is known that the encryption enablement is currently enabled, the called communication node determines that it has communication encryption capability; otherwise, the called communication node determines that it does not have communication encryption capability .

If the main operations of the above-mentioned communication encryption capability negotiation process are embodied, there can be multiple communication encryption capability negotiation processes between the calling communication node and the called communication node. The first communication encryption capability negotiation process is:

The calling communication node sends a communication encryption capability negotiation request including media capability information and communication encryption capability information to the called communication node, and the communication encryption capability information is represented by a public key, that is, the communication encryption capability negotiation request includes The public key represents that the calling communication node has communication encryption capability. After receiving the communication encryption capability negotiation request from the calling communication node, the called communication node applies the existing technology to obtain its own media capability, and compares the obtained media capability with the media capability information contained in the communication encryption capability negotiation request Whether there is an intersection of the represented media capabilities, if there is an intersection, the called communication node determines that it has a media capability that intersects with the calling communication node; otherwise, the called communication node determines that it does not have a media capability that intersects with the calling communication node ability.

The called communication node also determines whether it has the communication encryption capability, and if so, the called communication node applies the preset encryption strategy to encrypt the public key contained in the communication encryption capability negotiation request, and uses the encrypted result as The called side data encryption key for subsequent communication with the calling communication node. Afterwards, the called communication node sends a communication encryption capability negotiation response to the calling communication node, informing the calling communication node that the called communication node has the communication encryption capability and the media capability that overlaps with the calling communication node; After the communication encryption capability negotiation response of the called communication node, it is determined that encrypted communication can be performed with the calling communication node, and the encryption strategy is applied to encrypt the public key, and the encrypted result is used as a subsequent communication with the called communication node. The calling side data encryption key when the communication node communicates.

Of course, the calling and called communication nodes may not use the encryption strategy to encrypt the public key, but directly use the public key as the data encryption key of the calling side and the called side in subsequent communication respectively.

In practical applications, the communication encryption capability negotiation response may carry the called side data encryption key, and the calling communication node applies the encryption strategy to the called party data contained in the communication encryption capability negotiation response received. side data encryption key to decrypt, and judge whether the decrypted result is the same as the public key, if the same, the calling communication node sends a confirmation message to the called communication node; otherwise, the calling communication node sends a confirmation message to the called communication node Negotiation failure message.

Certainly, after the calling communication node receives the communication encryption capability negotiation response, it may not perform the decryption operation, but directly judges whether the called side data encryption key contained in the received response is consistent with the calling side data encryption key generated by itself. The data encryption keys on the calling side are the same, if they are the same, the calling communication node sends a confirmation message to the called communication node; otherwise, the calling communication node sends a negotiation failure message to the called communication node.

The communication encryption capability negotiation response may further carry media capability information corresponding to the media capability of the called communication node that overlaps with the calling communication node.

The second communication encryption capability negotiation process is: the calling communication node sends a communication encryption capability negotiation request including media capability information and communication encryption capability information to the called communication node, and the communication encryption capability information is arbitrarily generated by the calling communication node The random number indicates that the random number contained in the communication encryption capability negotiation request represents that the calling communication node has the communication encryption capability. The called communication node determines whether it has media capabilities that overlap with the calling communication node, and the specific determination method is the same as the corresponding determination method in the first communication encryption capability negotiation process.

The called communication node also determines whether it has the communication encryption capability, generates the data encryption key on the called side after determining that it has the communication encryption capability, and performs subsequent operations such as sending a communication encryption capability negotiation response to the calling communication node. The specific operation method It is substantially the same as the corresponding method in the communication encryption capability negotiation process of the first kind, except that the operation performed is no longer directed to the public key but to the random number.

The advantage of using random numbers for encrypted communication is that a new random number can be randomly generated every time a new communication such as a new session is carried out between the calling and called communication nodes, and the data encryption key can be generated by using the random number . It can be seen that whenever the calling and called communication nodes conduct a new communication, the generated data encryption key is different from the previous one. The flexibility of this kind of data encryption key generation makes it possible for the person who illegally obtains information even in a communication Even if the data encryption key is deciphered, the same method cannot be applied to decipher the data encryption key used in each communication, which can further improve communication security.

Of course, the calling communication node can use the random number as the calling side data encryption key when communicating with the called communication node, and apply the set public key and encryption strategy to encrypt the random number, and the encrypted The result is carried in the communication encryption capability negotiation request as communication encryption capability information, and sent to the called communication node. After the called communication node receives the communication encryption capability negotiation request and determines that it has encryption capability, it applies the set public key and encryption strategy to decrypt the communication encryption capability information contained in the communication encryption capability negotiation request received, and The decryption result is used as the data encryption key of the called side during subsequent communication with the calling communication node. It can be seen that the data encryption key on the called side is the same as the random number sent by the calling communication node.

The third communication encryption capability negotiation process is: the calling communication node sends a pre-negotiation request containing media capability information and communication encryption capability information to the called communication node, and the communication encryption capability information is represented by a communication encryption capability flag, the communication The encryption capability flag is used to inform the called communication node that the calling communication node has communication encryption capability. For example, when the communication encryption capability flag sent by the calling communication node is 1, it means that the calling communication node has the communication encryption capability.

After receiving the pre-negotiation request from the calling communication node, the called communication node determines whether it has the media capability that overlaps with the calling communication node. The specific determination method is the same as the corresponding determination method in the first communication encryption capability negotiation process Basically the same, the difference is that the current determination method is aimed at the pre-negotiation request. The called communication node also determines whether it has the communication encryption capability, and sends a pre-negotiation response to the calling communication node after determining that it has the communication encryption capability. After receiving the pre-negotiation response from the called communication node, the calling communication node performs basically the same operation as the second or third communication encryption capability negotiation process with the called communication node. Of course, since the called communication node has determined whether it is With the media capability and communication encryption capability, the called communication node does not need to perform the operation of determining the media capability and communication encryption capability in the second and third communication encryption capability negotiation processes.

Step 107: When the called communication node has communication encryption capability, the called communication node initiates a communication encryption capability negotiation process with the calling communication node, and the operations involved in the communication encryption capability negotiation process are substantially the same as those in step 106 , the difference is that: step 107 has an exchange of operation subjects relative to step 106 . Of course, the communication encryption capability information corresponding to the communication encryption capability set in the called communication node represents that the called communication node has encryption communication capability; the media capability information corresponding to the media capability set in the called communication node represents The media capability it has, specifically, the media capability information represents the media codec capability that the called communication node has when performing data communication.

Step 107 and step 106 have no strict time sequence relationship.

In practical applications, only one of step 107 or step 106 may be executed, which will not affect subsequent data encryption communications.

Step 108: Apply existing technology to establish a media channel between the calling and called communication nodes. The specific media channel establishment process is usually: the calling/called communication node sends at least the calling/called communication node to the called/called communication node. The media channel establishment request of the node IP address and the communication port number; / The media channel establishment response of the IP address of the calling communication node and the communication port number. In this way, the calling and called communication nodes obtain the address information used by the other party for data communication, and can perform subsequent data communication according to the address information.

Certainly, if the called/called communication node rejects the media channel establishment request, a channel establishment rejection message is sent to the calling/called communication node, and the channel establishment rejection message may also carry a reason for the rejection.

Step 109: The calling and called communication nodes use the established media channel to perform encrypted data communication. The specific operation is:

The calling/called communication node encrypts the data sent to the called/called communication node by applying the calling/called side data encryption key and the encryption policy, and sends the encrypted encrypted data to the called/called Communication node; the called/called communication node applies the data encryption key of the called/calling side and the encryption strategy to decrypt the encrypted data from the calling/called communication node, and applies the prior art to complete the decryption according to the data Follow up.

Steps 101 to 105 may be implemented by communication protocols such as Q931, and may further include other signaling interactions.

Steps 106 to 109 are usually implemented by the H245 protocol. The communication encryption capability negotiation request can be implemented by a terminal capability request (Terminal Capability Set, TCS), and the communication encryption capability negotiation response can be confirmed by a terminal capability request (Terminal Capability Set, TCS). Set Ack, TCS Ack) realizes, and described media channel establishment request can be realized by open logical channel (Open LogicChannel) message, and described media channel establishes response and can be realized by open logical channel response (OpenLogic Channel Ack), and described channel establishes refusal The message can be implemented by an Open Logic Channel Reject message.

Of course, steps 106 to 109 may further include other signaling interactions, and may also be implemented by other communication protocols; and steps 106 and 107 may also be implemented by a Session Description Protocol (SessionDescription Protocol, SDP).

Step 106 and/or step 107 can be performed at any time before step 109 .

The media capability information may be the name of any communication protocol supported by the calling and called communication nodes, so as to ensure that the receiver knows which communication protocol the sender supports. Such as: G.711, G.723, H.263, RFC 2833, etc. In this way, the calling communication node can send the name of the communication protocol supported by itself as media capability information to the called communication node; the called communication node obtains the communication protocol supported by itself, and compares the name of the communication protocol obtained with the received Whether there is an intersection between the names of the communication protocols, and if there is an intersection, the called communication node determines that it has media capabilities that overlap with the calling communication node. Regardless of the content of the media capability information, in order to ensure that the calling and called communication nodes can communicate normally, the calling and called communication nodes must use the overlapping media capabilities for communication.

The calling and called communication nodes may be a communication terminal, a gateway or a media controller unit (MCU) and the like.

The encryption strategy may be an XOR algorithm, an inversion algorithm, an MD5 algorithm, etc. commonly used at present.

Flow process shown in Fig. 1 can be realized by communication protocols such as Session Initiation Protocol (SIP), H323 agreement, and the encrypted communication in the step 109 is usually for RFC 2833 protocol packet encryption. When the process shown in FIG. 1 is implemented by SIP, step 107 may not be performed, and the key operations in step 106 are divided into steps 101 and 104 to be performed respectively. The specific splitting method is: put the operation of the calling communication node sending the communication encryption capability negotiation request to the called communication node in step 106 into step 101; The operation of the capability negotiation response is performed in step 104 . Furthermore, when the process shown in FIG. 1 is implemented by SIP, step 105 is not executed.

It can be seen from the above description that the method for implementing encrypted communication provided by the present invention improves communication security and user satisfaction.

Claims (10)

1. A method for realizing encrypted communication is characterized in that, the method is used for encrypting at RFC 2833 protocol packets, comprising the following steps: a. When two communication nodes communicate, the first communication node sends its own media capability information and communication encryption capability information to the second communication node; b. According to the media capability information and communication encryption capability information from the first communication node, the second communication node judges whether it has the communication encryption capability and the media capability that overlaps with the first communication node. If so, the first and second communications The node determines the same data encryption key, and uses the intersecting media capabilities and the determined data encryption key to perform encrypted communication; Wherein, the judgment method includes: The second communication node acquires the media capability it has, and compares whether there is an intersection between the acquired media capability and the media capability corresponding to the media capability information from the first communication node, and if there is an intersection, the second communication node determines that it has the same media capability as the first communication node. Communication nodes have overlapping media capabilities; The second communication node inquires communication configuration parameters related to communication encryption capability among its own communication configuration parameters, and if the queried communication configuration parameters support communication encryption, the second communication node determines that it has communication encryption capability. 2. The method according to claim 1, wherein the media capability information is a communication protocol name, and then the method for the second communication node to determine whether itself has a media capability that overlaps with the first communication node is: The second communication node obtains the communication protocol supported by itself, and compares whether there is an intersection between the name of the obtained communication protocol and the communication protocol name from the first communication node, and if there is an intersection, the second communication node determines that it has an intersection with the first communication node Intersecting media capabilities. 3. The method according to claim 1 or 2, wherein the communication configuration parameter related to communication encryption capability is encryption enablement, then in step b, the second communication node judges whether it has communication encryption capability yes: The second communication node queries the encryption enablement in its own communication configuration parameters, and if the queried encryption enablement is set to an enabled state, the second communication node determines that it has communication encryption capability. 4. The method according to claim 1 or 2, wherein the communication encryption capability information is a random number generated by the first communication node or a preset public key, then in step b, the first, The method for the second communication node to determine the data encryption key includes: The second communication node applies a preset encryption policy to encrypt the random number or public key from the first communication node, and uses the encryption result as a data encryption key for subsequent communication with the first communication node; the first communication node applies a preset The encryption strategy encrypts the random number generated by itself or the public key sent to the second communication node, and uses the encryption result as the data encryption key for subsequent communication with the second communication node. 5. The method according to claim 1 or 2, wherein the communication encryption capability information is obtained by encrypting the random number generated by the first communication node by applying a preset encryption policy and a preset public key encryption result, then in step b, the method for determining the data encryption key by the first and second communication nodes includes: The second communication node applies a preset encryption policy and public key to decrypt the communication encryption capability information from the first communication node, and uses the decryption result as a data encryption key for subsequent communications with the first communication node; the first communication node The generated random number is used as a data encryption key for subsequent communication with the second communication node. 6. The method according to claim 1 or 2, wherein the communication encryption capability information is a random number generated by the first communication node or a preset public key, then in step b, the first, The method for the second communication node to determine the data encryption key includes: The second communication node directly uses the random number or public key from the first communication node as the data encryption key for subsequent communication with the first communication node; the first communication node directly sends the random number or public key generated by itself to the second communication node The public key is used as a data encryption key for subsequent communication with the second communication node. 7. The method according to claim 1 or 2, wherein in step b, said performing encrypted communication comprises: The first/second communication node encrypts the data sent to the second/first communication node by applying the data encryption key and the preset encryption policy, and sends the encrypted encrypted data to the second/first communication node a node; a second/first communication node to decrypt encrypted data from the first/second communication node by applying said data encryption key and said encryption policy. 8. The method according to claim 1, characterized in that, before step b or in step b, a media channel for communication is further established between the first communication node and the second communication node. 9. The method according to claim 1, wherein the first communication node and the second communication node are a communication terminal, a gateway or a media controller unit (MCU). 10. The method according to claim 1, wherein the first communication node interacts with the second communication node using the Session Initiation Protocol (SIP) or the H323 protocol.

Images