A full-link voice communication security protection system, method, device and medium based on a national secret algorithm

Abstract

A full-link voice communication security protection system, method and device based on a national secret algorithm and a medium, the system comprising a user end and a server, the user end comprising: a registration login module; a security protection module; an audio / video call module; the server is deployed with multiple functional servers, including a signaling server; a STUN / TURN server; a service server; a verification code server; a CA server; a KGC server; based on the above system, the identity legitimacy of the access system user is ensured by using a man-machine verification code mechanism, and the signaling interaction process of the audio / video communication parties is protected by using the SM2 national secret algorithm, the SM4 national secret algorithm and the SM9 national secret algorithm based on the user identity identification in combination with the PKI system; at the same time, in order to improve the system efficiency and enhance the system compatibility, the P2P communication is constructed by using the WebRTC audio / video call framework, and the transmission safety of the audio / video data is ensured by using the related security transmission protocol, so as to protect the legality of the user and the full-link safety of the data in the instant audio / video communication.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of security encryption technology, and particularly relates to a full-link voice communication security protection system, method, device and medium based on a national cryptographic algorithm. BACKGROUND

[0002] With the rapid development of mobile Internet technology, diversified instant messaging applications based on text, audio, video and other information have gradually become part of people's daily life. Since audio and video calls are more instant, communication between the two parties is more convenient and efficient, and is closer to face-to-face communication in real life. Once users are involved in important or complex events in their work or life, they will tend to prefer audio and video communication to communicate and exchange. However, the existing mainstream instant messaging software only protects key frames for audio and video information, and directly transmits signaling information in clear text or simple serialization during the audio and video call process, which has obvious security risks. At the same time, the "Cryptography Law of the People's Republic of China" clearly states that the state will establish and improve the national commercial cryptography standard system, encourage national commercial cryptography practitioners to use commercial cryptography recommended national standards and industry standards, improve the protection capability of commercial cryptography, and protect the legitimate rights and interests of users. However, the existing mainstream instant messaging software does not provide perfect support for national commercial cryptography algorithms (i.e., national cryptographic algorithms).

[0003] Currently, in the field of instant messaging, the security protection measures of instant messaging systems mainly include the following aspects. By conducting legal identity authentication on users accessing the system, it is ensured that only users authorized by the system can enter the system and perform relevant functional operations. For relevant private data information generated during instant messaging, the system adds relevant security transmission protocols in the transport layer of the TCP / IP four-layer model to establish a secure transmission channel to ensure the security of data transmission. In addition, the system can also add an end-to-end encryption method in the application layer of the TCP / IP four-layer model to provide encryption protection for key private information at the user end, and ensure that the instant messaging data transmitted in the public channel is in the form of ciphertext.

[0004] Encryption algorithms are the cornerstone of secure voice communication systems, used to protect the confidentiality of audio and video data. Researchers have explored various encryption algorithms, such as symmetric and asymmetric encryption algorithms. Among them, symmetric encryption algorithms like AES encryption and decryption algorithms are widely used in voice communication. M.A. Abbasi et al. proposed a voice encryption scheme based on AES in the paper "Secure Voice Communication using Advanced Encryption Standard (AES)" [J]. International Journal of Advanced Computer Science and Applications, 2019, 10(6): 355-360. By grouping and encrypting voice data, the protection of voice communication is achieved, which is an end-to-end encryption method. Identity verification is a key technology to prevent unauthorized access, and it is the basic security guarantee portal of the system. Researchers have proposed various identity verification schemes, including passwords, biometrics, and multi-factor identity verification. For example, R.D. Gawande et al. proposed a voice identity verification system based on biometrics, using the speaker's voiceprint features for identity recognition to ensure the legitimacy of both parties in communication. The diversity of identity verification schemes requires researchers to select the most suitable solution for the current system according to the specific system in practical applications.

[0005] However, the above-mentioned technology is aimed at signaling information generated during audio and video calls, and the system does not undergo a comprehensive security protection process, resulting in potential security leaks.

[0006] When using the secure transmission protocol in the transport layer of the TCP / IP four-layer model to establish a secure transmission channel for data transmission, the signaling negotiation information in the audio and video communication process will pass through the signaling server and undergo a certain storage and analysis process. The signaling information transmitted using only the secure transmission channel is in plaintext form, which cannot guarantee the storage and analysis security and poses a certain risk of information leakage.

[0007] Adding end-to-end encryption and decryption strategies to the application layer of the TCP / IP four-layer model as a security protection measure, during audio and video calls, due to the high real-time requirements and large data volume of audio and video data, using end-to-end encryption will result in unacceptable latency for users, and the risk of missing key frame information due to decryption failure will also increase. Using only end-to-end encryption and decryption strategies to protect key frame information cannot achieve comprehensive security protection for audio and video data.

[0008] The current commonly used user identity authentication methods mainly include biological information assisted authentication and user identification information assisted verification, and the user biological information assisted authentication methods mainly include voiceprint information, face information, palm print information and fingerprint information, etc., which are generally used in secure identity verification scenarios, such as payment scenarios, and are too complex for the registration scenario and cannot fully adapt to the scene requirements. SUMMARY

[0009] In order to overcome the problems existing in the prior art, the purpose of the present application is to disclose a full-link voice communication security protection system, method, device and medium based on a national secret algorithm, which adopts a man-machine verification code mechanism to ensure the identity legality of the access system user, and adopts an SM2 national secret algorithm combined with a PKI system, an SM4 national secret algorithm and an SM9 national secret algorithm based on the user identity to provide protection for the signaling interaction process of the audio and video communication parties; at the same time, in order to improve the system efficiency and enhance the system compatibility, the method and system adopt a WebRTC audio and video call framework to construct a P2P communication, and use a related secure transmission protocol to ensure the transmission safety of the audio and video data, protect the legality of the user and the full-link safety of the data in the instant audio and video communication.

[0010] In order to achieve the above purpose, the following technical solutions are adopted in the present application:

[0011] A full-link voice communication security protection system based on a national secret algorithm, comprising a user end and a server, wherein the user end comprises:

[0012] A registration and login module for verifying and registering the users in the system and logging in;

[0013] A security protection module for performing self-defined standardized security detection on the account password information used by the user during registration and login, ensuring the legality of the user input information and the uniqueness of the account; using the user account as the unique identity identifier of the user in the system, applying for the establishment of the audio and video call and the security protection module key and certificate;

[0014] An audio and video call module based on the WebRTC audio and video call framework, adding expansion and self-defined function points including speaker opening and closing and call mode conversion in the system to expand the practicability of the system; adding a signaling interaction verification mechanism based on caching in the system to establish the audio and video call;

[0015] The server end is deployed with multiple functional servers, comprising:

[0016] A signaling server responsible for the exchange of media negotiation information and network candidate information of both parties during the audio and video call, and responsible for the management of room behavior and user behavior;

[0017] STUN(Session Traversal Utilities for NAT) / TURN(Traversal Using Relays around NAT) server: responsible for the implementation of NAT(Network Address Translation) traversal and the relay function of media data after the failure of NAT traversal;

[0018] Business server: parses the user request, communicates with different functional servers, obtains the response of the functional server and forwards it to the user terminal;

[0019] Verification code server: responsible for the related operation of the mobile phone verification code in the user registration process;

[0020] CA(Certificate Authority) server: implements the generation and management of user certificates in the system;

[0021] KGC(Key Generation Center) server: implements the private key distribution of SM9 national secret algorithm and the distribution of master public key and system information.

[0022] A full-link voice communication security protection method based on a national secret algorithm, specifically comprising the following steps:

[0023] Step 1, verify the legality of the user's identity, and after successful verification, the user logs in to the system;

[0024] Step 2, after verifying the user's identity in step 1, use the national secret algorithm to protect the signaling privacy information generated in the audio and video call process;

[0025] Step 3, based on the signaling privacy information generated in step 2, use the open source WebRTC audio and video call framework to establish a secure transmission channel for audio and video information transmission, and realize the audio and video call function of the user terminal.

[0026] The specific method of step 1 is to verify the user's identity, and after successful verification, the user inputs the self-defined account password; through the interaction between the verification code server and the business server, the legality of the account password and the consistency with the account information during registration are detected and determined, and the detection is successful. Login can be completed.

[0027] The authentication mode of the user identity adopts a mobile phone number auxiliary registration, that is, a verification code generated by a verification code server on a service end is obtained by inputting a mobile phone number, and after verification code verification succeeds, the user can input a self-defined account password to complete registration through a business server; the account information during registration is a unique identifier of a system user, and based on this, subsequent application of a certificate key and establishment of an audio / video call connection are performed.

[0028] The specific method of step 2 is:

[0029] 2.1, SM2 and SM4 national secret algorithms are combined and used, first, a signaling privacy information generated in an audio / video call process is encrypted and decrypted by using a grouped symmetric cipher algorithm in the SM4 national secret algorithm, an SM4 symmetric key is generated in the encryption process; second, the SM2 national secret algorithm is used to encrypt the SM4 symmetric key; then, a certificate module is added in the SM2 national secret algorithm to authenticate public key information in a signaling server, a user end and the signaling server exchange digital certificates through own account information to a CA server before privacy information interaction to ensure the identity legality and the public key legality, and then different information interaction parties, that is, the user end and the signaling server, complete public key information interaction authentication by exchanging certificates;

[0030] 2.2, based on the identity-based characteristics of the SM9 national secret algorithm, a user directly applies for a main public key of a system and system parameters to a KGC server, and then the user obtains public key information of the signaling server through account information of the signaling server and the main public key of the system on the user end, and the user private key information needs to be applied by the user through a unique identifier, that is, a user account, after the KGC server verifies the legality of the user, the private key information of the signaling server is calculated by using the main private key of the system and the identifier of the signaling server and is issued through the business server; the security protection of the signaling privacy information generated in the audio / video call process is realized.

[0031] The specific method of the step 3 is as follows: using an open-source WebRTC audio and video call framework, before the user terminals of the two parties of the audio and video call make the audio and video call through the account information of each other, the signaling privacy information generated in the step 2 is subjected to signaling privacy information negotiation: the signaling privacy information contains media negotiation information and network negotiation information at the same time, the user terminal obtains the public network IP address of the user terminal through a STUN / TURN server to perform network negotiation, and obtains the media negotiation information supported by the local user terminal to perform media negotiation; in the signaling privacy information negotiation process, first, the signaling server is queried to obtain the signaling interaction cache between the two parties of the call, when the signaling interaction cache exists, the cache result is directly used to establish the audio and video call connection, when the signaling interaction cache does not exist or the audio and video call connection cannot be established through the cache, a new round of signaling privacy information interaction is performed; finally, in the audio and video call process, the user terminal performs network transmission through audio and video information collection and coding, and the receiving party can obtain the audio and video information through reverse operation of the sending party after transmission, and in the transmission process, a secure transmission channel is established by using a secure transmission protocol supported by the WebRTC audio and video call framework to perform transmission.

[0032] A device for full-link voice communication security protection based on a national secret algorithm, comprising a memory and a processor, the memory storing a computer program, and the computer program being used to perform the method for full-link voice communication security protection based on the national secret algorithm according to steps 1 to 3 to perform audio and video call.

[0033] A computer readable storage medium storing a computer program, the computer program being executed by a processor to perform the method for full-link voice communication security protection based on the national secret algorithm according to steps 1 to 3 to perform audio and video call.

[0034] Compared with the prior art, the application has the following advantages:

[0035] The application belongs to a privacy information full-link protection strategy in an audio and video call process, and covers various security protection modes, such as an application layer end-to-end encryption protection mode, a transmission layer security link establishment protection mode and a user legal identity authentication protection strategy.

[0036] The application provides encryption protection for the signaling interaction process of two parties of audio-video communication by combining the SM2 national encryption algorithm, the SM4 national encryption algorithm and the SM9 national encryption algorithm based on user identity identification, flexibly uses the most suitable security protection mode for the characteristics of various data according to the specific characteristics of the data generated in the audio-video call process, uses end-to-end encryption mode to perform security protection for the signaling information involving storage risk and clear text transmission, establishes a secure channel to ensure real-time and safe transmission of audio-video data for the audio-video call data with high real-time requirement, and uses the simplest mobile phone auxiliary registration mode to perform security authentication of the internal users of the system.

[0037] The application provides a fast connection establishment mode based on signaling buffering to solve the problem of increased connection delay in the end-to-end encryption process of audio-video call, greatly improves the connection establishment efficiency of secure audio-video call, stores the account information as a key and the signaling interaction result as a value in a database, and stores the signaling interaction result in a chain structure to facilitate the addition, deletion, modification and query operation. When the two parties establish an audio-video connection, the account information of the two parties is first searched in the data table of the signaling server, the buffered result in the server is directly issued to the two parties if the signaling interaction result exists, and a complete signaling interaction process is performed if the signaling interaction result does not exist.

[0038] In summary, the application is a full-link voice communication security protection method based on national encryption algorithm, has the advantages of flexibly adopting a security protection mode according to data requirements, has the advantage of efficiently establishing an audio-video connection based on signaling buffering, and combines the national commercial encryption algorithm SM2, SM4 and the SM9 algorithm based on identity identification encouraged by the country to ensure the security of signaling data in the audio-video connection process. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 It is a system overall structure diagram of the application.

[0040] Figure 2 It is a whole structure diagram of the registration module in the application.

[0041] Figure 3 It is a whole structure diagram of the audio-video call module in the application.

[0042] Figure 4 It is a system security protection system structure diagram in the application. DETAILED DESCRIPTION

[0043] The application will be further described in detail below with reference to the drawings.

[0044] Referring to Figure 1 A full-link voice communication security protection system based on a national secret algorithm, comprising a user end, i.e., a client, and a server, the user end comprising:

[0045] A registration and login module: used for verifying and registering and logging in the user in the system; the structural principle is shown in Figure 2 ;

[0046] A security protection module: used for performing self-defined and standardized security detection on the account and password information used during user registration and login, so as to ensure the legality of the information entered by the user and the uniqueness of the account; the user account is used as the unique identifier of the user in the system, and the establishment of the audio and video call and the application of the security protection module key and the certificate are performed; the structural principle is shown in Figure 3 ;

[0047] An audio and video call module: based on the WebRTC audio and video call framework, the system is added with extended and customized function points including the opening and closing of the loudspeaker and the conversion of the call mode, so as to expand the practicability of the system; the system is added with a signaling interaction verification mechanism based on the cache, so as to establish the audio and video call;

[0048] The server end is deployed with multiple functional servers, comprising:

[0049] A signaling server: responsible for the exchange of the media negotiation information and the network candidate information of both parties during the audio and video call, and responsible for the management of the room behavior and the user behavior;

[0050] A STUN (Session Traversal Utilities for NAT) / TURN (Traversal Using Relays around NAT) server: responsible for the implementation of the NAT (Network Address Translation) traversal and the media data transfer function after the failure of the NAT traversal;

[0051] A service server: used for analyzing the request of the user end, communicating with the functional servers of different server ends, obtaining the response of the functional servers and forwarding the response to the user end;

[0052] A verification code server: responsible for the related operation of the mobile phone verification code during the user registration;

[0053] A CA (Certificate Authority) server: used for generating, issuing and managing the user certificate in the system;

[0054] KGC (Key Generation Center) server: realize the private key distribution for SM9 national secret algorithm and the distribution of main public key and system information.

[0055] Referring to Figure 4 A full-link voice communication security protection method based on a national secret algorithm, specifically comprising the following steps:

[0056] Step 1, verify the legality of the user's identity, and after successful verification, the user logs in the system;

[0057] Step 2, after verifying the user's identity in step 1, use the national secret algorithm to protect the signaling privacy information generated in the audio and video call process;

[0058] Step 3, based on the signaling privacy information generated in step 2, use the open source WebRTC audio and video call framework to establish a secure transmission channel for audio and video information transmission, and realize the audio and video call function of the user end.

[0059] The specific method of step 1 is to use a mobile phone number assisted registration method to verify the user's identity, and after successful verification, the user inputs a custom account password; the legality of the account password and the consistency with the account information at the time of registration are determined by interacting with the verification code server and the business server, and the detection is successful. After successful detection, the login can be completed.

[0060] The method of verifying the user's identity includes mobile phone number assisted registration, that is, by inputting a mobile phone number to obtain a verification code generated by a verification code server on the service side, after the verification code is verified successfully, the user can input a custom account password to complete the registration through the business server; The account information at the time of registration is the unique identifier of the system user, which is used as the basis for subsequent certificate key application and audio and video call connection establishment.

[0061] The specific method of step 2 is:

[0062] 2.1 Combining the SM2 national secret algorithm and the SM4 national secret algorithm, first, the SM4 national secret algorithm is used to encrypt and decrypt the signaling privacy information generated in the process of audio and video call, which has the characteristics of high efficiency and is suitable for large amount of data encryption and decryption, and the SM4 symmetric key is generated in the process of encryption; second, the SM2 national secret algorithm is used to encrypt the SM4 symmetric key, which has the characteristics of high security and is not suitable for large amount of data encryption and decryption; then, the certificate module is added to the SM2 national secret algorithm to authenticate the public key information in the signaling server, and the user end and the signaling server exchange the certificates to complete the public key information interaction authentication before the privacy information interaction.

[0063] 2.2 The SM9 national secret algorithm is used to obtain the main public key and system parameters of the system, and then the public key information of the signaling server is obtained through the account information of the signaling server and the main public key of the system, and the private key information of the user is obtained through the unique identity identifier, i.e. the user account, and the KGC server calculates the private key information of the signaling server through the main private key of the system and the identity identifier of the signaling server, and then sends it through the business server; the security protection of the signaling privacy information generated in the process of audio and video call is realized.

[0064] The specific method of step 3 is to use the open source WebRTC audio and video call framework, and before the user end of the audio and video call party performs audio and video call through each other's account information, the signaling privacy information generated in step 2 is negotiated: the signaling privacy information contains media negotiation information and network negotiation information, and the user end obtains its public IP address through the STUN / TURN server to perform network negotiation, and obtains the media negotiation information supported by the local user end to perform media negotiation; in the process of signaling privacy information negotiation, first, the signaling server queries the signaling interaction cache between the two call users, and when there is a signaling interaction cache, the cache result is directly used to establish an audio and video call connection, and when there is no signaling interaction cache or the audio and video call connection cannot be established through the cache, a new round of signaling privacy information interaction is performed; finally, the user end in the process of audio and video call transmits the audio and video information through encoding, and the receiving end performs the inverse operation of the sending end to obtain the audio and video information, and the secure transmission protocol supported by the WebRTC audio and video call framework is used to establish a secure transmission channel for transmission.

[0065] A device for protecting the security of full-link voice communication based on a national encryption algorithm, comprising a memory and a processor, the memory storing a computer program, and the computer program being used to perform the method for protecting the security of full-link voice communication based on a national encryption algorithm according to steps 1 to 3 to conduct audio and video calls.

[0066] A computer-readable storage medium storing a computer program, the computer program being executed by a processor to enable the method for protecting the security of full-link voice communication based on a national encryption algorithm according to steps 1 to 3 to implement audio and video calls.

[0067] Performance tests show that:

[0068] The existing audio and video communication system directly transmits the signaling information in clear text or simple serialization during the audio and video call process, which has obvious security risks, and does not provide perfect support for the national commercial encryption algorithm.

[0069] Compared with the audio and video call system without the protection system, the audio and video call system adopting the safety protection method of the application guarantees the full-link safety of data of the user in instant audio and video communication. Meanwhile, the client function of the system is realized based on the Android 13.0 version, the server function is realized based on the Ubunto 22.04 version of the Linux system, and the functions and performance of each module of the system are comprehensively tested. The test result shows that each function module in the system runs well and meets the design expectation. Meanwhile, during the safe audio and video call, the average CPU occupancy of the mobile client is 23%, the average occupied memory space is 150M, and the average overall running time of the encryption suite is 30ms, so that the system overhead is reasonable, and the system can long-term, stable, reliable and efficient provide the user with the safe audio and video call function. For the safety protection module in the system, different encryption and decryption algorithms are contained, which have different use scenarios and scene time consumption. The SM4 national encryption algorithm symmetric encryption and decryption algorithm has a fixed length, and in the system, the encryption and decryption time consumption of the media negotiation information with a length of about 5200 bytes and the network negotiation information with a length of about 430 bytes. The different asymmetric encryption and decryption algorithms, i.e. the asymmetric encryption and decryption algorithms of the SM2 national encryption algorithm and the asymmetric encryption and decryption algorithms of the SM9 national encryption algorithm, have the encryption and decryption time consumption of the same length SM4 symmetric key, i.e. 128-bit symmetric key. After about 1000 tests, the average result is shown in Table 1. It can be known from the encryption and decryption performance test result in Table 1 that the running time of the application, i.e. the sum of the running time of the SM4 symmetric encryption algorithm and the running time of the SM2 national encryption algorithm or the SM9 national encryption algorithm asymmetric encryption algorithm, is basically within 30ms, which is acceptable for the whole audio and video call establishment process. At the same time, the decryption time consumption is shorter than the encryption time consumption to a certain extent, so that the running efficiency of the added encryption and decryption in the system is very excellent, and the total running time is completely within the acceptable range, which will not cause too much time overhead to the system.

[0070] Table 1

[0071] Encryption type Encryption time Decryption time SM4 symmetric encryption media negotiation information 3.0 ms SM4 symmetric decryption media negotiation information 2.8 ms SM4 symmetric encryption network negotiation information 1.6 ms SM4 symmetric decryption network negotiation information 0.9 ms SM2 public key encryption 28.8 ms SM2 private key decryption 22.4 ms SM9 public key encryption 20.3 ms SM9 private key decryption 18.7 ms

Claims

1. A full-link voice communication security protection system based on national cryptographic algorithms, comprising a user terminal and a server terminal, characterized in that, The user terminal includes: Registration and login module: Used for user verification, registration, and login within the system; Security Protection Module: Used to perform customized and standardized security checks on the account and password information used during user registration and login, ensuring the legality of the information entered by the user and the uniqueness of the account; using the user account as the unique identifier of the user within the system, for establishing audio and video calls and applying for security protection module keys and certificates; Audio and video call module: Based on the WebRTC audio and video call framework, the system adds extended custom functions such as speaker on / off and call mode switching to expand the system's usability; a cache-based signaling interaction verification mechanism is added to the system to establish audio and video calls; The server-side deployment includes multiple functional servers, including: Signaling server: responsible for exchanging media negotiation information and network candidate information between the two parties during audio and video calls, and also responsible for managing room behavior and user behavior; STUN (Session Traversal Utilities for NAT) / TURN (Traversal Using Relaysaround NAT) server: responsible for implementing NAT (Network Address Translation) traversal and relaying media data after NAT traversal fails; Business server: It parses user requests, communicates with functional servers on different servers, obtains responses from functional servers, and forwards them to the user. Verification code server: Responsible for handling mobile phone verification codes during user registration; CA (Certificate Authority) server: Implements the generation, distribution, and management of user certificates in the system; KGC (Key Generation Center) server: Enables the distribution of private keys, master and public keys, and system information for the SM9 national cryptographic algorithm.

2. A full-link voice communication security protection method based on national cryptographic algorithms, based on the system described in claim 1, characterized in that, Specifically, the following steps are included: Step 1: Verify the legitimacy of the user's identity. After successful verification, the user can log in to the system. Step 2: After verifying the user's identity in Step 1, use national cryptographic algorithms to protect the signaling privacy information generated during audio and video calls. Step 3: Based on the signaling privacy information generated in Step 2, use the open-source WebRTC audio and video call framework to establish a secure transmission channel for audio and video information transmission, thereby realizing the audio and video call function on the user end.

3. The end-to-end voice communication security protection method based on national cryptographic algorithms according to claim 2, characterized in that, The specific method of step 1 is as follows: verify the user's identity. After successful verification, the user enters a custom account and password. The verification code server interacts with the business server to detect and determine the legality of the account and password and their consistency with the account information during registration. If the detection is successful, the login is completed.

4. The end-to-end voice communication security protection method based on national cryptographic algorithms according to claim 3, characterized in that, The user identity verification method includes mobile phone number-assisted registration, which involves entering a mobile phone number to obtain a verification code generated by the verification code server on the server side. After the verification code is successfully verified, the user can enter a custom account and password to complete the registration through the business server. The account information during registration is the unique identifier of the system user, and this is used as the basis for subsequent certificate key applications and the establishment of audio and video call connections.

5. A method for end-to-end voice communication security protection based on national cryptographic algorithms according to claim 2, characterized in that, The specific method for step 2 is as follows: 2.1 The SM2 and SM4 national cryptographic algorithms are combined. First, the block symmetric cipher algorithm in the SM4 national cryptographic algorithm is used to encrypt and decrypt the signaling privacy information generated during audio and video calls, generating an SM4 symmetric key during the encryption process. Second, the asymmetric algorithm of the SM2 national cryptographic algorithm is used to encrypt the SM4 symmetric key. Then, a certificate module is added to the SM2 national cryptographic algorithm to authenticate the public key information in the signaling server. Before exchanging privacy information, the user terminal and the signaling server apply for digital certificates from the CA server using their account information to ensure the legitimacy of their identity and public key. Afterwards, the different information exchange parties, namely the user terminal and the signaling server, complete the public key information exchange authentication by exchanging certificates. 2.2 Utilizing the identifier-based characteristics of the SM9 national cryptographic algorithm, users directly apply to the KGC server for the system's master public key and system parameters. Then, on the user's end, the public key information of the signaling server is obtained through the account information of the signaling server and the system's master public key. The user's private key information needs to be applied for by the user through a unique identifier, i.e., the user account. After verifying the user's legitimacy, the KGC server calculates the private key information of the signaling server using the system's master private key and the identity identifier of the signaling server, and then distributes it through the business server. To achieve secure protection of signaling privacy information generated during audio and video calls.

6. The end-to-end voice communication security protection method based on national cryptographic algorithms according to claim 2, characterized in that, The specific method of step 3 is as follows: using the open-source WebRTC audio and video call framework, before the user terminals of both parties in the audio and video call conduct audio and video calls through each other's account information, the signaling privacy information generated in step 2 is negotiated: the signaling privacy information includes both media negotiation information and network negotiation information. The user terminal obtains its own public IP address through the STUN / TURN server to conduct network negotiation, and obtains the media negotiation information supported by the local user terminal to conduct media negotiation. During the signaling privacy information negotiation process, the signaling server first queries the signaling interaction cache between the two users in the call. If a signaling interaction cache exists, the cached result is used directly to establish an audio and video call connection. If no signaling interaction cache exists or an audio and video call connection cannot be established through the cache, a new round of signaling privacy information exchange is initiated. Finally, during the audio and video call, the user end transmits the audio and video information over the network by collecting and encoding the audio and video information. After transmission to the receiver, the receiver can obtain the audio and video information by performing the reverse operation of the sender. During transmission, the secure transmission protocol supported by the WebRTC audio and video call framework is used to establish a secure transmission channel for transmission.

7. A device for end-to-end voice communication security protection based on national cryptographic algorithms, characterized in that, include: A memory and a processor, wherein the memory stores a computer program for executing the computer program to perform audio and video calls according to the method for end-to-end voice communication security protection based on national cryptographic algorithms as described in any one of claims 2 to 6.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it can realize audio and video calls based on the method of full-link voice communication security protection based on national cryptographic algorithms as described in any one of claims 2 to 6.

Images