Communication method, device, equipment, storage medium and program product

Abstract

The present application provides a communication method, device, equipment, storage medium and program product. The embodiments of the present invention can be applied to various scenarios such as cloud technology, artificial intelligence, smart transportation, and assisted driving. The communication method may include: accessing a signaling server to trigger a two-way authentication between a first terminal and the signaling server; after the two-way authentication between the first terminal and the signaling server is successful, generating a video connection establishment request; signing the video connection establishment request; encrypting the video connection establishment request and the signature of the video connection establishment request to obtain a first encryption result; transmitting the first encryption result to the signaling server, so that the signaling server transmits the first encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal. Thereby, the secure transmission of the video connection establishment request can be guaranteed, and the security of video transmission can be guaranteed.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and more particularly to a communication method, apparatus, device, storage medium, and program product. Background Art

[0002] In vehicle video application scenarios such as sentry mode and remote driving, the vehicle and the user terminal can transmit videos based on the Web Real-Time Communication (webRTC) point to point (P2P) mechanism, allowing users to view vehicle videos or remotely drive through the user terminal.

[0003] Specifically, in the stage of initiating a video connection, the user terminal can exchange information related to establishing a video connection, such as the Session Description Protocol (SDP) and the Interactive Connectivity Establishment (ICE) through the signaling server; in the video transmission stage, the user terminal and the vehicle end can exchange video encryption keys through DTLS, and further, the user terminal and the vehicle end can use the video encryption key to encrypt and transmit the video through the Secure Real-time Transport Protocol (SRTP). In the SDP process, the user terminal can send a video connection establishment request to the vehicle end, through which Datagram Transport Layer Security (DTLS) parameters can be transmitted, such as the signature of the user terminal's public key certificate, and the parameters carried in the request directly affect whether the video encryption key can be securely transmitted, and thus whether the video can be securely transmitted.

[0004] Currently, the user terminal forwards the video connection establishment request to the vehicle end through the signaling server. This method has the problem of low security in the transmission of the request, which in turn leads to the problem of low security in video transmission. Summary of the invention

[0005] The present application provides a communication method, apparatus, device, storage medium and program product, thereby ensuring the secure transmission of a video connection establishment request, thereby ensuring the security of video transmission.

[0006] In a first aspect, a communication method is provided, which is applied to a first terminal, and the method includes: accessing a signaling server to trigger two-way authentication between the first terminal and the signaling server; after the two-way authentication between the first terminal and the signaling server is successful, generating a video connection establishment request; signing the video connection establishment request; encrypting the video connection establishment request and the signature of the video connection establishment request to obtain a first encryption result; transmitting the first encryption result to the signaling server, so that the signaling server transmits the first encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal.

[0007] In a second aspect, a communication method is provided, which is applied to a second terminal, and the method includes: accessing a signaling server to trigger two-way authentication between the second terminal and the signaling server; after the two-way authentication between the second terminal and the signaling server is successful, receiving a first encryption result sent by the signaling server through a dedicated channel between the first terminal and the second terminal; the first encryption result is an encryption result obtained by the first terminal signing a video connection establishment request and encrypting the video connection establishment request and the signature of the video connection establishment request; decrypting the first encryption result to obtain the video connection establishment request and the signature of the video connection establishment request; and verifying the signature of the video connection establishment request.

[0008] According to a third aspect, a communication device is provided, which is a first terminal and includes: a processing module and a communication module, wherein the processing module is used to: access a signaling server to trigger two-way authentication between the first terminal and the signaling server; after the two-way authentication between the first terminal and the signaling server is successful, generate a video connection establishment request; sign the video connection establishment request; encrypt the video connection establishment request and the signature of the video connection establishment request to obtain a first encryption result; and the communication module is used to: transmit the first encryption result to the signaling server, so that the signaling server transmits the first encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal.

[0009] In a fourth aspect, a communication device is provided, which is a second terminal and includes: a processing module and a communication module; the processing module is used to access a signaling server to trigger two-way authentication between the second terminal and the signaling server; the communication module is used to receive a first encryption result sent by the signaling server through a dedicated channel between the first terminal and the second terminal after the two-way authentication between the second terminal and the signaling server is successful; the first encryption result is an encryption result obtained by the first terminal signing a video connection establishment request and encrypting the video connection establishment request and the signature of the video connection establishment request; the processing module is also used to decrypt the first encryption result to obtain the video connection establishment request and the signature of the video connection establishment request; the processing module is also used to verify the signature of the video connection establishment request.

[0010] In a fifth aspect, an electronic device is provided, comprising: a processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, and executing a method as in any one of the first to second aspects or any of their implementations.

[0011] In a sixth aspect, a computer-readable storage medium is provided for storing a computer program, wherein the computer program enables a computer to execute a method as in any one of the first to second aspects or any of their implementations.

[0012] In a seventh aspect, a computer program product is provided, comprising computer program instructions, wherein the computer program instructions enable a computer to execute a method as in any one of the first to second aspects or any implementation thereof.

[0013] In an eighth aspect, a computer program is provided, which enables a computer to execute the method in any one of the first to second aspects or their respective implementations.

[0014] Through the technical solution provided by the present application, since there is a secure exclusive channel between the first terminal and the second terminal, other illegal user terminals can be prevented from accessing the signaling server, and the first terminal can sign and encrypt the above-mentioned video connection establishment request for transmission, thereby preventing an illegal signaling server from tampering with the video connection establishment request. In short, the secure transmission of the video connection establishment request can be guaranteed, thereby ensuring the security of video transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 It is a flow chart of a video transmission method based on webRTC P2P mechanism;

[0017] Figure 2 An application scenario diagram of the technical solution of the present application is exemplarily shown;

[0018] Figure 3 An interactive flow chart of a communication method provided in an embodiment of the present application;

[0019] Figure 4 An interactive flow chart of another communication method provided in an embodiment of the present application;

[0020] Figure 5An interactive flow chart of another communication method provided in an embodiment of the present application;

[0021] Figure 6 An interactive flow chart of another communication method provided in an embodiment of the present application;

[0022] Figure 7 A schematic diagram of a communication device 700 provided in an embodiment of the present application;

[0023] Figure 8 A schematic diagram of a communication device 800 provided in an embodiment of the present application;

[0024] Fig. 9 It is a schematic block diagram of an electronic device 900 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0027] Before introducing the technical solution of this application, the relevant knowledge of the technical solution of this application will be explained below:

[0028] Two-way authentication: Both parties to be authenticated need to authenticate each other's identities.

[0029] Symmetric key encryption: also known as private key encryption or shared key encryption, that is, the parties sending and receiving data use the same key to encrypt and decrypt plaintext.

[0030] Asymmetric key: A pair of keys, one for encryption and the other for decryption.

[0031] Signature: Also known as digital signature, it is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also an effective proof of the authenticity of the information sent by the sender. Digital signature is the application of asymmetric key encryption technology and digital summary technology. For example, the SHA256+RSA algorithm can be used to implement signature.

[0032] RSA: It is the most influential public key encryption algorithm at present. It can resist all known cryptographic attacks so far and has been recommended by the International Organization for Standardization (ISO) as a public key data encryption standard. RSA is an asymmetric encryption algorithm, that is, the encryption key is different from the decryption key. The content encrypted with the private key can only be decrypted by the public key, and the content encrypted with the public key can only be decrypted by the private key.

[0033] SHA-256: For any length of message, SHA256 will generate a 256-bit hash value, called a message digest. This digest is equivalent to an array of 32 bytes in length, usually represented by a hexadecimal string of length 64, where 1 byte = 8 bits and a hexadecimal character is 4 bits long.

[0034] Certificate: includes the subject's public key value, subject identifier information, validity period, issuer identifier information, and issuer's signature.

[0035] Figure 1 It is a flow chart of the video transmission method based on the webRTC P2P mechanism, such as Figure 1 As shown, the video transmission method includes: a video connection initiation stage and a video transmission stage. In the video connection initiation stage, the user terminal can use the SDP protocol to send a video connection establishment request (offer) to the vehicle end through the signaling server, and receive a video connection establishment reply (answer) sent by the vehicle end through the signaling server using the SDP protocol. The offer can carry at least one of the following, but is not limited to:

[0036] a=ice-ufrag:khLS;

[0037] a=ice-pwd:cxLzteJaJBou3DspNaPsJhlQ;

[0038] a=fingerprint:sha-256

[0039] FA:14:42:3B:C7:97:1B:E8:AE:0C2:71:03:05:05:16:8F:B9:C7:98:E9:60:43:4B:5B:2C:28:EE:5C:8F3:17

[0040] a=setup:actpass

[0041] Among them, a=ice-ufrag:khLS is the session identifier a=ice-pwd:cxLzteJaJBou3DspNaPsJhlQ is the key used in the ICE stage. a=fingerprint:sha-256 is the signature of the public key certificate of the user terminal to be used in the DTLS process a=setup:actpass is the working mode, including: client and / or server mode.

[0042] The vehicle side can carry confirmation and selection of various information in the offer in the answer.

[0043] Furthermore, the user terminal may send a Simple Traversal of UDP over NATs (STUN) request to the vehicle side, and receive a STUN response sent by the vehicle side, so as to find a path between the user terminal and the vehicle side.

[0044] During the video transmission phase, the user terminal and the vehicle end exchange video encryption keys through the interaction of DTLS signaling. Furthermore, the user terminal and the vehicle end can use the video encryption key to encrypt and transmit the video through SRTP.

[0045] As mentioned above, the offer can pass DTLS parameters, such as the signature of the public key certificate of the user terminal, and the parameters carried in the offer directly affect whether the video encryption key can be securely transmitted, and thus whether the video can be securely transmitted. Currently, the user terminal forwards the video connection establishment request to the vehicle through the signaling server. This method has the problem of low security in the transmission of the request, which in turn leads to low security in video transmission.

[0046] In order to solve the above technical problems, a secure exclusive channel can be built between the vehicle and the user terminal, and the above requests can be signed and encrypted for transmission.

[0047] Figure 2 The application scenario diagram of the technical solution of the present application is shown exemplarily, such as Figure 2As shown, the user terminal 210 and the vehicle terminal 220 can communicate with the signaling server 230 to establish a video connection. The established video connection can be a P2P mode video connection, that is, the user terminal 210 and the vehicle terminal 220 can communicate directly, or the established video connection can also be a forwarding-based video connection, that is, the user terminal 210 and the vehicle terminal 220 can forward the communication through the forwarding server 240.

[0048] Optionally, the forwarding server 240 and the signaling server 230 may be the same server or different servers.

[0049] Optionally, the user terminal 210, the vehicle terminal 220 and the signaling server 230 may be directly or indirectly connected via wired or wireless communication, which is not limited in this application. For example, the communication between the user terminal 210, the vehicle terminal 220 and the signaling server 230 may be based on the fifth generation (5G) communication system, the fourth generation (4G) communication system, the third generation (3G) communication system, wireless fidelity (WiFi) or other wireless communication technologies.

[0050] Optionally, the user terminal 210 can be a mobile phone, a computer, an intelligent voice interaction device, a smart home appliance, a vehicle terminal, an aircraft, etc., but is not limited thereto.

[0051] Optionally, the signaling server 230 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0052] Optionally, the forwarding server 240 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0053] The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc. For example, it can be applied to vehicle video application scenarios such as sentry mode and remote driving.

[0054] It should be understood that the sentry mode refers to detecting potential threats through the vehicle's external cameras, such as detecting whether someone is approaching the vehicle or whether the vehicle has been damaged.

[0055] The technical solution of this application will be described in detail below:

[0056] Figure 3The interactive flow chart of a communication method provided in an embodiment of the present application, the execution subject involved in the method may include: a first terminal, a second terminal and a signaling server, the first terminal may be Figure 2 The user terminal 210 in the second terminal may be Figure 2 The vehicle end 220 in the embodiment of the present invention is not limited thereto. Figure 3 As shown, the method includes:

[0057] S301: The first terminal accesses the signaling server to trigger a two-way authentication between the first terminal and the signaling server;

[0058] S302: The second terminal accesses the signaling server to trigger two-way authentication between the second terminal and the signaling server;

[0059] S303: After the two-way authentication between the first terminal and the signaling server is successful, the first terminal generates a video connection establishment request;

[0060] S304: The first terminal signs the video connection establishment request;

[0061] S305: The first terminal encrypts the video connection establishment request and the signature of the video connection establishment request to obtain a first encryption result;

[0062] S306: The first terminal transmits the first encryption result to the signaling server;

[0063] S307: The signaling server transmits the first encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal;

[0064] (Optionally) S308: The second terminal decrypts the first encryption result to obtain the video connection establishment request and the signature of the video connection establishment request;

[0065] (Optionally) S309: The second terminal verifies the signature of the video connection establishment request.

[0066] Optionally, the signaling server can establish a mapping relationship between the first terminal and the second terminal, that is, form an exclusive channel between the first terminal and the second terminal, and the exclusive channel is used to realize transparent forwarding of signaling between the first terminal and the second terminal. Based on this, only the first terminal and the second terminal can communicate through the exclusive channel, and other user terminals cannot communicate with the second terminal through the signaling server.

[0067] Optionally, before the first terminal and the second terminal access the signaling server, the first terminal and the second terminal can register on the signaling server to register at least one of the token, certification authority (CA) certificate and hardware information of the first terminal to the signaling server, and register at least one of the token, CA certificate and hardware information of the second terminal to the signaling server, and the user can also configure the user password of the second terminal for the second terminal. Both the first terminal and the second terminal can be configured with the CA certificate of the signaling server. Based on this, two-way authentication between the first terminal and the signaling server and two-way authentication between the second terminal and the signaling server are realized.

[0068] Optionally, the hardware information may include at least one of the following, but is not limited thereto: a chip serial number, a media access control (MAC) address.

[0069] Optionally, the user can initiate a video connection through an application (Application, APP) on the first terminal for realizing video transmission between the first terminal and the second terminal, select the second terminal to be connected, and enter the user password of the second terminal. When the user initiates a video connection through the APP, the first terminal will access the signaling server. After the user selects the second terminal, the second terminal will access the signaling server.

[0070] Optionally, if the signaling server is registered with at least one of the token and hardware information of the first terminal, the two-way authentication process between the first terminal and the signaling server can be as follows: the first terminal generates a random number, encrypts the random number using the public key in the CA certificate of the signaling server, and sends the encrypted result to the signaling server. The signaling server decrypts the random number using the private key corresponding to the CA certificate, and encrypts the decrypted result using the private key, and compares the encryption result obtained from the first terminal with the encryption result generated by itself to see if they are consistent. If they are consistent, the first terminal successfully authenticates the signaling server. If they are inconsistent, the first terminal fails to authenticate the signaling server. The first terminal can use a hash algorithm to encrypt at least one of its token and hardware information, and send the encrypted result to the signaling server. The signaling server can also use the same hash algorithm to encrypt at least one of the hardware information of the first terminal to obtain an encrypted result, and compare the two encryption results to see if they are consistent. If they are consistent, the signaling server successfully authenticates the first terminal. If they are inconsistent, the signaling server fails to authenticate the first terminal.

[0071] Optionally, if the signaling server is registered with the CA certificate of the first terminal, the two-way authentication process between the first terminal and the signaling server can be as follows: The authentication process of the first terminal to the signaling server can refer to the above. The signaling server can generate a random number, encrypt the random number with the public key in the CA certificate of the first terminal, send the encrypted result to the first terminal, the first terminal decrypts it with the private key corresponding to the CA certificate, and encrypts the decrypted result with the private key, compares the encryption result obtained from the signaling server with the encryption result generated by itself, if they are consistent, the signaling server successfully authenticates the first terminal, if not, the signaling server fails to authenticate the first terminal.

[0072] Optionally, if the signaling server is registered with at least one of the token and hardware information of the first terminal and the CA certificate, the two-way authentication process between the first terminal and the signaling server can be as follows: The authentication process of the first terminal to the signaling server can refer to the above. The first terminal can use a hash algorithm to encrypt at least one of its token and hardware information, and send the encryption result to the signaling server. The signaling server can also use the same hash algorithm to encrypt at least one of the hardware information of the first terminal to obtain an encryption result. The signaling server can compare the two encryption results. The signaling server can generate a random number, encrypt the random number with the public key in the CA certificate of the first terminal, and send the encryption result to the first terminal. The first terminal decrypts it with the private key corresponding to the CA certificate, and encrypts the decryption result with the private key, and compares the encryption result obtained from the signaling server and the encryption result generated by itself. If the signaling server determines that the two sets of encryption results are consistent, the signaling server successfully authenticates the first terminal. If the signaling server determines that at least one of the two sets of encryption results is inconsistent, the signaling server fails to authenticate the first terminal.

[0073] It should be understood that the two-way authentication process between the second terminal and the signaling server may refer to the two-way authentication process between the first terminal and the signaling server, and the embodiments of the present application will not be described in detail.

[0074] It should be understood that if the two-way authentication between the first terminal and the signaling server is successful, and the two-way authentication between the second terminal and the signaling server is successful, then the exclusive channel between the first terminal and the second terminal is a secure exclusive channel. This is because even if an illegal user terminal steals the identity of the first terminal, it accesses the above-mentioned exclusive channel, but because it has not registered its identity on the signaling server and does not have the CA certificate of the signaling server, the two-way authentication between it and the signaling server fails.

[0075] Optionally, the video connection establishment request can be Figure 1 The video connection establishment request in is exactly the same as Figure 1 The video connection establishment request in the video connection establishment request is not exactly the same. For example, the request may include at least one of the following: a public key certificate of a first asymmetric key, a signature of a public key certificate, audio and video parameters, an identifier of a requested video transmission mode, an identifier of a distribution algorithm for a video encryption key, an identifier of a first terminal, an identifier of a second terminal, a timestamp, a session identifier, a key used in the ICE stage, a working mode, etc.

[0076] Optionally, the first asymmetric key is generated by the first terminal.

[0077] Optionally, the audio and video parameters include: compression encoding format, resolution, etc., but are not limited thereto.

[0078] Optionally, the video transmission mode may be a P2P video transmission mode or a forwarding-based video transmission mode.

[0079] Optionally, the distribution algorithm of the video encryption key may be an RSA algorithm or a key exchange algorithm (Diffie-Hellman, DH) algorithm, etc.

[0080] Optionally, in a remote driving scenario, the video connection establishment request may further include: an identifier for establishing a data channel, etc., where the data channel is used to transmit control information, such as control information for controlling the brakes, control information for controlling the throttle, etc.

[0081] Optionally, the first terminal may use the SHA256+RSA signature algorithm to sign the video connection establishment request. In other words, the first terminal may first use the SHA256 algorithm on the video connection establishment request to obtain a hash value, i.e., a digest, and then encrypt the hash value through RSA to obtain a signature of the video connection establishment request.

[0082] Optionally, the first terminal may use a private key of a public key certificate of the first asymmetric key or a third-party key to sign the video connection establishment request.

[0083] Optionally, the third-party key may be a key generated by a signing server or an application server corresponding to the above APP, and the first terminal may call back the third-party key generated by the signing server or the application server through a software development kit (SDK).

[0084] Optionally, if the video connection establishment request includes: a signature of a public key certificate of the first asymmetric key, the first terminal may use a private key of the public key certificate of the first asymmetric key or a third-party key to sign the public key certificate of the first asymmetric key, wherein signing the public key certificate of the first asymmetric key by the private key of the public key certificate of the first asymmetric key may be referred to as self-signing. For an explanation of the third-party key, please refer to the above.

[0085] It should be understood that the signature of the video connection establishment request is to prevent the video connection establishment request from being tampered with. The first terminal needs to send the video connection establishment request and the signature of the request to the second terminal through the signaling server. In order to prevent the video connection establishment request from being tampered with by an illegal signaling server, the video connection establishment request and the signature of the request need to be encrypted.

[0086] Optionally, the first terminal may encrypt the video connection establishment request and the signature of the request using the user password of the second terminal, or may encrypt the video connection establishment request and the signature of the request using the user password and a dynamic password of the second terminal.

[0087] Optionally, after receiving the first encryption result, the second terminal may also use the same password as the first terminal to decrypt the first encryption result. For example, when the first terminal uses the user password of the second terminal to encrypt the video connection establishment request and the signature of the request, the second terminal also uses the user password of the second terminal to decrypt the first encryption result. When the first terminal uses the user password and dynamic password of the second terminal to encrypt the video connection establishment request and the signature of the request, the second terminal also uses the user password and dynamic password of the second terminal to decrypt the first encryption result.

[0088] Optionally, the dynamic password uniquely corresponds to the session identifier, that is, the dynamic passwords corresponding to the same session identifier are the same, based on which it can be ensured that the dynamic passwords used by the first terminal and the second terminal are the same.

[0089] Optionally, after the second terminal obtains the video connection establishment request and the signature of the video connection establishment request, if the signature of the video connection establishment request is obtained through the SHA256+RSA algorithm, the second terminal can first decrypt the signature through the public key of the public key certificate of the first asymmetric key or the third-party key to obtain a hash value, and then the second terminal can use SHA256 on the video connection establishment request to obtain a hash value, and compare the two hash values. If the two hash values ​​are the same, it means that the signature of the video connection establishment request is legal, otherwise, it means that the signature of the video connection establishment request is illegal.

[0090] Optionally, if the video connection establishment request includes: the signature of the public key certificate of the first asymmetric key, then after the first terminal successfully verifies the signature of the video connection establishment request, it can also verify the signature of the public key certificate. The verification process can refer to the verification process of the video connection establishment request, and this application will not go into details.

[0091] In the embodiment of the present application, there is a secure dedicated channel between the first terminal and the second terminal, so that other illegal user terminals can be prevented from accessing the signaling server, and the first terminal can sign and encrypt the above-mentioned video connection establishment request for transmission, so as to prevent the illegal signaling server from tampering with the video connection establishment request. In short, the secure transmission of the video connection establishment request can be guaranteed, thereby ensuring the security of video transmission.

[0092] Furthermore, the signaling server may authenticate the first terminal and the second terminal based on the hardware information of the first terminal and the second terminal, which may reduce the risk of identity forgery of the first terminal and the second terminal.

[0093] It should be understood that, in order to achieve the purpose of video connection establishment negotiation, after the first terminal sends a video connection establishment request to the second terminal, the second terminal may send a video connection establishment reply to the first terminal.

[0094] It should be understood that the video connection establishment response may carry confirmation and selection of various information in the video connection establishment request.

[0095] Optionally, the video connection establishment reply can be Figure 1 The video connection establishment reply in the video connection establishment reply may be exactly the same or not exactly the same. For example, when the video connection establishment request includes: an identifier of the requested video transmission mode, such as requesting a P2P video transmission mode, the second terminal can confirm whether the P2P video transmission mode is applicable.

[0096] Optionally, in a remote driving scenario, when the video connection establishment request includes: an identifier for establishing a data channel, etc., the video connection establishment response may include: agreement to establish the data channel and the certificate corresponding to each data channel, and subsequent data in the data channel can be signed using the corresponding certificate.

[0097] Optionally, the second terminal may send the video connection establishment response in plain text to the first terminal through the signaling server, or may sign and encrypt the video connection establishment response and send the encryption result to the first terminal through the signaling server.

[0098] Alternatively, if Figure 4 As shown, after the above S309, the communication method may further include the following steps:

[0099] S310: The second terminal generates a video connection establishment response;

[0100] S311: The second terminal signs the video connection establishment reply;

[0101] S312: The second terminal encrypts the video connection establishment reply and the signature of the video connection establishment reply to obtain a second encryption result;

[0102] S313: The second terminal transmits the second encryption result to the signaling server;

[0103] S314: The signaling server transmits the second encryption result to the first terminal through a dedicated channel between the first terminal and the second terminal;

[0104] S315: The first terminal decrypts the second encryption result to obtain a video connection establishment reply and a signature of the video connection establishment reply;

[0105] S316: Verify the signature of the video connection establishment reply.

[0106] Optionally, the second terminal may use the SHA256+RSA signature algorithm to sign the video connection establishment reply. In other words, the second terminal may first use the SHA256 algorithm to the video connection establishment reply to obtain a hash value, i.e., a digest, and then encrypt the hash value through RSA to obtain a signature of the video connection establishment reply.

[0107] Optionally, the second terminal may use the private key of the public key certificate of the second asymmetric key or a third-party key to sign the video connection establishment reply.

[0108] Optionally, the second asymmetric key is generated by the second terminal.

[0109] It should be understood that if the second terminal uses the private key of the public key certificate of the second asymmetric key to sign the video connection establishment reply, then before sending the video connection establishment reply, the second terminal needs to send the public key certificate of the second asymmetric key to the first terminal, so that the second terminal can verify the signature of the video connection establishment reply through the public key in the public key certificate.

[0110] It should be understood that the explanation about the third-party key can be found above, and this application will not go into details.

[0111] It should be understood that the signature of the video connection establishment reply is to prevent the video connection establishment reply from being tampered with. The second terminal needs to send the video connection establishment reply and the signature of the reply to the first terminal through the signaling server. In order to prevent the video connection establishment reply from being tampered with by an illegal signaling server, the video connection establishment reply and the signature of the reply need to be encrypted.

[0112] Optionally, the second terminal may encrypt the video connection establishment reply and the signature of the reply using the user password of the second terminal, or may encrypt the video connection establishment reply and the signature of the reply using the user password and a dynamic password of the second terminal.

[0113] Optionally, after receiving the second encryption result, the first terminal may also use the same password as the second terminal to decrypt the second encryption result. For example, when the second terminal uses the user password of the second terminal to encrypt the video connection establishment reply and the signature of the reply, the first terminal also uses the user password of the second terminal to decrypt the second encryption result. When the second terminal uses the user password and dynamic password of the second terminal to encrypt the video connection establishment reply and the signature of the reply, the first terminal also uses the user password and dynamic password of the second terminal to decrypt the second encryption result.

[0114] It should be understood that the explanation of the dynamic password can be found above, and this application will not go into details.

[0115] Optionally, after the first terminal obtains the video connection establishment reply and the signature of the video connection establishment reply, if the signature of the video connection establishment reply is obtained through the SHA256+RSA algorithm, the first terminal can first decrypt the signature through the public key of the public key certificate of the second asymmetric key or the third-party key to obtain a hash value, and then the first terminal can use SHA256 to the video connection establishment reply to obtain a hash value, and compare the two hash values. If the two hash values ​​are the same, it means that the signature of the video connection establishment reply is legal, otherwise, it means that the signature of the video connection establishment reply is illegal.

[0116] In the embodiment of the present application, there is a secure dedicated channel between the first terminal and the second terminal, so that other illegal user terminals can be prevented from accessing the signaling server, and the second terminal can sign and encrypt the above-mentioned video connection establishment reply for transmission, so as to prevent the illegal signaling server from tampering with the video connection establishment reply. In short, the secure transmission of the video connection establishment reply can be guaranteed, thereby ensuring the security of video transmission.

[0117] It should be understood that after executing the video connection establishment negotiation, the first terminal and the second terminal can search for the path between the first terminal and the second terminal in the ICE stage, and implement the exchange of video encryption keys based on the path, thereby realizing video transmission. In an embodiment of the present application, the video transmission between the first terminal and the second terminal is not limited to the P2P video transmission mode, and a forwarding-based video transmission mode can also be used. In this case, the video connection establishment request may include: an identifier of the requested video transmission mode, for example: the requested video transmission mode is P2P and / or a forwarding-based video transmission mode, and the video connection suggestion reply may include: the first video transmission mode confirmed by the second terminal, such as confirming the subsequent use of the P2P video transmission mode or the forwarding-based video transmission mode.

[0118] Alternatively, if Figure 5 As shown, the communication method may further include the following steps:

[0119] S317: After determining that the video connection establishment negotiation is successful, the first terminal generates a video forwarding interaction request corresponding to the first video transmission mode;

[0120] S318: The first terminal signs the video forwarding interaction request;

[0121] S319: The first terminal encrypts the video forwarding interaction request and the signature of the video forwarding interaction request to obtain a third encryption result;

[0122] S320: The first terminal transmits the third encryption result to the signaling server;

[0123] S321: The signaling server transmits the third encryption result to the second terminal through the dedicated channel between the first terminal and the second terminal;

[0124] S322: The second terminal decrypts the third encryption result to obtain the video forwarding interaction request and the signature of the video forwarding interaction request;

[0125] S323: The second terminal verifies the signature of the video forwarding interaction request;

[0126] S324: The second terminal generates a video forwarding interaction reply;

[0127] S325: The second terminal signs the video forwarding interaction reply;

[0128] S326: The second terminal encrypts the video forwarding interactive reply and the signature of the video forwarding interactive reply to obtain a fourth encryption result;

[0129] S327: The second terminal transmits the fourth encryption result to the signaling server;

[0130] S328: The signaling server transmits the fourth encryption result to the first terminal through the dedicated channel between the first terminal and the second terminal;

[0131] S329: The first terminal decrypts the fourth encryption result to obtain a video forwarding interactive reply and a signature of the video forwarding interactive reply;

[0132] S330: The first terminal verifies the signature of the video forwarding interactive reply.

[0133] It should be noted that S317 to S330 may be executed after the above S316.

[0134] Optionally, if the first video transmission mode is a P2P mode, the video forwarding interaction request corresponding to the first video transmission mode may be the same as the STUN request, which may include ICE parameters, such as the transmission address in the subnet, the transmission address on the Network Address Translation (NAT), the forwarding address on the server using the Relay Extensions to Session Traversal Utilities for NAT (TURN) server, etc. Correspondingly, the video forwarding interaction reply may be the same as the STUN response, which may include the confirmed Internet Protocol (IP) and port number of the other end, etc., to form a path between the first terminal and the second terminal.

[0135] Optionally, if the first video transmission mode is a forwarding-based video transmission mode, the video forwarding interaction request corresponding to the first video transmission mode may include: an identifier of a requested forwarding server, a requested room number, etc. Correspondingly, the video forwarding interaction reply may include: an identifier of a confirmed forwarding server, a confirmed room number, etc.

[0136] Optionally, the first terminal may use the SHA256+RSA signature algorithm to sign the video forwarding interaction request. In other words, the first terminal may first use the SHA256 algorithm on the video forwarding interaction request to obtain a hash value, i.e., a digest, and then encrypt the hash value through RSA to obtain a signature of the video forwarding interaction request.

[0137] Optionally, the first terminal may use the private key of the public key certificate of the first asymmetric key or a third-party key to sign the video forwarding interaction request.

[0138] It should be understood that the explanation about the third-party key can be found above, and this application will not go into details.

[0139] It should be understood that the signature of the video forwarding interaction request is to prevent the video forwarding interaction request from being tampered with. The first terminal needs to send the video forwarding interaction request and the signature of the request to the second terminal through the signaling server. In order to prevent the video forwarding interaction request from being tampered with by an illegal signaling server, the video forwarding interaction request and the signature of the request need to be encrypted.

[0140] Optionally, the first terminal may encrypt the video forwarding interaction request and the signature of the request using the user password of the second terminal, or may encrypt the video forwarding interaction request and the signature of the request using the user password and a dynamic password of the second terminal.

[0141] Optionally, after receiving the third encryption result, the second terminal may also use the same password as the first terminal to decrypt the third encryption result. For example, when the first terminal uses the user password of the second terminal to encrypt the video forwarding interaction request and the signature of the request, the second terminal also uses the user password of the second terminal to decrypt the third encryption result. When the first terminal uses the user password and dynamic password of the second terminal to encrypt the video forwarding interaction request and the signature of the request, the second terminal also uses the user password and dynamic password of the second terminal to decrypt the third encryption result.

[0142] Optionally, the explanation of the dynamic password can be found above, and this application will not go into details.

[0143] Optionally, after the second terminal obtains the video forwarding interaction request and the signature of the video forwarding interaction request, if the signature of the video forwarding interaction request is obtained through the SHA256+RSA algorithm, the second terminal can first decrypt the signature through the public key of the public key certificate of the first asymmetric key or a third-party key to obtain a hash value, and then the second terminal can use SHA256 on the video forwarding interaction request to obtain a hash value, and compare the two hash values. If the two hash values ​​are the same, it means that the signature of the video forwarding interaction request is legal, otherwise, it means that the signature of the video forwarding interaction request is illegal.

[0144] Optionally, the second terminal may use the SHA256+RSA signature algorithm to sign the video forwarding interactive reply. In other words, the second terminal may first use the SHA256 algorithm on the video forwarding interactive reply to obtain a hash value, i.e., a digest, and then encrypt the hash value through RSA to obtain the signature of the video forwarding interactive reply.

[0145] Optionally, the second terminal may use the private key of the public key certificate of the second asymmetric key or a third-party key to sign the video forwarding interaction reply.

[0146] It should be understood that the explanation about the third-party key can be found above, and this application will not go into details.

[0147] It should be understood that the signature of the video forwarding interactive reply is to prevent the video forwarding interactive reply from being tampered with. The second terminal needs to send the video forwarding interactive reply and the signature of the reply to the first terminal through the signaling server. In order to prevent the video forwarding interactive reply from being tampered with by an illegal signaling server, the video forwarding interactive reply and the signature of the reply need to be encrypted.

[0148] Optionally, the second terminal may encrypt the video forwarding interaction reply and the signature of the reply using the user password of the second terminal, or may encrypt the video forwarding interaction reply and the signature of the reply using the user password and dynamic password of the second terminal.

[0149] Optionally, after receiving the fourth encryption result, the first terminal may also use the same password as the second terminal to decrypt the fourth encryption result. For example, when the second terminal uses the user password of the second terminal to encrypt the video forwarding interactive reply and the signature of the reply, the first terminal also uses the user password of the second terminal to decrypt the fourth encryption result. When the second terminal uses the user password and dynamic password of the second terminal to encrypt the video forwarding interactive reply and the signature of the reply, the first terminal also uses the user password and dynamic password of the second terminal to decrypt the fourth encryption result.

[0150] It should be understood that the explanation of the dynamic password can be found above, and this application will not go into details.

[0151] Optionally, after the first terminal obtains the video forwarding interaction reply and the signature of the video forwarding interaction reply, if the signature of the video forwarding interaction reply is obtained through the SHA256+RSA algorithm, the first terminal can first decrypt the signature through the public key of the public key certificate of the second asymmetric key or a third-party key to obtain a hash value, and then the first terminal can use SHA256 on the video forwarding interaction reply to obtain a hash value, and compare the two hash values. If the two hash values ​​are the same, it means that the signature of the video forwarding interaction reply is legal, otherwise, it means that the signature of the video forwarding interaction reply is illegal.

[0152] In the embodiment of the present application, there is a secure exclusive channel between the first terminal and the second terminal, so that other illegal user terminals can be prevented from accessing the signaling server, and the first terminal can perform signature encryption transmission on the above-mentioned video forwarding interaction request, so as to prevent the illegal signaling server from tampering with the video forwarding interaction request. The second terminal can also perform signature encryption transmission on the above-mentioned video forwarding interaction reply, so as to prevent the illegal signaling server from tampering with the video forwarding interaction reply. In short, the video forwarding interaction request and the video forwarding interaction reply can be guaranteed, thereby ensuring the security of video transmission.

[0153] It should be understood that Figure 5The corresponding embodiment realizes the establishment of a path between the first terminal and the second terminal. Based on this, in the subsequent process, the first terminal and the second terminal can use the path to transmit the video encryption key and the video. In some scenarios, such as the sentry mode scenario, the vehicle terminal only needs to transmit the video to the user terminal. This video transmission process is a one-way video transmission process; in other scenarios, such as the remote driving scenario, the vehicle terminal and the user terminal need to transmit the video to each other. This video transmission is a two-way video transmission process. The following will explain these two video transmission processes respectively:

[0154] Figure 6 An interactive flow chart of another communication method provided in an embodiment of the present application, such as Figure 6 As shown, the method includes:

[0155] S601: The second terminal encrypts the first video encryption key by using the public key of the public key certificate of the first asymmetric key to obtain a fifth encryption result;

[0156] S602: The second terminal sends a fifth encryption result to the first terminal;

[0157] S603: The first terminal decrypts the fifth encryption result by using the private key of the first asymmetric key to obtain a first video encryption key;

[0158] S604: The second terminal encrypts the video to be transmitted using the first video encryption key to obtain a first encrypted video;

[0159] S605: The second terminal sends the first encrypted video to the first terminal;

[0160] S606: The first terminal decrypts the first encrypted video using the first video encryption key.

[0161] Optionally, when the video transmission mode adopted by the first terminal and the second terminal is the P2P transmission mode, then in this embodiment, all transmission contents of the first terminal and the second terminal are transmitted based on the P2P transmission mode. When the video transmission mode adopted by the first terminal and the second terminal is a forwarding-based video transmission mode, then in this embodiment, all transmission contents of the first terminal and the second terminal can be forwarded and transmitted through the forwarding server.

[0162] It should be understood that the video encryption key distribution algorithm adopted in this embodiment is the RSA algorithm. In fact, the DH algorithm may also be adopted.

[0163] It should be understood that, in this embodiment, the second terminal encrypts the first video encryption key by the public key of the public key certificate of the first asymmetric key. In fact, the first video encryption key can also be encrypted by a symmetric key. In this case, the first terminal uses the symmetric key to decrypt the fifth encryption result to obtain the first video encryption key.

[0164] Optionally, when the video transmission mode adopted by the first terminal and the second terminal is a P2P video transmission mode, the second terminal may adopt the video transmission parameters corresponding to the P2P video transmission mode to transmit the first video encryption key, such as performing video transmission based on the SRTP protocol, etc. When the video transmission mode adopted by the first terminal and the second terminal is a forwarding-based video transmission mode, the second terminal may adopt the video transmission parameters corresponding to the video transmission mode to transmit the first video encryption key, such as performing video transmission based on the RTC protocol.

[0165] Optionally, the communication method may further include the following steps:

[0166] S607: The first terminal obtains a public key certificate of the second asymmetric key;

[0167] S608: The first terminal encrypts the second video encryption key by using the public key of the public key certificate of the second asymmetric key to obtain a sixth encryption result;

[0168] S609: The first terminal sends a sixth encryption result to the second terminal;

[0169] S610: The second terminal decrypts the sixth encryption result by using the private key of the second asymmetric key to obtain a second video encryption key;

[0170] S611: The first terminal encrypts the video to be transmitted by using the second video encryption key to obtain a second encrypted video;

[0171] S612: The first terminal sends a second encrypted video to the second terminal;

[0172] S613: The second terminal decrypts the second encrypted video using the second video encryption key.

[0173] It should be understood that S607 to S613 can be executed after S606, and their combined scheme is a two-way video transmission process. Of course, S607 to S613 can also be executed directly after the path between the first terminal and the second terminal is established, that is, it does not need to be coupled with the scheme between S601 to S606.

[0174] It should be understood that, with regard to S607 to S613 , reference may be made to the explanations regarding S601 to S606 , which will not be elaborated on herein.

[0175] In the embodiment of the present application, the first terminal and the second terminal can use the P2P video transmission mode or the forwarding-based video transmission mode to transmit the video, thereby improving the flexibility of the video transmission. In addition, if the first terminal and the second terminal use the forwarding-based video transmission mode to transmit the video, then this mode can support multiple devices to watch the video at the same time, for example: the vehicle terminal can transmit the video to multiple user terminals, so that multiple users can watch the vehicle video.

[0176] Figure 7 A schematic diagram of a communication device 700 provided in an embodiment of the present application, the communication device is the first terminal mentioned above, such as Figure 7 As shown, the device 700 may include: a processing module 710 and a communication module 720, wherein the processing module 710 is used to access the signaling server to trigger two-way authentication between the first terminal and the signaling server; after the two-way authentication between the first terminal and the signaling server is successful, generate a video connection establishment request; sign the video connection establishment request; encrypt the video connection establishment request and the signature of the video connection establishment request to obtain a first encryption result; the communication module 720 is used to transmit the first encryption result to the signaling server, so that the signaling server transmits the first encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal.

[0177] Optionally, the communication module 720 is also used to receive a second encryption result transmitted by the second terminal through the signaling server, the second encryption result is the encryption result after the second terminal signs the video connection establishment reply, and encrypts the video connection establishment reply and the signature of the video connection establishment reply; the processing module 710 is also used to decrypt the second encryption result to obtain the video connection establishment reply and the signature of the video connection establishment reply; and verify the signature of the video connection establishment reply.

[0178] Optionally, the video connection establishment request includes: an identifier of the requested video transmission mode; the processing module 710 is also used to generate a video forwarding interaction request corresponding to a first video transmission mode after determining that the video connection establishment negotiation is successful, and the first video transmission mode is confirmed based on the identifier of the requested video transmission mode; signing the video forwarding interaction request; encrypting the video forwarding interaction request and the signature of the video forwarding interaction request to obtain a third encryption result; the communication module 720 is also used to transmit the third encryption result to the signaling server, so that the signaling server transmits the third encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal.

[0179] Optionally, the communication module 720 is also used to receive a fourth encryption result transmitted by the second terminal through the signaling server, and the fourth encryption result is the encryption result after the second terminal signs the video forwarding interaction reply, and encrypts the video forwarding interaction reply and the signature of the video forwarding interaction reply; the processing module 710 is also used to decrypt the fourth encryption result to obtain the video forwarding interaction reply and the signature of the video forwarding interaction reply; and verify the signature of the video forwarding interaction reply.

[0180] Optionally, the first video transmission mode is a P2P video transmission mode or a forwarding-based video transmission mode.

[0181] Optionally, the video connection establishment request includes: a public key certificate of a first asymmetric key; the communication module 720 is also used to receive a fifth encryption result sent by the second terminal, the fifth encryption result being the encryption result of the second terminal encrypting the first video encryption key using the public key of the public key certificate of the first asymmetric key; the processing module 710 is also used to decrypt the fifth encryption result using the private key of the first asymmetric key to obtain a first video encryption key; the communication module 720 is also used to receive a first encrypted video sent by the second terminal; the processing module 710 is also used to decrypt the first encrypted video using the first video encryption key.

[0182] Optionally, the communication module 720 is also used to obtain the public key certificate of the second asymmetric key; the processing module 710 is also used to encrypt the second video encryption key by the public key of the public key certificate of the second asymmetric key to obtain a sixth encryption result; the communication module 720 is also used to send the sixth encryption result to the second terminal; the processing module 710 is also used to encrypt the video to be transmitted by the second video encryption key to obtain a second encrypted video; the communication module 720 is also used to send the second encrypted video to the second terminal.

[0183] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Figure 7 The device 700 shown can execute the method embodiment corresponding to the first terminal, and the aforementioned and other operations and / or functions of each module in the device 700 are respectively for implementing the corresponding processes in the method embodiment corresponding to the first terminal. For the sake of brevity, they are not repeated here.

[0184] The above describes the device 700 of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0185] Figure 8 A schematic diagram of a communication device 800 provided in an embodiment of the present application, the communication device is the above-mentioned second terminal, such as Figure 8 As shown, the device 800 may include: a processing module 810 and a communication module 820, the processing module 810 is used to access the signaling server to trigger a two-way authentication between the second terminal and the signaling server; the communication module 820 is used to receive a first encryption result sent by the signaling server through a dedicated channel between the first terminal and the second terminal after the two-way authentication between the second terminal and the signaling server is successful; the first encryption result is an encryption result obtained by the first terminal signing the video connection establishment request and encrypting the video connection establishment request and the signature of the video connection establishment request; the processing module 810 is also used to decrypt the first encryption result to obtain the video connection establishment request and the signature of the video connection establishment request; the processing module 810 is also used to verify the signature of the video connection establishment request.

[0186] Optionally, the processing module 810 is also used to generate a video connection establishment reply; sign the video connection establishment reply; encrypt the video connection establishment reply and the signature of the video connection establishment reply to obtain a second encryption result; the communication module 820 is also used to transmit the second encryption result to the signaling server, so that the signaling server transmits the second encryption result to the first terminal through a dedicated channel between the first terminal and the second terminal.

[0187] Optionally, the video connection establishment request includes: an identifier of the requested video transmission mode; the communication module 820 is also used to receive a third encryption result sent by the signaling server through a dedicated channel between the first terminal and the second terminal after determining that the video connection establishment negotiation is successful; the third encryption result is an encryption result obtained by the first terminal signing the video forwarding interaction request corresponding to the first video transmission mode, and encrypting the video forwarding interaction request and the signature of the video forwarding interaction request, and the first video transmission mode is confirmed based on the identifier of the requested video transmission mode; the processing module 810 is also used to decrypt the third encryption result to obtain the video forwarding interaction request and the signature of the video forwarding interaction request; and verify the signature of the video forwarding interaction request.

[0188] Optionally, the processing module 810 is also used to generate a video forwarding interaction reply; sign the video forwarding interaction reply; encrypt the video forwarding interaction reply and the signature of the video forwarding interaction reply to obtain a fourth encryption result; the communication module 820 is also used to transmit the fourth encryption result to the signaling server, so that the signaling server transmits the fourth encryption result to the first terminal through the exclusive channel between the first terminal and the second terminal.

[0189] Optionally, the video transmission mode is a P2P video transmission mode or a forwarding-based video transmission mode.

[0190] Optionally, the video connection establishment request includes: a public key certificate of a first asymmetric key; the processing module 810 is also used to encrypt the first video encryption key by means of the public key of the public key certificate of the first asymmetric key to obtain a fifth encryption result; the communication module 820 is also used to send the fifth encryption result to the first terminal; the processing module 810 is also used to encrypt the video to be transmitted by means of the first video encryption key to obtain a first encrypted video; the communication module 820 is also used to send the first encrypted video to the first terminal.

[0191] Optionally, the communication module 820 is also used to send the public key certificate of the second asymmetric key to the first terminal; receive the sixth encryption result sent by the first terminal, the sixth encryption result is the encryption result of the first terminal encrypting the second video encryption key by the public key of the public key certificate of the second asymmetric key; the processing module 810 is also used to decrypt the sixth encryption result by the private key of the second asymmetric key to obtain the second video encryption key; the communication module 820 is also used to receive the second encrypted video sent by the second terminal; the processing module 810 is also used to decrypt the second encrypted video by the second video encryption key.

[0192] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here. Specifically, Figure 8The device 800 shown can execute the method embodiment corresponding to the second terminal, and the aforementioned and other operations and / or functions of each module in the device 800 are respectively for implementing the corresponding processes in the method embodiment corresponding to the second terminal. For the sake of brevity, they are not repeated here.

[0193] The above describes the device 800 of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0194] Fig. 9 It is a schematic block diagram of an electronic device 900 provided in an embodiment of the present application.

[0195] like Fig. 9 As shown, the electronic device 900 may include:

[0196] The memory 910 and the processor 920, the memory 910 is used to store the computer program and transmit the program code to the processor 920. In other words, the processor 920 can call and run the computer program from the memory 910 to implement the method in the embodiment of the present application.

[0197] For example, the processor 920 may be configured to execute the above method embodiments according to instructions in the computer program.

[0198] In some embodiments of the present application, the processor 920 may include but is not limited to:

[0199] General-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.

[0200] In some embodiments of the present application, the memory 910 includes but is not limited to:

[0201] Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0202] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 910 and executed by the processor 920 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0203] like Fig. 9 As shown, the electronic device may also include:

[0204] The transceiver 930 may be connected to the processor 920 or the memory 910 .

[0205] The processor 920 may control the transceiver 930 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 930 may include a transmitter and a receiver. The transceiver 930 may further include an antenna, and the number of antennas may be one or more.

[0206] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0207] The present application also provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. In other words, the present application embodiment also provides a computer program product containing instructions, and when the instructions are executed by a computer, the computer can perform the method of the above method embodiment.

[0208] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (digital video disc, DVD)), or a semiconductor medium (e.g., a solid state drive (solid state disk, SSD)), etc.

[0209] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0210] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0211] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0212] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: The method is based on a webRTC P2P mechanism, and is applied to a first terminal. The method includes: Accessing a signaling server to trigger two-way authentication between the first terminal and the signaling server; After the two-way authentication between the first terminal and the signaling server is successful, generating a video connection establishment request; Signing the video connection establishment request; Encrypting the video connection establishment request and the signature of the video connection establishment request to obtain a first encryption result; The first encryption result is transmitted to the signaling server, so that the signaling server transmits the first encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal; wherein the two-way authentication between the second terminal and the signaling server is successful.

2. The method according to claim 1, characterized in that: Also includes: receiving a second encryption result transmitted by the second terminal through the signaling server, where the second encryption result is an encryption result after the second terminal signs the video connection establishment reply and encrypts the video connection establishment reply and the signature of the video connection establishment reply; Decrypting the second encryption result to obtain the video connection establishment reply and the signature of the video connection establishment reply; The signature of the video connection establishment reply is verified.

3. The method according to claim 1 or 2, characterized in that: The video connection establishment request includes: an identifier of the requested video transmission mode; the method further includes: After determining that the video connection establishment negotiation is successful, generating a video forwarding interaction request corresponding to a first video transmission mode, wherein the first video transmission mode is confirmed according to an identifier of the requested video transmission mode; Signing the video forwarding interaction request; Encrypting the video forwarding interaction request and the signature of the video forwarding interaction request to obtain a third encryption result; The third encryption result is transmitted to the signaling server, so that the signaling server transmits the third encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal.

4. The method according to claim 3, characterized in that Also includes: Receive a fourth encryption result transmitted by the second terminal through the signaling server, where the fourth encryption result is an encryption result after the second terminal signs the video forwarding interaction reply and encrypts the video forwarding interaction reply and the signature of the video forwarding interaction reply; Decrypting the fourth encryption result to obtain the video forwarding interactive reply and the signature of the video forwarding interactive reply; The signature of the video forwarding interactive reply is verified.

5. The method according to claim 3, characterized in that: The first video transmission mode is a point-to-point P2P video transmission mode or a forwarding-based video transmission mode.

6. The method according to claim 1 or 2, characterized in that: The video connection establishment request includes: a public key certificate of the first asymmetric key; the method further includes: receiving a fifth encryption result sent by the second terminal, where the fifth encryption result is an encryption result of the second terminal encrypting the first video encryption key using the public key of the public key certificate of the first asymmetric key; Decrypting the fifth encryption result by using the private key of the first asymmetric key to obtain the first video encryption key; Receiving a first encrypted video sent by the second terminal; The first encrypted video is decrypted using the first video encryption key.

7. The method according to claim 2, characterized in that: Also includes: Obtaining a public key certificate for a second asymmetric key; Encrypting the second video encryption key by using the public key of the public key certificate of the second asymmetric key to obtain a sixth encryption result; Sending the sixth encryption result to the second terminal; Encrypting the video to be transmitted by using the second video encryption key to obtain a second encrypted video; Send the second encrypted video to the second terminal.

8. A communication method, characterized in that: The method is based on a webRTC P2P mechanism, the method is applied to a second terminal, and the method includes: Accessing a signaling server to trigger two-way authentication between the second terminal and the signaling server; After the two-way authentication between the second terminal and the signaling server is successful, receiving a first encryption result sent by the signaling server through the dedicated channel between the first terminal and the second terminal; the first encryption result is an encryption result obtained by the first terminal signing the video connection establishment request and encrypting the video connection establishment request and the signature of the video connection establishment request; wherein the two-way authentication between the first terminal and the signaling server is successful; Decrypting the first encryption result to obtain the video connection establishment request and the signature of the video connection establishment request; The signature of the video connection establishment request is verified.

9. The method according to claim 8, characterized in that Also includes: Generate video connection to establish response; Signing the video connection establishment response; Encrypting the video connection establishment reply and the signature of the video connection establishment reply to obtain a second encryption result; The second encryption result is transmitted to the signaling server, so that the signaling server transmits the second encryption result to the first terminal through a dedicated channel between the first terminal and the second terminal.

10. The method according to claim 8 or 9, characterized in that: The video connection establishment request includes: an identifier of the requested video transmission mode; the method further includes: After determining that the video connection establishment negotiation is successful, receiving a third encryption result sent by the signaling server through the dedicated channel between the first terminal and the second terminal; the third encryption result is an encryption result obtained by the first terminal signing the video forwarding interaction request corresponding to the first video transmission mode, and encrypting the video forwarding interaction request and the signature of the video forwarding interaction request, and the first video transmission mode is confirmed according to the identifier of the requested video transmission mode; Decrypting the third encryption result to obtain the video forwarding interaction request and the signature of the video forwarding interaction request; The signature of the video forwarding interaction request is verified.

11. The method according to claim 10, characterized in that Also includes: Generate interactive responses for video forwarding; Signing the video forwarding interactive reply; Encrypting the video forwarding interactive reply and the signature of the video forwarding interactive reply to obtain a fourth encryption result; The fourth encryption result is transmitted to the signaling server, so that the signaling server transmits the fourth encryption result to the first terminal through a dedicated channel between the first terminal and the second terminal.

12. The method according to claim 10, characterized in that The video transmission mode is a P2P video transmission mode or a forwarding-based video transmission mode.

13. The method according to claim 8 or 9, characterized in that: The video connection establishment request includes: a public key certificate of the first asymmetric key; the method further includes: Encrypting the first video encryption key by using the public key of the public key certificate of the first asymmetric key to obtain a fifth encryption result; Sending the fifth encryption result to the first terminal; Encrypting the video to be transmitted by using the first video encryption key to obtain a first encrypted video; Send the first encrypted video to the first terminal.

14. The method according to claim 9, characterized in that Also includes: Sending a public key certificate of a second asymmetric key to the first terminal; receiving a sixth encryption result sent by the first terminal, where the sixth encryption result is an encryption result of the first terminal encrypting the second video encryption key by using the public key of the public key certificate of the second asymmetric key; Decrypting the sixth encryption result by using the private key of the second asymmetric key to obtain the second video encryption key; Receiving a second encrypted video sent by the second terminal; The second encrypted video is decrypted using the second video encryption key.

15. A communication device, the communication device being a first terminal, characterized in that: The communication device is a device based on the webRTC P2P mechanism, including: Processing modules for: Accessing a signaling server to trigger two-way authentication between the first terminal and the signaling server; After the two-way authentication between the first terminal and the signaling server is successful, generating a video connection establishment request; Signing the video connection establishment request; Encrypting the video connection establishment request and the signature of the video connection establishment request to obtain a first encryption result; Communication modules for: The first encryption result is transmitted to the signaling server, so that the signaling server transmits the first encryption result to the second terminal through a dedicated channel between the first terminal and the second terminal; wherein the two-way authentication between the second terminal and the signaling server is successful.

16. A communication device, the communication device being a second terminal, characterized in that: The communication device is a device based on the webRTC P2P mechanism, including: a processing module and a communication module; The processing module is used to access the signaling server to trigger two-way authentication between the second terminal and the signaling server; The communication module is used to receive a first encryption result sent by the signaling server through the dedicated channel between the first terminal and the second terminal after the two-way authentication between the second terminal and the signaling server is successful; the first encryption result is an encryption result obtained by the first terminal signing the video connection establishment request and encrypting the video connection establishment request and the signature of the video connection establishment request; wherein the two-way authentication between the first terminal and the signaling server is successful; The processing module is further used to decrypt the first encryption result to obtain the video connection establishment request and the signature of the video connection establishment request; The processing module is further configured to verify the signature of the video connection establishment request.

17. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 14.

18. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 14.

19. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 14 is implemented.

Images