Video telephone service processing method and device, electronic equipment and storage medium

Abstract

The invention provides a video telephone service processing method and device, electronic equipment and a storage medium. The video telephone service processing method comprises the following steps: a first terminal generates verification data, signs the verification data by using a pre-applied private key of the first terminal to obtain first signature data, and sends a video telephone application carrying the verification data and the first signature data to a second terminal; the second terminal performs first verification on the verification data and the first signature data by using the public key of the first terminal, signs the verification data by using a pre-applied private key of the second terminal to obtain second signature data after the first verification is passed, and sends the second signature data to the first terminal; and the first terminal performs second verification on the second signature data by using the public key of the second terminal, sends the first video telephone data to the second terminal after the second verification is passed, and receives second video telephone data sent by the second terminal. According to the invention, the security of the video telephone service can be ensured.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a videophone service processing method, device, electronic equipment and storage medium. Background Art

[0002] With the rapid development of network services, various network services are becoming more and more popular among users, and the security requirements for various network-based services are also increasing.

[0003] Taking the videophone service as an example, the current videophone service is that the calling terminal sends a regular videophone application to the called terminal. After the user of the called terminal accepts the videophone application, the calling terminal and the called terminal can start transmitting videophone data. However, in many scenarios, the importance of videophone services is high, so the requirements for service security are also high, and the current videophone service processing method cannot guarantee the security of videophone services. Summary of the invention

[0004] In view of the above problems, the embodiments of the present invention are proposed to provide a videophone service processing method, device, electronic device and storage medium that overcome the above problems or at least partially solve the above problems.

[0005] In a first aspect, an embodiment of the present invention discloses a videophone service processing method, which is applied to a first terminal, and the method includes:

[0006] Generate verification data, sign the verification data using the pre-applied private key of the first terminal to obtain first signature data, and send a videophone application carrying the verification data and the first signature data to the second terminal; so that the second terminal uses the public key of the first terminal to perform a first verification on the verification data and the first signature data, and after the first verification passes, sign the verification data using the pre-applied private key of the second terminal to obtain second signature data, and send the second signature data to the first terminal;

[0007] The second signature data is subjected to a second verification using the public key of the second terminal. After the second verification passes, the first videophone data is sent to the second terminal, and the second videophone data sent by the second terminal is received.

[0008] Optionally, before sending the first videophone data to the second terminal, the method further includes: generating a session key, encrypting the session key using the public key of the second terminal to obtain an encrypted session key, and sending the encrypted session key to the second terminal so that the second terminal decrypts the encrypted session key using the private key of the second terminal to obtain the session key;

[0009] The sending of the first videophone data to the second terminal and receiving the second videophone data sent by the second terminal includes: encrypting the first videophone data by using the session key to obtain first encrypted videophone data, and sending the first encrypted videophone data to the second terminal; so that the second terminal decrypts the first encrypted videophone data by using the session key to obtain the first videophone data; receiving the second encrypted videophone data sent by the second terminal, which is obtained by encrypting the second videophone data by using the session key, and decrypting the second encrypted videophone data by using the session key to obtain the second videophone data.

[0010] Optionally, the method further comprises: deleting the session key after the videophone service ends.

[0011] Optionally, before generating verification data, it also includes: sending a first key application carrying the identity of the first terminal to a key generation center, and receiving a private key of the first terminal returned by the key generation center, where the public key of the first terminal is the identity of the first terminal.

[0012] Optionally, the generating verification data includes: generating a random number as the verification data.

[0013] In a second aspect, an embodiment of the present invention discloses a videophone service processing method, which is applied to a second terminal, and the method includes:

[0014] receiving a videophone application sent by a first terminal, performing a first verification on verification data and first signature data carried in the videophone application using a public key of the first terminal, and after the first verification passes, signing the verification data using a pre-applied private key of the second terminal to obtain second signature data, and sending the second signature data to the first terminal; the verification data is generated by the first terminal, and the first signature data is obtained by the first terminal signing the verification data using the pre-applied private key of the first terminal;

[0015] The first videophone data sent by the first terminal is received, and the second videophone data is sent to the first terminal; the first terminal performs a second verification on the second signature data using the public key of the second terminal, and sends the first videophone data to the second terminal after the second verification passes.

[0016] Optionally, before receiving the videophone data sent by the first terminal, the method further includes: receiving an encrypted session key sent by the first terminal, obtained by encrypting a session key generated by using the public key of the second terminal, and decrypting the encrypted session key using the private key of the second terminal to obtain the session key;

[0017] The receiving of the first videophone data sent by the first terminal and sending the second videophone data to the first terminal includes: receiving the first videophone data sent by the first terminal, encrypting the first videophone data using the session key to obtain the first encrypted videophone data, decrypting the first encrypted videophone data using the session key to obtain the first videophone data; encrypting the second videophone data using the session key to obtain the second encrypted videophone data, and sending the second encrypted videophone data to the first terminal; so that the first terminal decrypts the second encrypted videophone data using the session key to obtain the second videophone data.

[0018] Optionally, the method further comprises: deleting the session key after the videophone service ends.

[0019] Optionally, before receiving the videophone application sent by the first terminal, it also includes: sending a second key application carrying the identity of the second terminal to a key generation center, and receiving the private key of the second terminal returned by the key generation center, where the public key of the second terminal is the identity of the second terminal.

[0020] In a third aspect, an embodiment of the present invention discloses a videophone service processing device, characterized in that it is applied to a first terminal, and the device includes:

[0021] A first processing module is used to generate verification data, sign the verification data using the pre-applied private key of the first terminal to obtain first signature data, and send a videophone application carrying the verification data and the first signature data to a second terminal; so that the second terminal performs a first verification on the verification data and the first signature data using the public key of the first terminal, and after the first verification passes, signs the verification data using the pre-applied private key of the second terminal to obtain second signature data, and sends the second signature data to the first terminal;

[0022] The first interaction module is used to perform a second verification on the second signature data using the public key of the second terminal, and after the second verification passes, send the first videophone data to the second terminal and receive the second videophone data sent by the second terminal.

[0023] Optionally, the device further includes: a third processing module, configured to generate a session key, encrypt the session key using a public key of the second terminal to obtain an encrypted session key, and send the encrypted session key to the second terminal, so that the second terminal decrypts the encrypted session key using a private key of the second terminal to obtain the session key;

[0024] The first interaction module includes: a first encryption unit, used to encrypt the first videophone data using the session key to obtain the first encrypted videophone data, and send the first encrypted videophone data to the second terminal; so that the second terminal decrypts the first encrypted videophone data using the session key to obtain the first videophone data; a first decryption unit, used to receive the second encrypted videophone data sent by the second terminal, which is obtained by encrypting the second videophone data using the session key, and decrypt the second encrypted videophone data using the session key to obtain the second videophone data.

[0025] Optionally, the device further comprises: a first deleting module, configured to delete the session key after the videophone service ends.

[0026] Optionally, the device also includes: a first application module, used to send a first key application carrying the identity of the first terminal to a key generation center, and receive the private key of the first terminal returned by the key generation center, where the public key of the first terminal is the identity of the first terminal.

[0027] Optionally, the first processing module is specifically configured to generate a random number as the verification data.

[0028] In a fourth aspect, an embodiment of the present invention discloses a videophone service processing device, which is applied to a second terminal, and the device includes:

[0029] a second processing module, configured to receive a videophone application sent by a first terminal, perform a first verification on the verification data and the first signature data carried in the videophone application using a public key of the first terminal, and after the first verification passes, sign the verification data using a pre-applied private key of the second terminal to obtain second signature data, and send the second signature data to the first terminal; the verification data is generated by the first terminal, and the first signature data is obtained by the first terminal signing the verification data using a pre-applied private key of the first terminal;

[0030] The second interaction module is used to receive the first videophone data sent by the first terminal and send the second videophone data to the first terminal; the first terminal performs a second verification on the second signature data using the public key of the second terminal, and sends the first videophone data to the second terminal after the second verification passes.

[0031] Optionally, the device further includes: a fourth processing module, configured to receive an encrypted session key sent by the first terminal, obtained by encrypting the session key generated by using the public key of the second terminal, and decrypt the encrypted session key using the private key of the second terminal to obtain the session key;

[0032] The second interaction module includes: a second decryption unit, which is used to receive the first encrypted videophone data sent by the first terminal, encrypt the first videophone data using the session key to obtain the first encrypted videophone data, and decrypt the first encrypted videophone data using the session key to obtain the first videophone data; a second encryption unit, which is used to encrypt the second videophone data using the session key to obtain the second encrypted videophone data, and send the second encrypted videophone data to the first terminal; so that the first terminal decrypts the second encrypted videophone data using the session key to obtain the second videophone data.

[0033] Optionally, the device further comprises: a second deleting module, configured to delete the session key after the videophone service ends.

[0034] In a fifth aspect, an embodiment of the present invention discloses an electronic device, comprising a processor and a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program; when the computer program is executed by the processor, the processor executes the videophone service processing method as described in any one of the above items.

[0035] In a sixth aspect, an embodiment of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the videophone service processing method as described in any one of the above items.

[0036] In an embodiment of the present invention, a first terminal generates verification data, signs the verification data using a pre-applied private key of the first terminal to obtain first signature data, and sends a videophone application carrying the verification data and the first signature data to a second terminal; the second terminal performs a first verification on the verification data and the first signature data using a public key of the first terminal, and after the first verification passes, signs the verification data using the private key of the second terminal to obtain second signature data, and sends the second signature data to the first terminal; the first terminal performs a second verification on the second signature data using the public key of the second terminal, and after the second verification passes, sends the first videophone data to the second terminal, and receives the second videophone data sent by the second terminal.

[0037] It can be seen that in the embodiment of the present invention, the first terminal and the second terminal apply for their own public keys and private keys in advance using an asymmetric encryption algorithm. Before the first terminal and the second terminal exchange videophone data, they first use the public key and the private key to authenticate each other. After both parties have passed the authentication, they will further exchange videophone data, thereby ensuring the security of the videophone service and meeting the security requirements of the videophone service of higher importance.

[0038] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the drawings required for use in the description of the embodiment of the present invention will be briefly introduced below. Obviously, the drawings described below are only some drawings of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 is a flowchart of a method for processing a videophone service according to an embodiment of the present invention;

[0041] Figure 2 is a flowchart of another method for processing a videophone service according to an embodiment of the present invention;

[0042] Figure 3 is a flowchart of another method for processing a videophone service according to an embodiment of the present invention;

[0043] Figure 4 is a schematic diagram of a videophone service processing architecture according to an embodiment of the present invention;

[0044] Figure 5 is a schematic diagram of a videophone service processing process according to an embodiment of the present invention;

[0045] Figure 6 is a structural block diagram of a videophone service processing device according to an embodiment of the present invention;

[0046] Figure 7 is a structural block diagram of another videophone service processing device according to an embodiment of the present invention;

[0047] Figure 8 is a structural block diagram of an electronic device according to an embodiment of the present invention;

[0048] Fig. 9 It is a structural block diagram of a computer-readable storage medium according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] In the current videophone service, the calling terminal sends a regular videophone application to the called terminal. After the user of the called terminal accepts the videophone application, the videophone data can be transmitted between the calling terminal and the called terminal. However, for some important videophone services, it cannot meet their security requirements.

[0051] Taking the video network as an example, there is currently no security processing for the videophone service in the video network. Although in the existing password application solutions of the video network, the terminals that carry out business need to uniformly perform network authentication with the network management system or the integrated management system, and uniformly perform business authentication with the conference management system or the integrated management system to obtain a unified business key. However, this method is suitable for point-to-multipoint or multipoint-to-multipoint business models, and is not suitable for point-to-point business models such as videophone services. In addition, there is no business management system in the videophone service, and authentication operations cannot be performed. Therefore, if the above method is used to process the business security of the videophone service, it will change the product business process and have a significant impact.

[0052] In view of the above problems, the embodiment of the present invention proposes that the first terminal and the second terminal performing the videophone service use the public key and the private key to authenticate each other, and only after both parties have passed the authentication, will they further exchange videophone data, thereby ensuring the security of the videophone service. The following is a detailed introduction.

[0053] Reference Figure 1 , shows a flowchart of a method for processing a videophone service according to an embodiment of the present invention. The method for processing a videophone service according to an embodiment of the present invention can be applied to a first terminal.

[0054] like Figure 1 As shown, the videophone service processing method may include the following steps:

[0055] Step 101: A first terminal generates verification data, signs the verification data using a pre-applied private key of the first terminal to obtain first signature data, and sends a videophone application carrying the verification data and the first signature data to a second terminal; so that the second terminal performs a first verification on the verification data and the first signature data using a public key of the first terminal, and after the first verification passes, signs the verification data using a pre-applied private key of the second terminal to obtain second signature data, and sends the second signature data to the first terminal.

[0056] In an embodiment of the present invention, before initiating a videophone service for the first time, the first terminal may connect to a key generation center (KGC) and send a first key application carrying the identity of the first terminal to the key generation center. After receiving the first key application sent by the first terminal, the key generation center generates a private key of the first terminal through an asymmetric encryption algorithm based on the identity of the first terminal and system parameters (such as a master private key, a user key version number, etc.), and returns the private key of the first terminal to the first terminal. After the first terminal receives the private key of the first terminal returned by the key generation center, it may store the private key of the first terminal, for example, the private key of the first terminal may be encrypted and stored in a security chip on the first terminal, etc. Among them, the public key of the first terminal is the identity of the first terminal, which may specifically be the dial-up identity of the first terminal. For example, when the first terminal is a visual network terminal, the identity of the first terminal may be the visual network number of the first terminal.

[0057] In an embodiment of the present invention, before the second terminal initiates the videophone service for the first time, it can connect to the key generation center and send a second key application carrying the identity of the second terminal to the key generation center. After receiving the second key application sent by the second terminal, the key generation center generates the private key of the second terminal through an asymmetric encryption algorithm based on the identity of the second terminal and system parameters (such as the master private key, the user key version number, etc.), and returns the private key of the second terminal to the second terminal. After the second terminal receives the private key of the second terminal returned by the key generation center, it can store the private key of the second terminal, for example, the private key of the second terminal can be encrypted and stored in a security chip on the second terminal, etc. Among them, the public key of the second terminal can be the identity of the second terminal, specifically the dial-up identity of the second terminal. For example, when the second terminal is a visual network terminal, the identity of the second terminal can be the visual network number of the second terminal.

[0058] In the embodiment of the present invention, the above-mentioned asymmetric encryption algorithm can be implemented by any applicable asymmetric encryption algorithm. Exemplarily, the above-mentioned asymmetric encryption algorithm can include but is not limited to: SM9 encryption algorithm, ECC (Elliptic Curve Cryptography), DSA (Digital Signature Algorithm), ECDSA (Elliptic Curve Digital Signature Algorithm), and the like.

[0059] When the first terminal is about to conduct a videophone service with the second terminal, the first terminal generates verification data, and signs the verification data using the pre-applied private key of the first terminal to obtain first signature data. Afterwards, the first terminal generates a videophone application carrying the verification data and the first signature data, and sends the videophone application to the second terminal.

[0060] In the embodiment of the present invention, the first terminal may generate verification data in any applicable manner. For example, the first terminal may generate a random number as the verification data; for another example, the first terminal may select some characters in the identity identifier of the first terminal as the verification data, and so on.

[0061] In an embodiment of the present invention, when the first terminal uses the pre-applied private key of the first terminal to sign the verification data to obtain the first signature data, the first terminal can first use a set hash algorithm to hash the verification data to obtain a first hash value (also called a digest), which represents the content of the verification data and is unique, and then use the private key of the first terminal to perform an encryption operation on the above-obtained first hash value to generate the first signature data.

[0062] After receiving the videophone application sent by the first terminal, the second terminal parses the videophone application to obtain the verification data and the first signature data carried in the videophone application. The second terminal knows the public key of the first terminal, so it uses the public key of the first terminal to perform a first verification on the verification data and the first signature data, and after the first verification passes, it uses the pre-applied private key of the second terminal to sign the verification data to obtain second signature data, and then sends the second signature data to the first terminal.

[0063] In an embodiment of the present invention, during the process of performing a first verification on the verification data and the first signature data using the public key of the first terminal, the second terminal may use the same hash algorithm as that used by the first terminal to perform hash processing on the verification data to obtain a second hash value, and use the public key of the first terminal to perform a decryption operation on the first signature data to obtain a third hash value, and then compare the second hash value and the third hash value. When the second hash value and the third hash value are the same, it can be determined that the first verification has passed, and when the second hash value and the third hash value are different, it can be determined that the first verification has failed.

[0064] In an embodiment of the present invention, after the first verification is passed, the second terminal can first use the same hash algorithm as used by the first terminal to hash the verification data to obtain second signature data when using the pre-applied private key of the second terminal to obtain a fourth hash value. The fourth hash value represents the content of the verification data and is unique. Then, the private key of the second terminal is used to encrypt the fourth hash value obtained above, thereby generating second signature data.

[0065] Step 102: The first terminal performs a second verification on the second signature data using the public key of the second terminal. After the second verification is passed, the first terminal sends the first videophone data to the second terminal and receives the second videophone data sent by the second terminal.

[0066] After receiving the second signature data sent by the second terminal, the first terminal performs a second verification on the second signature data using the public key of the second terminal.

[0067] In an embodiment of the present invention, during the process of performing a second verification on the second signature data using the public key of the second terminal, the first terminal may use the same hash algorithm used previously to perform hash processing on the verification data generated by itself to obtain a fifth hash value, and use the public key of the second terminal to perform a decryption operation on the second signature data to obtain a sixth hash value, and then compare the fifth hash value and the sixth hash value. When the fifth hash value and the sixth hash value are the same, it can be determined that the second verification has passed; when the fifth hash value and the sixth hash value are different, it can be determined that the second verification has failed.

[0068] After the second verification is passed, the first terminal can send the first videophone data to the second terminal, and can receive the second videophone data sent by the second terminal. Similarly, the second terminal can receive the first videophone data sent by the first terminal, and can send the second videophone data to the first terminal. Thus, the videophone service between the first terminal and the second terminal is realized.

[0069] In the embodiment of the present invention, the first terminal and the second terminal apply for their own public keys and private keys in advance using an asymmetric encryption algorithm. Before the first terminal and the second terminal exchange videophone data, they first use the public key and the private key to authenticate each other. After both parties have passed the authentication, they will further exchange videophone data, thereby ensuring the security of the videophone service and meeting the security requirements of the videophone service of higher importance.

[0070] Reference Figure 2 , shows a flowchart of another videophone service processing method according to an embodiment of the present invention. The videophone service processing method according to the embodiment of the present invention can be applied to a second terminal.

[0071] like Figure 2 As shown, the videophone service processing method may include the following steps:

[0072] Step 201: The second terminal receives a videophone application sent by the first terminal, performs a first verification on verification data and first signature data carried in the videophone application using the public key of the first terminal, and after the first verification passes, signs the verification data using the pre-applied private key of the second terminal to obtain second signature data, and sends the second signature data to the first terminal; the verification data is generated by the first terminal, and the first signature data is obtained by the first terminal signing the verification data using the pre-applied private key of the first terminal.

[0073] Step 202: The second terminal receives the first videophone data sent by the first terminal, and sends the second videophone data to the first terminal; the first terminal performs a second verification on the second signature data using the public key of the second terminal, and sends the first videophone data to the second terminal after the second verification passes.

[0074] For the specific process of step 201 and step 202, reference may be made to the specific description of the above embodiment, and this embodiment will not be discussed in detail here.

[0075] Reference Figure 3 , shows a flowchart of the steps of another videophone service processing method according to an embodiment of the present invention.

[0076] like Figure 3 As shown, the videophone service processing method may include the following steps:

[0077] Step 301: A first terminal generates verification data, signs the verification data using a pre-applied private key of the first terminal to obtain first signature data, and sends a videophone application carrying the verification data and the first signature data to a second terminal.

[0078] Step 302: The second terminal receives the videophone application sent by the first terminal, performs a first verification on the verification data and the first signature data using the public key of the first terminal, and after the first verification passes, signs the verification data using the pre-applied private key of the second terminal to obtain second signature data, and sends the second signature data to the first terminal.

[0079] Step 303: The first terminal receives the second signature data sent by the second terminal, performs a second verification on the second signature data using the public key of the second terminal, generates a session key after the second verification passes, encrypts the session key using the public key of the second terminal to obtain an encrypted session key, and sends the encrypted session key to the second terminal.

[0080] In the embodiment of the present invention, the first terminal may generate a session key using any applicable symmetric encryption algorithm. Exemplarily, the symmetric encryption algorithm may include, but is not limited to, an SM4 encryption algorithm, an AES (Advanced Encryption Standard) algorithm, a DES (Data Encryption Standard) algorithm, and the like. For example, the SM4 encryption algorithm may be used to generate a random number as the session key.

[0081] The first terminal may save the session key, and use the public key of the second terminal to encrypt the session key to obtain an encrypted session key, and send the encrypted session key to the second terminal.

[0082] Step 304: The second terminal receives the encrypted session key sent by the first terminal, and decrypts the encrypted session key using the private key of the second terminal to obtain the session key.

[0083] The second terminal receives the encrypted session key sent by the first terminal, decrypts the encrypted session key using the private key of the second terminal to obtain the session key, and saves the session key.

[0084] Step 305: The first terminal encrypts the first videophone data using the session key to obtain first encrypted videophone data, and sends the first encrypted videophone data to the second terminal.

[0085] Step 306: The second terminal receives the first encrypted videophone data sent by the first terminal, and decrypts the first encrypted videophone data using the session key to obtain the first videophone data.

[0086] Step 307: The second terminal encrypts the second videophone data using the session key to obtain second encrypted videophone data, and sends the second encrypted videophone data to the first terminal.

[0087] Step 308: The first terminal receives the second encrypted videophone data sent by the second terminal, and decrypts the second encrypted videophone data using the session key to obtain the second videophone data.

[0088] Since the first terminal and the second terminal synchronously save the session key, the first terminal can use the session key to encrypt the first videophone data sent to the second terminal, thereby obtaining the first encrypted videophone data, and the second terminal can use the session key to decrypt the received first encrypted videophone data, thereby obtaining the first videophone data. Correspondingly, the second terminal can use the session key to encrypt the second videophone data sent to the first terminal, thereby obtaining the second encrypted videophone data, and the first terminal can use the session key to decrypt the received second encrypted videophone data, thereby obtaining the second videophone data. By encrypting and transmitting the videophone data transmitted between the first terminal and the second terminal in this way, the security of the videophone service can be further guaranteed.

[0089] Step 309: After the videophone service ends, the first terminal deletes the session key.

[0090] Step 310: After the videophone service ends, the second terminal deletes the session key.

[0091] After the videophone service ends, the first terminal and the second terminal both delete the session key stored in each terminal, and regenerate the session key when the videophone service is performed next time, thereby further ensuring the security of the session key.

[0092] The following is an explanation using the videophone service in a video network as an example.

[0093] The network architecture of the visual network is deployed in a hierarchical cascade manner. Each visual network terminal has its own visual network number as the destination address of the service unit. The embodiment of the present invention uses the visual network number of the visual network terminal as the identity of the visual network terminal without changing the original business process (initiating the video telephone service by dialing the visual network number of the visual network terminal participating in the video telephone service).

[0094] Figure 4 and Figure 5 In the description, the asymmetric encryption algorithm is SM9 and the symmetric encryption algorithm is SM4 as examples, but in actual applications, it is not limited to these two algorithms.

[0095] Reference Figure 4 , showing a schematic diagram of a videophone service processing architecture according to an embodiment of the present invention.

[0096] like Figure 4 As shown, the video terminal A initiates the video call, and the video terminal B receives the video call. In the pre-stage, the video terminal A uses its own video number as an identity identifier to apply for an SM9 key pair from the key generation center, and the video terminal B uses its own video number as an identity identifier to apply for an SM9 key pair from the key generation center. The video terminal A signs with the private key of the video terminal A, and the video terminal B verifies the signature (that is, verifies the signature) with the public key of the video terminal A; the video terminal B signs with the private key of the video terminal B, and the video terminal A verifies the signature with the public key of the video terminal B. The video terminal A encrypts the SM4 session key with the public key of the video terminal B, and the video terminal B decrypts the SM4 session key with the private key of the video terminal B. The video phone data is encrypted between the video terminal A and the video terminal B using the SM4 session key.

[0097] Reference Figure 5 , which shows a schematic diagram of a videophone service processing process according to an embodiment of the present invention.

[0098] like Figure 5 As shown, the videophone service processing process may include:

[0099] ① Video network terminal A accesses the video network and applies for an SM9 key pair from the key generation center (apply for a key pair before the first videophone service, and no need to apply again if you have applied). After receiving the SM9 key pair, video network terminal A encrypts and stores its own SM9 private key.

[0100] ② Video network terminal B accesses the video network and applies for an SM9 key pair from the key generation center (apply for a key pair before the first videophone service, and no need to apply again if you have applied). After receiving the SM9 key pair, video network terminal B encrypts and stores its own SM9 private key.

[0101] ③ The video network terminal A initiates a video phone service application to the video network terminal B. The video phone service application includes verification data and first signature data obtained by signing the verification data using the SM9 private key of the video network terminal A.

[0102] ④ After receiving the videophone service application, the video network terminal B uses the SM9 public key of the video network terminal A to verify the first signature data. After the verification is passed, the SM9 private key of the video network terminal B is used to sign the verification data to obtain the second signature data.

[0103] ⑤ Visual network terminal B sends the second signature data to visual network terminal A.

[0104] ⑥ Visual networking terminal A uses the SM9 public key of visual networking terminal B to verify the second signature data. After the verification is passed, visual networking terminal A generates an SM4 session key, and uses the SM9 public key of visual networking terminal B to encrypt the SM4 session key to obtain the encrypted session key.

[0105] ⑦ Visual network terminal A sends the encrypted session key to visual network terminal B.

[0106] ⑧ Visual networking terminal B uses the SM9 private key of visual networking terminal B to decrypt the encrypted session key and obtain the session key.

[0107] ⑨ The video networking terminal A and the video networking terminal B complete key synchronization, and subsequently the video phone data encrypted by the session key is transmitted between the video networking terminal A and the video networking terminal B.

[0108] ⑩ After the videophone service ends, the video network terminal A and the video network terminal B each destroy the session key.

[0109] The embodiments of the present invention simplify the process of identity authentication based on digital certificates in the visual networking solution and ensure the security of the business, which helps to improve the market competitiveness of visual networking products and services.

[0110] Reference Figure 6, shows a structural block diagram of a videophone service processing device according to an embodiment of the present invention. The videophone service processing device according to the embodiment of the present invention is applied to a first terminal.

[0111] like Figure 6 As shown, the videophone service processing device may include the following modules:

[0112] The first processing module 601 is used to generate verification data, sign the verification data using the pre-applied private key of the first terminal to obtain first signature data, and send a videophone application carrying the verification data and the first signature data to the second terminal; so that the second terminal uses the public key of the first terminal to perform a first verification on the verification data and the first signature data, and after the first verification passes, use the pre-applied private key of the second terminal to sign the verification data to obtain second signature data, and send the second signature data to the first terminal;

[0113] The first interaction module 602 is used to perform a second verification on the second signature data using the public key of the second terminal, and after the second verification passes, send the first videophone data to the second terminal and receive the second videophone data sent by the second terminal.

[0114] Optionally, the device further includes: a third processing module, configured to generate a session key, encrypt the session key using a public key of the second terminal to obtain an encrypted session key, and send the encrypted session key to the second terminal, so that the second terminal decrypts the encrypted session key using a private key of the second terminal to obtain the session key;

[0115] The first interaction module 602 includes: a first encryption unit, used to encrypt the first videophone data using the session key to obtain the first encrypted videophone data, and send the first encrypted videophone data to the second terminal; so that the second terminal decrypts the first encrypted videophone data using the session key to obtain the first videophone data; a first decryption unit, used to receive the second encrypted videophone data sent by the second terminal, which is obtained by encrypting the second videophone data using the session key, and decrypt the second encrypted videophone data using the session key to obtain the second videophone data.

[0116] Optionally, the device further comprises: a first deleting module, configured to delete the session key after the videophone service ends.

[0117] Optionally, the device also includes: a first application module, used to send a first key application carrying the identity of the first terminal to a key generation center, and receive the private key of the first terminal returned by the key generation center, where the public key of the first terminal is the identity of the first terminal.

[0118] Optionally, the first processing module 601 is specifically configured to generate a random number as the verification data.

[0119] Reference Figure 7 , shows a structural block diagram of another videophone service processing device according to an embodiment of the present invention. The videophone service processing device according to an embodiment of the present invention is applied to a second terminal.

[0120] like Figure 7 As shown, the videophone service processing device may include the following modules:

[0121] The second processing module 701 is used to receive a videophone application sent by a first terminal, perform a first verification on the verification data and the first signature data carried in the videophone application using the public key of the first terminal, and after the first verification passes, sign the verification data using the pre-applied private key of the second terminal to obtain second signature data, and send the second signature data to the first terminal; the verification data is generated by the first terminal, and the first signature data is obtained by the first terminal signing the verification data using the pre-applied private key of the first terminal;

[0122] The second interaction module 702 is used to receive the first videophone data sent by the first terminal and send the second videophone data to the first terminal; the first terminal performs a second verification on the second signature data using the public key of the second terminal, and sends the first videophone data to the second terminal after the second verification passes.

[0123] Optionally, the device further includes: a fourth processing module, configured to receive an encrypted session key sent by the first terminal, obtained by encrypting the session key generated by using the public key of the second terminal, and decrypt the encrypted session key using the private key of the second terminal to obtain the session key;

[0124] The second interaction module 702 includes: a second decryption unit, which is used to receive the first encrypted videophone data sent by the first terminal, encrypt the first videophone data using the session key to obtain the first encrypted videophone data, and decrypt the first encrypted videophone data using the session key to obtain the first videophone data; a second encryption unit, which is used to encrypt the second videophone data using the session key to obtain the second encrypted videophone data, and send the second encrypted videophone data to the first terminal; so that the first terminal decrypts the second encrypted videophone data using the session key to obtain the second videophone data.

[0125] Optionally, the device further comprises: a second deleting module, configured to delete the session key after the videophone service ends.

[0126] In the embodiment of the present invention, the first terminal and the second terminal apply for their own public keys and private keys in advance using an asymmetric encryption algorithm. Before the first terminal and the second terminal exchange videophone data, they first use the public key and the private key to authenticate each other. After both parties have passed the authentication, they will further exchange videophone data, thereby ensuring the security of the videophone service and meeting the security requirements of the videophone service of higher importance.

[0127] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0128] In an embodiment of the present invention, an electronic device is further provided. The electronic device may include a processor and a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium; when the computer program is executed by the processor, the processor executes the videophone service processing method of any of the above embodiments.

[0129] Reference Figure 8 , shows a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 8 As shown, the electronic device 80 includes a processor 801 and a computer-readable storage medium 802 , on which a computer program 8021 is stored.

[0130] The processor 801 is used to execute the computer program 8021 stored on the computer-readable storage medium 802. When the processor 801 executes the computer program 8021, it implements the videophone service processing method of any of the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be described here.

[0131] The processor 801 mentioned above may include but is not limited to: a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0132] The computer-readable storage medium 802 mentioned above may include but is not limited to: Read Only Memory (ROM), Random Access Memory (RAM), Compact Disc Read Only Memory (CD-ROM), Electronic Erasable Programmable Read Only Memory (EEPROM), hard disk, floppy disk, flash memory, and the like.

[0133] In an embodiment of the present invention, a computer-readable storage medium is further provided, on which a computer program is stored. The computer program can be executed by a processor of an electronic device. When the computer program is executed by the processor, the processor executes the videophone service processing method described in any of the above embodiments.

[0134] Reference Fig. 9 , shows a block diagram of a computer-readable storage medium according to an embodiment of the present invention. Fig. 9 As shown, a computer program 901 is stored on a computer-readable storage medium 90. When the computer program 901 is executed by a processor, the processor executes the videophone service processing method described in any of the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be described here.

[0135] It should be noted that all actions of acquiring signals, information or data in the present invention are performed in compliance with the corresponding data protection laws and policies of the country where the device is located and with the authorization given by the owner of the corresponding device.

[0136] The various embodiments in this specification are interrelated, and each embodiment is described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referenced to each other.

[0137] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0138] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0139] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0140] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0141] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0142] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0143] The above is a detailed introduction to a videophone service processing method, device, electronic device and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principle and implementation of the present invention. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A videophone service processing method, characterized in that: Applied to a first terminal, the method includes: Generate verification data, sign the verification data using the pre-applied private key of the first terminal to obtain first signature data, and send a videophone application carrying the verification data and the first signature data to the second terminal; so that the second terminal uses the public key of the first terminal to perform a first verification on the verification data and the first signature data, and after the first verification passes, sign the verification data using the pre-applied private key of the second terminal to obtain second signature data, and send the second signature data to the first terminal; The second signature data is subjected to a second verification using the public key of the second terminal. After the second verification passes, the first videophone data is sent to the second terminal, and the second videophone data sent by the second terminal is received.

2. The method according to claim 1, characterized in that Before sending the first videophone data to the second terminal, the method further includes: Generate a session key, encrypt the session key using the public key of the second terminal to obtain an encrypted session key, and send the encrypted session key to the second terminal so that the second terminal decrypts the encrypted session key using the private key of the second terminal to obtain the session key; The sending of the first videophone data to the second terminal and receiving the second videophone data sent by the second terminal includes: Encrypting the first videophone data using the session key to obtain first encrypted videophone data, and sending the first encrypted videophone data to the second terminal; so that the second terminal decrypts the first encrypted videophone data using the session key to obtain the first videophone data; receiving second encrypted videophone data sent by the second terminal, which is obtained by encrypting the second videophone data using the session key, and decrypting the second encrypted videophone data using the session key to obtain the second videophone data.

3. The method according to claim 2, characterized in that The method further comprises: After the videophone service ends, the session key is deleted.

4. The method according to claim 1, characterized in that: Before generating validation data, also include: A first key application carrying the identity of the first terminal is sent to a key generation center, and a private key of the first terminal returned by the key generation center is received, where the public key of the first terminal is the identity of the first terminal.

5. The method according to claim 1, characterized in that The generating verification data includes: generating a random number as the verification data.

6. A videophone service processing method, characterized in that: Applied to the second terminal, the method includes: receiving a videophone application sent by a first terminal, performing a first verification on verification data and first signature data carried in the videophone application using a public key of the first terminal, and after the first verification passes, signing the verification data using a pre-applied private key of the second terminal to obtain second signature data, and sending the second signature data to the first terminal; the verification data is generated by the first terminal, and the first signature data is obtained by the first terminal signing the verification data using the pre-applied private key of the first terminal; The first videophone data sent by the first terminal is received, and the second videophone data is sent to the first terminal; the first terminal performs a second verification on the second signature data using the public key of the second terminal, and sends the first videophone data to the second terminal after the second verification passes.

7. The method according to claim 6, characterized in that Before receiving the videophone data sent by the first terminal, the method further includes: receiving an encrypted session key sent by the first terminal, obtained by encrypting the session key generated by using the public key of the second terminal, and decrypting the encrypted session key by using the private key of the second terminal to obtain the session key; The receiving the first videophone data sent by the first terminal and sending the second videophone data to the first terminal includes: receiving the first terminal sending, encrypting the first videophone data using the session key to obtain the first encrypted videophone data, and decrypting the first encrypted videophone data using the session key to obtain the first videophone data; The second videophone data is encrypted using the session key to obtain second encrypted videophone data, and the second encrypted videophone data is sent to the first terminal; so that the first terminal decrypts the second encrypted videophone data using the session key to obtain the second videophone data.

8. The method according to claim 7, characterized in that The method further comprises: After the videophone service ends, the session key is deleted.

9. A videophone service processing device, characterized in that: Applied to a first terminal, the device includes: A first processing module is used to generate verification data, sign the verification data using the pre-applied private key of the first terminal to obtain first signature data, and send a videophone application carrying the verification data and the first signature data to a second terminal; so that the second terminal performs a first verification on the verification data and the first signature data using the public key of the first terminal, and after the first verification passes, signs the verification data using the pre-applied private key of the second terminal to obtain second signature data, and sends the second signature data to the first terminal; The first interaction module is used to perform a second verification on the second signature data using the public key of the second terminal, and after the second verification passes, send the first videophone data to the second terminal and receive the second videophone data sent by the second terminal.

10. A videophone service processing device, characterized in that: Applied to a second terminal, the device includes: a second processing module, configured to receive a videophone application sent by a first terminal, perform a first verification on the verification data and the first signature data carried in the videophone application using a public key of the first terminal, and after the first verification passes, sign the verification data using a pre-applied private key of the second terminal to obtain second signature data, and send the second signature data to the first terminal; the verification data is generated by the first terminal, and the first signature data is obtained by the first terminal signing the verification data using a pre-applied private key of the first terminal; The second interaction module is used to receive the first videophone data sent by the first terminal and send the second videophone data to the first terminal; the first terminal performs a second verification on the second signature data using the public key of the second terminal, and sends the first videophone data to the second terminal after the second verification passes.

11. An electronic device, characterized in that: The electronic device comprises a processor and a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program; when the computer program is executed by the processor, the processor executes the videophone service processing method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the videophone service processing method according to any one of claims 1 to 8.

Images