Conversation encryption method and device, electronic equipment and storage medium

Abstract

The invention provides an encrypted call method and device, electronic equipment and a storage medium, relates to the technical field of wireless communication, and solves the technical problem that the security in a call process cannot be ensured when a key service identifier is subjected to plaintext transmission in related technologies. The method comprises the following steps: receiving a key negotiation request sent by a calling terminal, wherein the key negotiation request comprises first encrypted information; the first encrypted information is decrypted based on a calling protection key corresponding to the calling terminal to obtain calling call information, the calling call information comprises a target call identifier, and the target call identifier is a call identifier of an encrypted call between the calling terminal and the called terminal; performing encryption processing on a target service key corresponding to the target call identifier based on the calling protection key to obtain second encrypted information; and sending the second encrypted information to the calling terminal, so that the calling terminal performs an encrypted call based on the target service key.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to an encrypted call method, device, electronic device and storage medium. Background Art

[0002] Currently, when a call is initiated between terminals, the cloud-based secure call management platform can generate a key business identifier (specifically an encrypted communication identifier) ​​and send the key business identifier to the terminal via the Internet. The key business identifier is used in subsequent encrypted call processes between terminals.

[0003] However, in the above method, the key business identifier is directly transmitted in plain text via the Internet, lacks effective protection measures, and is easily intercepted and forged, and the security during the call may not be guaranteed. Summary of the invention

[0004] The present application provides an encrypted call method, device, electronic device and storage medium, which solves the technical problem in the related art that key business identifiers are transmitted in plain text and the security during the call cannot be guaranteed.

[0005] In the first aspect, the present application provides an encrypted call method, which is applied to a cryptographic server, and the method includes: receiving a key negotiation request sent by a calling terminal, the key negotiation request including first encrypted information; decrypting the first encrypted information based on a calling protection key corresponding to the calling terminal to obtain calling call information, the calling call information including a target call identifier, the target call identifier being a call identifier for an encrypted call between the calling terminal and the called terminal; encrypting a target business key corresponding to the target call identifier based on the calling protection key to obtain second encrypted information; and sending the second encrypted information to the calling terminal so that the calling terminal conducts an encrypted call based on the target business key.

[0006] In the second aspect, the present application provides an encrypted call method, which is applied to a calling terminal, and the method includes: obtaining calling call information, the calling call information including a target call identifier, and the target call identifier is a call identifier for an encrypted call between the calling terminal and the called terminal; encrypting the calling call information based on a calling protection key corresponding to the calling terminal to obtain first encrypted information; sending a key negotiation request to a cryptographic server, the key negotiation request including the first encrypted information, and the key negotiation request is used to request the cryptographic server to assign a service key to the calling terminal and the called terminal; receiving second encrypted information sent by the cryptographic server, and decrypting the second encrypted information based on the calling protection key to obtain a target service key corresponding to the target call identifier; and conducting an encrypted call based on the target service key.

[0007] In the third aspect, the present application provides an encrypted call device, which is applied to a cryptographic server, and the device includes: a receiving module, a processing module and a sending module; the receiving module is used to receive a key negotiation request sent by a calling terminal, and the key negotiation request includes first encrypted information; the processing module is used to decrypt the first encrypted information based on a calling protection key corresponding to the calling terminal to obtain calling call information, and the calling call information includes a target call identifier, which is a call identifier for an encrypted call between the calling terminal and the called terminal; the processing module is also used to encrypt a target business key corresponding to the target call identifier based on the calling protection key to obtain second encrypted information; the sending module is used to send the second encrypted information to the calling terminal, so that the calling terminal conducts an encrypted call based on the target business key.

[0008] In a fourth aspect, the present application provides an encrypted call device, which is applied to a calling terminal, and the device includes: an acquisition module, a processing module, a sending module and a receiving module; the acquisition module is used to acquire calling call information, and the calling call information includes a target call identifier, and the target call identifier is a call identifier for an encrypted call between the calling terminal and the called terminal; the processing module is used to encrypt the calling call information based on a calling protection key corresponding to the calling terminal to obtain first encrypted information; the sending module is used to send a key negotiation request to a cryptographic server, and the key negotiation request includes the first encrypted information, and the key negotiation request is used to request the cryptographic server to allocate a service key to the calling terminal and the called terminal; the receiving module is used to receive second encrypted information sent by the cryptographic server; the processing module is also used to decrypt the second encrypted information based on the calling protection key to obtain a target service key corresponding to the target call identifier; the processing module is also used to conduct an encrypted call based on the target service key.

[0009] In a fifth aspect, the present application provides an electronic device comprising: a processor and a memory configured to store processor executable instructions; wherein the processor is configured to execute the instructions to implement any one of the optional encrypted call methods in the above-mentioned first aspect, or to implement any one of the optional encrypted call methods in the above-mentioned second aspect.

[0010] In a sixth aspect, the present application provides a computer-readable storage medium having instructions stored thereon. When the instructions in the computer-readable storage medium are executed by an electronic device, the electronic device is enabled to execute any one of the optional encrypted call methods described in the first aspect, or to execute any one of the optional encrypted call methods described in the second aspect.

[0011] In the seventh aspect, the present application provides a computer program product, including a computer program or instructions. When the computer program or instructions are run on an electronic device, the electronic device executes any one of the optional encrypted call methods in the first aspect above, or executes any one of the optional encrypted call methods in the second aspect above.

[0012] The encrypted call method, device, electronic device and storage medium provided by the present application can obtain the target call identifier for the encrypted call between the calling terminal and the called terminal based on the calling protection key corresponding to the calling terminal after the cryptographic server receives the key negotiation request sent by the calling terminal. Afterwards, the cryptographic server can encrypt the target service key corresponding to the target call identifier based on the calling protection key, so that the calling terminal and the called terminal can conduct an encrypted call based on the target service key. By encrypting the target service key, the plaintext transmission of the key service identifier can be prevented, thereby improving the security of the user's encrypted call. As a result, the calling terminal and the called terminal can use the target service key to encrypt and decrypt the media data in the encrypted call, which can ensure the confidentiality and integrity of the call content during the entire communication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0014] Figure 1 A schematic diagram of the network architecture of the encrypted call system provided in an embodiment of the present application;

[0015] Figure 2 A flowchart of an encrypted call method provided in an embodiment of the present application;

[0016] Figure 3 A flowchart of another encrypted call method provided in an embodiment of the present application;

[0017] Figure 4 A schematic diagram of the structure of an encrypted communication device provided in an embodiment of the present application;

[0018] Figure 5 A schematic diagram of the structure of another encrypted communication device provided in an embodiment of the present application;

[0019] Figure 6 A schematic diagram of the structure of another encrypted communication device provided in an embodiment of the present application;

[0020] Figure 7 A schematic diagram of the structure of another encrypted communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] The following will describe in detail the encrypted call method, device, electronic device and storage medium provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0022] The terms "first" and "second" in the specification and drawings of this application are used to distinguish different objects rather than to describe the specific order of the objects. For example, the first encrypted information and the second encrypted information are used to distinguish different encrypted information rather than to describe the specific order of the encrypted information.

[0023] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0024] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0025] The term "and / or" used in the present application includes using either or both of the two methods.

[0026] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0027] Voice over long term evolution (VoLTE) is an Internet protocol (IP) data transmission technology (or voice communication technology) based on 4G networks, which can realize the unified bearing of data and voice services without relying on 2G / 3G networks. This technology can realize voice and video calls based on the IP multimedia subsystem (IMS) network and adopt IP data transmission.

[0028] VoLTE technology has the characteristics of shortening call connection time and improving voice and video quality. The IMS system has built-in authentication and authorization mechanisms, which can provide security for communication data to a certain extent. However, with the continuous evolution of mobile network attacks and data eavesdropping methods, traditional security measures are gradually unable to cope with risks such as malicious monitoring and data theft, and cannot fully protect the privacy and security of user communications. In order to deal with security issues in VoLTE calls, encryption technology can be introduced to enhance the security of data transmission during communication, prevent data from being eavesdropped or tampered with during transmission, and ensure the integrity and security of communication data.

[0029] In some embodiments, the VoLTE voice encryption communication process can be implemented based on a customized terminal and a security chip. The process can include steps such as identity authentication, generation and transmission of encryption service identifiers, and negotiation and transmission of call keys.

[0030] Specifically, in the identity authentication step, the calling terminal and the called terminal can use the authentication keys stored in their security chips to complete the identity authentication with their respective key management platforms. This process does not rely on the traditional certificate authentication module, but directly performs identity authentication through the built-in security chip. This step requires the terminal device to have a customized security chip to store and process keys, so as to ensure the security of communication identity authentication.

[0031] In the step of generating and transmitting the encrypted service identifier, when the calling terminal and the called terminal initiate a call, they can send a verification request to the cloud-based encrypted call service management platform. After receiving the verification request, the cloud-based encrypted call service management platform generates a key service identifier (specifically, an encrypted communication identifier) ​​and returns it to the calling terminal and the called terminal via the Internet. The key service identifier is used for subsequent session key application and encrypted call processes.

[0032] In the call key negotiation and delivery step, the calling terminal and the called terminal can apply for the session key of this call from their key management platform based on the received key business identifier (or encrypted communication identifier). The key application is carried out by reporting the calling number and the called number. After the session key is generated, both parties use the media channel to transfer the session key to ensure that the calling and called terminals use the same session key to encrypt and decrypt voice data during the call.

[0033] In the above embodiments, it is usually necessary to deeply customize the terminal equipment, such as introducing a security chip, customizing a security terminal integrated encryption module, etc., to achieve encrypted communication in the VoLTE network. That is, users need specific terminal equipment and corresponding configurations to use the encrypted communication function. Although the security of communication is improved, higher requirements are placed on user equipment, such as the need to change equipment when users use services, which limits the popularity and flexibility of the technology. In addition, key business identifiers are often transmitted directly in plain text over the Internet, lack effective encryption measures, and are easily intercepted and forged by attackers. There is a risk of cracking in the face of complex attacks, and there is still room for improvement in encryption strength and transmission security.

[0034] In other embodiments, the VoLTE voice encryption communication process can be implemented based on the certificate authentication system. The process can include steps such as certificate authentication mechanism, mobile phone end encryption communication, and call key distribution and management of the certificate system.

[0035] Specifically, in the certificate authentication mechanism step, the certificate authentication system can be composed of a cloud-based confidential call service management platform, an operator network, and mobile phone components. The cloud-based confidential call service management platform is responsible for user management and certificate management in the VoLTE voice call service, and provides session key distribution functions. Through the certificate authentication mechanism of the cloud-based confidential call service management platform, users need to pass identity authentication when making calls, and the client's encryption certificate is uniformly issued by the cloud-based confidential call service management platform when the user logs in, ensuring the encryption security of call data.

[0036] In the encrypted communication step on the mobile phone, the communication data between the cloud-based secure call service management platform and the mobile phone can be carried and transmitted based on the operator's IMS network. The mobile phone component is responsible for providing encrypted call functions and performing real-time encryption and decryption operations on the voice data generated during the call, thereby enhancing the security of communication.

[0037] In the call key distribution and management steps of the certificate system, the cloud-based secret call service management platform is responsible for the generation and distribution of session keys. Key transfer strongly relies on the application, download and authentication of the security mechanism of the certificate. After the verification is passed, the key can be securely transmitted.

[0038] In this embodiment, although relying on the certificate authentication system can ensure the trusted relationship between the terminal side and the platform, identity authentication is achieved by entering information such as the service identifier into the certificate authentication system. However, the initialization authentication and call key negotiation process often takes a long time, resulting in delays in communication establishment, thereby reducing business processing efficiency, especially affecting user experience in a high-concurrency environment.

[0039] Based on the description in the background technology, in the related technology, the key business identifier is directly transmitted in plain text through the Internet, lacking effective protection measures, and is easily intercepted and forged, and the security during the call may not be guaranteed. Based on this, the embodiment of the present application provides an encrypted call method, device, electronic device and storage medium, which can prevent the plain text transmission of the key business identifier by encrypting the target business key, thereby improving the security of the user's encrypted call. Thus, the calling terminal and the called terminal can use the target business key to encrypt and decrypt the media data in the encrypted call, which can ensure the confidentiality and integrity of the call content during the entire communication process.

[0040] The encrypted call method, device, electronic device and storage medium provided in the embodiments of the present application can be applied to an encrypted call system. Figure 1 As shown in FIG. 1 , the encrypted call system includes a service management server 101, a password server 102, a storage server 103, the Internet 104, a terminal 105, a VoLTE network 106, and a terminal 107. Generally, in practical applications, the connection between the above-mentioned devices can be a wireless connection. In order to conveniently and intuitively represent the connection relationship between the various devices, Figure 1 Solid lines are used to indicate this.

[0041] Among them, the terminal (including terminal 105 and terminal 107) may include an encryption communication module, which is composed of an encryption communication software development kit (SDK), an application (App for short) and a subscriber identity module (SIM) card. It can support the access of various terminal devices (such as mobile phones, tablets, smart watches, etc.). The terminal form can be applicable to IMS App clients and native terminal devices with VoLTE audio and video communication capabilities. The encryption communication SDK provides the functions of negotiation and destruction of encryption keys, negotiation of call signaling, call initiation, answering, hanging up and encryption and decryption of media data. In addition, the SIM card can store the protection key generated offline by the cryptographic server 102 to ensure the security of subsequent business key negotiation and avoid the plain text transmission of business keys on the Internet.

[0042] The service management server 101 is responsible for managing the activation of the encrypted communication function, verification of user identity, distribution of configuration files, etc. The service management server 101 can ensure that the user terminal (or terminal) has the ability to encrypt communication and maintain a secure connection between the terminal and the network.

[0043] The cryptographic server 102 is used to generate protection keys offline and negotiate business keys online, providing a two-way authentication mechanism based on the national encryption algorithm. It works together with the encryption communication module included in the terminal to complete initial authentication and periodic authentication, ensuring the security of the terminal and preventing data from being tampered with or forged.

[0044] The storage server 103 is used to provide data storage functions for the business management server 101 and the cryptographic server 102. It is mainly responsible for storing key information, terminal information and user data during the communication process, and supports data management and query to ensure the security and integrity of data storage during communication.

[0045] Terminal 105 and terminal 107 can have an encrypted conversation via VoLTE network 106 .

[0046] Optionally, the functions of the above-mentioned storage server may also be integrated into the business management server 101 and / or the password server 102, that is, the business management server 101 and the password server 102 may also have storage functions.

[0047] Exemplarily, an electronic device (including Figure 1 The terminal 105 and the terminal 107 shown in the figure can be a mobile phone, a tablet computer, a desktop, a laptop, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) or a virtual reality (VR) device. The embodiment of the present application does not impose any special restrictions on the specific form of the electronic device. It can interact with the user through one or more methods such as a keyboard, a touchpad, a touch screen, a remote control, a voice interaction or a handwriting device.

[0048] Optionally, the electronic device (including Figure 1 The business management server 101, cryptographic server 102, and storage server 103 shown in the figure can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, network acceleration services (content delivery network, CDN), as well as big data and artificial intelligence platforms.

[0049] Combined with the above Figure 1The encryption system shown in the figure, the encrypted call method provided by the embodiment of the present application is fully described below from the perspective of the interaction between each device in the encryption system, so as to illustrate the process of authenticating the calling terminal and the process of the calling terminal obtaining the target service key.

[0050] like Figure 2 As shown, the encrypted call method provided in the embodiment of the present application may include S101-S112.

[0051] S101: A calling terminal sends a service authentication request to a service management server.

[0052] The service authentication request includes a first account identifier, the first account identifier is an account identifier corresponding to the calling terminal, and the service authentication request is used to perform call service authentication on the calling terminal.

[0053] Specifically, an App is installed in the calling terminal, and the calling terminal can call a status query interface opened by the service management server through the App to send the service authentication request.

[0054] S102: The service management server receives a service authentication request sent by the calling terminal.

[0055] S103: The service management server determines whether the calling terminal has activated the call service and whether the call service corresponding to the calling terminal is within the validity period.

[0056] Specifically, the service management server may determine, based on the first account identifier, whether the calling terminal (or the account corresponding to the calling terminal, hereinafter referred to as the calling account) has activated the call service and whether the call service corresponding to the calling terminal is within the validity period.

[0057] S104: When the calling terminal has activated the call service and the call service of the calling terminal is within the validity period, the service management server sends a service authentication success response to the calling terminal.

[0058] The service authentication success response is used to notify the calling terminal that the call service authentication is successful.

[0059] It should be understood that when the calling terminal has activated the call service and the call service of the calling terminal is within the validity period, it means that the calling terminal (or calling account) is a legitimate user who has activated the call service. At this time, the service management server can send a service authentication success response to the calling terminal.

[0060] Optionally, when the calling terminal has not activated the call service and / or the call service of the calling terminal is out of validity (i.e., not within the validity period), it indicates that the calling terminal (or the calling account) is not a legitimate user of the call service. At this time, the service management server may send a service authentication failure response to the calling terminal to notify the calling terminal that the call service authentication has failed.

[0061] It should be understood that the called terminal may also send a service authentication request to the service management server, and the service management server authenticates the call service of the called terminal. The service authentication request sent by the called terminal includes the second account identifier (ie, the account identifier corresponding to the called terminal).

[0062] It is understandable that the calling terminal and the called terminal are the two end devices for a call (or encrypted call), and the terminal that actively initiates an encrypted call is the calling terminal. Correspondingly, the terminal that receives an encrypted call (or passively initiates an encrypted call) can be understood as the called terminal.

[0063] For example, in combination with the above Figure 1 In the encrypted call system shown, the calling terminal in the embodiment of the present application may be terminal 105 (or terminal 107), and the called terminal may be terminal 107 (or terminal 105).

[0064] S105: The calling terminal receives a service authentication success response sent by the service management server.

[0065] In the embodiment of the present application, after the service management server verifies the calling terminal (specifically, the call service authentication of the calling terminal is successful), the calling terminal can start the password service authentication process (specifically, the password server verifies the legitimacy of the encryption capability of the calling terminal).

[0066] S106: The calling terminal obtains the calling call information.

[0067] The calling call information includes an integrated circuit card identity (ICCID) of the calling terminal and a first account identifier.

[0068] In the embodiment of the present application, the calling call information also includes a target call identifier, where the target call identifier is a call identifier (call ID) for an encrypted call between the calling terminal and the called terminal.

[0069] S107: The calling terminal generates a first hash value based on the authentication key and the ICCID of the calling terminal.

[0070] It should be understood that the authentication key and the ICCID of the calling terminal can be stored in the SIM card of the calling terminal, and the calling terminal can use the authentication key as the zero key to complete the identity authentication of the calling terminal.

[0071] In an optional implementation, the calling terminal may combine the ICCID of the calling terminal and the authentication key (specifically a character string), and use the SM3 hash algorithm to obtain the above-mentioned first hash value.

[0072] S108: The calling terminal sends a cryptographic service authentication request to the cryptographic server.

[0073] The password service authentication request includes a first hash value and a first account identifier, and the password service authentication request is used to request password service authentication for the calling terminal.

[0074] S109: The cryptographic server receives a cryptographic service authentication request sent by the calling terminal.

[0075] S110. The cryptographic server generates a second hash value based on the authentication key and the first ICCID.

[0076] Among them, the first ICCID corresponds to the above-mentioned first account identifier.

[0077] It should be understood that after receiving the password service authentication request sent by the calling terminal, the password server can obtain the first ICCID corresponding to (or bound to) the first account identifier based on the first account identifier included in the password service authentication request, and generate a second hash value based on the first ICCID and the authentication key.

[0078] In the embodiment of the present application, the specific process of the password server generating the second hash value is the same or similar to the explanation of the calling terminal generating the first hash value, which will not be repeated here.

[0079] S111. When the first hash value is the same as the second hash value, the cryptographic server sends a cryptographic service success response to the calling terminal.

[0080] The cryptographic service success response is used to notify the calling terminal that the cryptographic service authentication is successful.

[0081] It should be understood that when the first hash value is the same as the second hash value, it indicates that the encryption capability of the calling terminal (or the calling account) is legitimate or the encryption service of the calling terminal is legitimate. At this time, the password server can send a password service success response to the calling terminal, that is, notify the calling terminal that the password service authentication is successful.

[0082] Optionally, when the first hash value is different from the second hash value, it indicates that the encryption capability of the calling terminal is not legitimate or the encryption of the calling terminal is not legitimate. At this time, the cryptographic server sends a cryptographic service failure response to the calling terminal, which is used to notify the calling terminal that the cryptographic service authentication has failed.

[0083] In one implementation of the embodiment of the present application, the cryptographic service authentication request may include part of the content in the first hash value (hereinafter referred to as the first content), and then the cryptographic server may compare the first content with part of the content in the generated second hash value (hereinafter referred to as the second content) to determine whether they are the same. The position of the first content in the first hash value is the same as the position of the second content in the second hash value. The specific process can be implemented through the following steps A to F.

[0084] Step A: The calling terminal generates a 16-byte random number.

[0085] It should be understood that the random number (rand) can be used as a part of the cryptographic service authentication request to ensure the uniqueness of the cryptographic service authentication request sent by the calling terminal each time and prevent replay attacks.

[0086] Step B: The calling terminal generates a 32-byte first hash value based on the authentication key and the ICCID of the calling terminal.

[0087] Step C: The calling terminal concatenates the random number and the last 16 bytes of the first hash value to obtain authentication data X.

[0088] That is, the last 16 bytes of the authentication data X=rand+(authentication key+ICCID of the calling terminal).

[0089] Step D: The calling terminal sends a password service authentication request to the password server.

[0090] The password service authentication request includes authentication data X and a first account identifier.

[0091] Step E: After receiving the password service authentication request sent by the calling terminal, the password server determines the first ICCID based on the first account identifier, and generates a 32-byte second hash value based on the authentication key and the first ICCID.

[0092] Step F: When the last 16 bytes of the second hash value are the same as the last 16 bytes of the first hash value, the cryptographic server sends a cryptographic service success response to the calling terminal.

[0093] It should be understood that the last 16 bytes of the first hash value are also the last 16 bytes of the authentication data X.

[0094] S112: The calling terminal receives a password service success response sent by the password server.

[0095] In the embodiment of the present application, the called terminal can also implement the password service authentication process of the called terminal by sending a password service authentication request to the password server. The specific process of the called terminal performing password service authentication is the same or similar to the explanation of the calling terminal performing password service authentication process, which will not be repeated here.

[0096] Optionally, the calling terminal and the called terminal can implement initialization authentication and / or periodic authentication of call service and password service based on the steps involved in S101-S112. The present embodiment of the application does not specifically limit the timing or period of call service authentication and password service authentication of the calling terminal and the called terminal.

[0097] In the embodiment of the present application, when the service management server and the cryptographic server authenticate both the calling terminal and the called terminal, the calling terminal and the called terminal can initiate an encrypted call request, thereby realizing end-to-end encrypted calls (or communications), and ensuring the security and integrity of communication data. In addition, since the above authentication process does not introduce a certificate system, the complexity of service deployment can be greatly reduced.

[0098] At this point, both the calling terminal and the called terminal have passed the authentication of the service management server and the password server, and then the key negotiation process can be started between the calling terminal and the called terminal. Figure 3 As shown, it may specifically include S201-S219.

[0099] S201. The calling terminal sends a service status query request to the service management server.

[0100] The service status query request includes the first account identifier and the second account identifier, and the service status query request is used to request to query the encrypted call service subscription status of the calling terminal and the called terminal.

[0101] S202: The service management server receives a service status query request sent by the calling terminal.

[0102] It should be understood that after receiving the service status query request, the service management server can determine whether the calling terminal has activated the encrypted call service and whether the subscription status of the encrypted call service of the calling terminal is valid based on the first account identifier. And the service management server can determine whether the called terminal has activated the encrypted call service and whether the subscription status of the encrypted call service of the called terminal is valid based on the second account identifier.

[0103] Specifically, the process in which the service management server determines whether the calling terminal (and called terminal) has activated the encrypted call service and whether the subscription status of the encrypted call service of the calling terminal (and called terminal) is valid can also be implemented by the storage server.

[0104] Optionally, when the term of the encrypted call service subscribed by the calling terminal is within the validity period, the service management server may determine that the subscription status of the encrypted call service of the calling terminal is in a valid state.

[0105] S203: The service management server sends a first service status query response to the calling terminal.

[0106] The first service status query response is used to notify the calling terminal and the called terminal that the encrypted call service subscription status is in a normal state, and an encrypted call can be performed between the calling terminal and the called terminal.

[0107] Specifically, when the calling terminal and the called terminal have both activated the encrypted call service, and the subscription status of the encrypted call service of the calling terminal and the called terminal is valid, the service management server can send the first service status query response to the calling terminal.

[0108] Optionally, when the calling terminal and / or the called terminal has not activated the encrypted call service, or the subscription status of the encrypted call service of the calling terminal is invalid and / or the subscription status of the encrypted call service of the called terminal is invalid, the service management server may send a second service status query response to the calling terminal, and the second service status query response is used to notify the calling terminal and / or the called terminal that the subscription status of the encrypted call service is in an abnormal state, and an encrypted call cannot be conducted between the calling terminal and the called terminal.

[0109] S204: The calling terminal receives a first service status query response sent by the service management server.

[0110] It should be understood that after the service management server determines the encrypted call service subscription status of the calling terminal and the called terminal, the calling terminal may initiate a session initialization protocol (SIP) request for the encrypted call.

[0111] S205: The calling terminal sends an encrypted call request to the VoLTE network.

[0112] The encrypted call request includes the first account identifier and the second account identifier. The encrypted call request is used to request to establish an encrypted call channel between the calling terminal and the called terminal.

[0113] Optionally, the encrypted call request may also include a service identifier of the encrypted call service.

[0114] Exemplarily, the encrypted call request may be an INVITE request.

[0115] S206: The VoLTE network receives the encrypted call request sent by the calling terminal.

[0116] S207. The VoLTE network sends an encrypted call request to the called terminal.

[0117] Specifically, the VoLTE network may determine the route of the called terminal based on the second account identifier, and send the encrypted call request to the called terminal based on the route of the called terminal.

[0118] It should be understood that the steps / actions performed by the above-mentioned VoLTE network may be specifically performed by a network element device in the VoLTE network, and the network element device may be a call session control function (CSCF) network element.

[0119] S208: The called terminal receives the encrypted call request sent by the VoLTE network.

[0120] S209: The called terminal sends a 200 OK signaling to the calling terminal.

[0121] The 200OK signaling is used to notify the called terminal that the encrypted call request has been received, and the called terminal also starts to answer the call.

[0122] S210: The calling terminal receives a 200OK signaling sent by the called terminal.

[0123] It should be understood that after the calling terminal receives the 200OK signaling, the encrypted call (or encrypted call channel) between the calling terminal and the called terminal is formally established, and the calling terminal and the called terminal can conduct an encrypted call.

[0124] S211. The calling terminal encrypts the calling call information based on the calling protection key corresponding to the calling terminal to obtain first encrypted information.

[0125] It is understandable that one terminal may correspond to one or more protection keys, and the SDK in the calling terminal may randomly select a protection key from one or more protection keys stored in the SIM card of the calling terminal as the calling protection key.

[0126] In combination with the description of the above embodiment, it should be understood that before the calling terminal obtains the first encrypted information, the calling terminal will first obtain the calling call information.

[0127] In this embodiment, the calling call information includes a target call identifier, where the target call identifier is a call identifier for an encrypted call between a calling terminal and a called terminal.

[0128] It should be understood that the call identifier is generated by the calling terminal (or the initiator of the call) when establishing the encrypted call channel. The VoLTE network will then identify whether the call identifier complies with the network specifications of the VoLTE network. If it does, it will be recorded and sent to the recipient of the call (i.e. the called terminal) after the encrypted call channel is established.

[0129] Optionally, the calling call information may also include the ICCID of the calling terminal, the first account identifier, and the second account identifier.

[0130] S212: The calling terminal sends a key negotiation request to the cryptographic server.

[0131] The key negotiation request includes the first encrypted information, and the key negotiation request is used to request the cryptographic server to allocate service keys to the calling terminal and the called terminal.

[0132] Specifically, the calling terminal may send a key negotiation request to the cryptographic server based on the SDK in the calling terminal.

[0133] S213: The cryptographic server receives a key negotiation request sent by the calling terminal.

[0134] In combination with the description of the above embodiment, it should be understood that the key negotiation request includes the first encryption information.

[0135] S214. The cryptographic server decrypts the first encrypted information based on the calling protection key corresponding to the calling terminal to obtain calling call information.

[0136] The calling call information includes a target call identifier, where the target call identifier is a call identifier for an encrypted call between a calling terminal and a called terminal.

[0137] It should be understood that a set of all protection keys is stored in the cryptographic server, and the set can represent each terminal and the protection key corresponding to each terminal. The cryptographic server can determine the calling protection key corresponding to the calling terminal based on the set.

[0138] S215. The cryptographic server encrypts the target service key corresponding to the target call identifier based on the caller protection key to obtain second encrypted information.

[0139] It should be understood that one call identifier corresponds to one service key, and by setting "one call, one key" the security and uniqueness of the encrypted call can be guaranteed.

[0140] Optionally, the cryptographic server may include a hardware for generating a business key, and the hardware may be a key random number generator. The key random number generator may randomly generate a key that meets the business requirements, and the cryptographic server may use the key as the business key.

[0141] S216. The cryptographic server sends second encryption information to the calling terminal, so that the calling terminal performs an encrypted call based on the target service key.

[0142] S217: The calling terminal receives the second encrypted information sent by the cryptographic server.

[0143] S218. The calling terminal decrypts the second encrypted information based on the calling protection key to obtain a target service key corresponding to the target call identifier.

[0144] S219: The calling terminal performs an encrypted call based on the target service key.

[0145] In the embodiment of the present application, the specific process (ie, key negotiation) of the called terminal obtaining the target service key is the same or similar to the explanation of the step of the calling terminal obtaining the target service key, and will not be repeated here.

[0146] In the embodiment of the present application, after receiving the key negotiation request sent by the calling terminal, the cryptographic server can obtain the target call identifier for the encrypted call between the calling terminal and the called terminal based on the calling protection key corresponding to the calling terminal. Afterwards, the cryptographic server can encrypt the target service key corresponding to the target call identifier based on the calling protection key, so that the calling terminal and the called terminal can conduct an encrypted call based on the target service key. By encrypting the target service key, the plaintext transmission of the key service identifier can be prevented, thereby improving the security of the user's encrypted call. As a result, the calling terminal and the called terminal can use the target service key to encrypt and decrypt the media data in the encrypted call, which can ensure the confidentiality and integrity of the call content during the entire communication process.

[0147] In one implementation of the embodiment of the present application, the calling terminal performs an encrypted call based on the target service key, which can be implemented by following steps G-N.

[0148] Step G: The calling terminal obtains a first media packet corresponding to the encrypted call.

[0149] The first media packet includes a packet header part and a first packet body part.

[0150] It should be understood that the media packet in the embodiment of the present application may be a real-time transport protocol (RTP) packet, which is used to carry voice data and / or video data, so the RTP packet may also be referred to as a call media data packet. In a VoLTE network, the header portion in the media packet may be used to determine whether it is an IMS call.

[0151] Step H: The calling terminal encrypts the first packet body part based on the target service key to obtain the second packet body part.

[0152] It can be understood that the package body part (including the first package body part and the second package body part) in the embodiment of the present application includes the content of the encrypted call between the calling terminal and the called terminal.

[0153] Step I: The calling terminal generates a second media packet based on the packet header part and the second packet body part.

[0154] Step J: The calling terminal sends the second media packet to the network element device in the call network, so that the network element device sends the second media packet to the called terminal.

[0155] Optionally, the call network is a VoLTE network, and the network element device is a CSCF network element.

[0156] Step K: The network element device receives the second media packet.

[0157] Step L: The network element device sends a second media packet to the called terminal.

[0158] Step M: The called terminal receives the second media packet sent by the network element device.

[0159] Step N: The called terminal decrypts the second media packet based on the target service key to obtain the content of the encrypted call between the calling terminal and the called terminal.

[0160] It should be understood that the process of the called terminal decrypting the second media packet is specifically to decrypt the second packet body part in the second media packet to obtain the above-mentioned first packet body part.

[0161] At this point, the encrypted call between the calling terminal and the called terminal is completed. The called terminal can restore the call content by decrypting the encrypted media package, ensuring the confidentiality and integrity of the call process.

[0162] In the embodiment of the present application, after the encrypted call between the calling terminal and the called terminal ends, in order to prevent the encrypted call content from being illegally obtained or tampered with, the service key can be destroyed.

[0163] Based on this, after the calling terminal performs an encrypted call based on the target service key, the encrypted call method provided in the embodiment of the present application may further include steps O to Q.

[0164] Step O: The cryptographic server sends a key deletion instruction to the calling terminal.

[0165] The key deletion indication includes at least one call identifier, and the key deletion indication is used to instruct the calling terminal to delete the service key corresponding to each of the at least one call identifier.

[0166] Step P: The calling terminal receives a key deletion instruction sent by the cryptographic server.

[0167] Step Q: The calling terminal deletes the service key corresponding to at least one call identification.

[0168] The cryptographic server may also send the key deletion instruction to the called terminal to instruct the called terminal to delete the service key corresponding to at least one call identifier.

[0169] At this point, the calling terminal and the called terminal can periodically destroy the used business keys to ensure that each call uses a unique business key, which can implement a "one call, one key" security mechanism and improve call security and data protection.

[0170] The embodiment of the present application can divide the functional modules of the terminal (including the calling terminal and the called terminal), the password server, the service management server, and the storage server according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0171] In the case of dividing each functional module into corresponding functional modules, Figure 4 A possible structural diagram of the encrypted communication device involved in the above embodiment is shown, and the encrypted communication device is applied to the password server in the above embodiment. Figure 4 As shown, the encrypted communication device 30 may include: a receiving module 301 , a processing module 302 and a sending module 303 .

[0172] The receiving module 301 is configured to receive a key negotiation request sent by a calling terminal, where the key negotiation request includes first encryption information.

[0173] The processing module 302 is used to decrypt the first encrypted information based on the caller protection key corresponding to the calling terminal to obtain the calling call information, which includes a target call identifier, which is a call identifier for the encrypted call between the calling terminal and the called terminal.

[0174] The processing module 302 is further used to encrypt the target service key corresponding to the target call identifier based on the calling protection key to obtain second encrypted information.

[0175] The sending module 303 is used to send the second encrypted information to the calling terminal, so that the calling terminal performs an encrypted call based on the target service key.

[0176] Optionally, the receiving module 301 is further configured to receive a password service authentication request sent by the calling terminal, where the password service authentication request includes a first hash value and a first account identifier, where the first account identifier is an account identifier corresponding to the calling terminal.

[0177] The processing module 302 is further configured to generate a second hash value based on the authentication key and the first ICCID, where the first ICCID corresponds to the first account identifier.

[0178] The sending module 303 is further configured to send a cryptographic service success response to the calling terminal when the first hash value is the same as the second hash value, wherein the cryptographic service success response is used to notify the calling terminal that the cryptographic service authentication is successful.

[0179] Optionally, the sending module 303 is further used to send a key deletion indication to the calling terminal, where the key deletion indication includes at least one call identifier, and the key deletion indication is used to instruct the calling terminal to delete the service key corresponding to each of the at least one call identifier.

[0180] In the case of an integrated unit, Figure 5 FIG. 1 shows a possible structural diagram of the encrypted communication device involved in the above embodiment. Figure 5 As shown, the encrypted communication device 40 may include: a processing module 401 and a communication module 402. The processing module 401 may be used to control and manage the actions of the encrypted communication device 40. The communication module 402 may be used to support the communication between the encrypted communication device 40 and other entities. Figure 5 As shown, the encrypted communication device 40 may further include a storage module 403 for storing program codes and data of the encrypted communication device 40 .

[0181] The processing module 401 may be a processor or a controller. The communication module 402 may be a transceiver, a transceiver circuit or a communication interface, etc. The storage module 403 may be a memory.

[0182] When the processing module 401 is a processor, the communication module 402 is a transceiver, and the storage module 403 is a memory, the processor, the transceiver, and the memory may be connected via a bus. The bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc.

[0183] In the case of dividing each functional module into corresponding functional modules, Figure 6 FIG. 1 shows a possible structural diagram of the encrypted communication device involved in the above embodiment, and the encrypted communication device is applied to the calling terminal in the above embodiment. Figure 6 As shown, the encrypted communication device 50 may include: an acquisition module 501 , a processing module 502 , a sending module 503 and a receiving module 504 .

[0184] The acquisition module 501 is used to acquire the call information of the calling party, where the call information includes a target call identifier, and the target call identifier is a call identifier for the encrypted call between the calling terminal and the called terminal.

[0185] The processing module 502 is used to encrypt the calling call information based on the calling protection key corresponding to the calling terminal to obtain first encrypted information.

[0186] The sending module 503 is used to send a key negotiation request to the cryptographic server, where the key negotiation request includes the first encryption information, and the key negotiation request is used to request the cryptographic server to allocate a service key to the calling terminal and the called terminal.

[0187] The receiving module 504 is used to receive the second encrypted information sent by the cryptographic server.

[0188] The processing module 502 is further used to decrypt the second encrypted information based on the calling protection key to obtain a target service key corresponding to the target call identifier.

[0189] The processing module 502 is further configured to perform an encrypted call based on the target service key.

[0190] Optionally, the above-mentioned calling call information also includes the ICCID of the calling terminal and a first account identifier, and the first account identifier is an account identifier corresponding to the calling terminal.

[0191] The processing module 502 is further configured to generate a first hash value based on the authentication key and the ICCID.

[0192] The sending module 503 is further used to send a password service authentication request to the password server, where the password service authentication request includes the first hash value and the first account identifier, and the password service authentication request is used to request password service authentication for the calling terminal.

[0193] The receiving module 504 is further configured to receive a password service success response sent by the password server, where the password service success response is used to notify the calling terminal that the password service authentication is successful.

[0194] Optionally, the encrypted communication device 50 may further include a deletion module 505 .

[0195] The receiving module 504 is further configured to receive a key deletion instruction sent by the cryptographic server, where the key deletion instruction includes at least one call identifier.

[0196] The deleting module 505 is used to delete the service key corresponding to each of the at least one call identifiers.

[0197] Optionally, the acquisition module 501 is further configured to acquire a first media packet corresponding to the encrypted call, wherein the first media packet includes a packet header portion and a first packet body portion.

[0198] The processing module 502 is specifically configured to encrypt the first package body part based on the target business key to obtain a second package body part.

[0199] The processing module 502 is further specifically configured to generate a second media packet based on the packet header portion and the second packet body portion.

[0200] The sending module 503 is further configured to send the second media packet to a network element device in the call network, so that the network element device sends the second media packet to the called terminal.

[0201] In the case of an integrated unit, Figure 7 FIG. 1 shows a possible structural diagram of the encrypted communication device involved in the above embodiment. Figure 7 As shown, the encrypted communication device 60 may include: a processing module 601 and a communication module 602. The processing module 601 may be used to control and manage the actions of the encrypted communication device 60. The communication module 602 may be used to support the communication between the encrypted communication device 60 and other entities. Figure 7 As shown, the encrypted communication device 60 may further include a storage module 603 for storing program codes and data of the encrypted communication device 60 .

[0202] The processing module 601 may be a processor or a controller. The communication module 602 may be a transceiver, a transceiver circuit or a communication interface, etc. The storage module 603 may be a memory.

[0203] When the processing module 601 is a processor, the communication module 602 is a transceiver, and the storage module 603 is a memory, the processor, the transceiver, and the memory can be connected via a bus. The bus can be a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0204] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0205] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0206] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0207] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0208] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing a computer program instruction on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or may contain one or more servers, data centers and other data storage devices that can be integrated with a medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0209] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An encrypted call method, characterized in that: Applied to a password server, the method comprises: Receiving a key negotiation request sent by a calling terminal, wherein the key negotiation request includes first encryption information; Decrypting the first encrypted information based on the caller protection key corresponding to the calling terminal to obtain calling call information, wherein the calling call information includes a target call identifier, and the target call identifier is a call identifier for the encrypted call between the calling terminal and the called terminal; Encrypting the target service key corresponding to the target call identifier based on the caller protection key to obtain second encrypted information; The second encryption information is sent to the calling terminal, so that the calling terminal performs an encrypted call based on the target service key.

2. The method according to claim 1, characterized in that: Before receiving the key negotiation request sent by the calling terminal, the method further includes: receiving a password service authentication request sent by the calling terminal, wherein the password service authentication request includes a first hash value and a first account identifier, where the first account identifier is an account identifier corresponding to the calling terminal; generating a second hash value based on the authentication key and a first integrated circuit card identification code ICCID, the first ICCID corresponding to the first account identifier; When the first Hash value is the same as the second Hash value, a cryptographic service success response is sent to the calling terminal, where the cryptographic service success response is used to notify the calling terminal that the cryptographic service authentication is successful.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: A key deletion indication is sent to the calling terminal, wherein the key deletion indication includes at least one call identifier, and the key deletion indication is used to instruct the calling terminal to delete the service key corresponding to each of the at least one call identifier.

4. An encrypted call method, characterized in that: Applied to a calling terminal, the method comprises: Acquire call information of the calling party, wherein the call information of the calling party includes a target call identifier, and the target call identifier is a call identifier of an encrypted call between the calling terminal and the called terminal; Encrypting the calling call information based on the calling protection key corresponding to the calling terminal to obtain first encrypted information; Sending a key negotiation request to a cryptographic server, where the key negotiation request includes the first encryption information, and the key negotiation request is used to request the cryptographic server to allocate a service key to the calling terminal and the called terminal; receiving the second encrypted information sent by the password server, and decrypting the second encrypted information based on the caller protection key to obtain the target service key corresponding to the target call identifier; An encrypted call is performed based on the target service key.

5. The encrypted call method according to claim 4, characterized in that: The calling call information further includes an integrated circuit card identification code ICCID of the calling terminal and a first account identifier, where the first account identifier is an account identifier corresponding to the calling terminal. Before sending the key negotiation request to the cryptographic server, the method further includes: Based on the authentication key and the ICCID, generate a first hash value; Sending a password service authentication request to the password server, the password service authentication request including the first hash value and the first account identifier, the password service authentication request being used to request password service authentication for the calling terminal; A password service success response is received from the password server, where the password service success response is used to notify the calling terminal that the password service authentication is successful.

6. The method according to claim 4, characterized in that The method further comprises: receiving a key deletion instruction sent by the cryptographic server, wherein the key deletion instruction includes at least one call identifier; Delete the service key corresponding to each of the at least one call identifiers.

7. The method according to any one of claims 4 to 6, characterized in that: The encrypting the call based on the target service key comprises: Acquire a first media packet corresponding to the encrypted call, wherein the first media packet includes a packet header portion and a first packet body portion; Encrypting the first package body part based on the target service key to obtain a second package body part; generating a second media packet based on the packet header portion and the second packet body portion; The second media packet is sent to a network element device in a call network, so that the network element device sends the second media packet to the called terminal.

8. An encrypted communication device, characterized in that: Applied to a cryptographic server, the device comprises a receiving module, a processing module and a sending module; The receiving module is used to receive a key negotiation request sent by a calling terminal, wherein the key negotiation request includes first encryption information; The processing module is used to decrypt the first encrypted information based on the caller protection key corresponding to the calling terminal to obtain calling call information, wherein the calling call information includes a target call identifier, and the target call identifier is a call identifier for the encrypted call between the calling terminal and the called terminal; The processing module is further used to encrypt the target service key corresponding to the target call identifier based on the caller protection key to obtain second encrypted information; The sending module is used to send the second encrypted information to the calling terminal, so that the calling terminal performs an encrypted call based on the target service key.

9. An encrypted communication device, characterized in that: Applied to a calling terminal, the device comprises: an acquisition module, a processing module, a sending module and a receiving module; The acquisition module is used to acquire the call information of the calling party, wherein the call information of the calling party includes a target call identifier, and the target call identifier is a call identifier of the encrypted call between the calling terminal and the called terminal; The processing module is used to encrypt the calling call information based on the calling protection key corresponding to the calling terminal to obtain first encrypted information; The sending module is used to send a key negotiation request to a cryptographic server, where the key negotiation request includes the first encryption information, and the key negotiation request is used to request the cryptographic server to allocate a service key to the calling terminal and the called terminal; The receiving module is used to receive the second encrypted information sent by the password server; The processing module is further used to decrypt the second encrypted information based on the caller protection key to obtain a target service key corresponding to the target call identifier; The processing module is further used to perform an encrypted call based on the target service key.

10. An electronic device, characterized in that: The electronic device comprises: processor; a memory configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the encrypted call method as described in any one of claims 1-3, or to implement the encrypted call method as described in any one of claims 4-7.

11. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions in the computer-readable storage medium are executed by an electronic device, the electronic device is enabled to execute the encrypted call method as described in any one of claims 1-3, or execute the encrypted call method as described in any one of claims 4-7.

12. A computer program product comprising instructions, characterized in that When the instruction is executed on an electronic device, the electronic device executes the encrypted call method as described in any one of claims 1 to 3, or executes the encrypted call method as described in any one of claims 4 to 7.

Images