Signaling service system and communication method based on signaling service system

Abstract

The embodiment of the invention provides a signaling service system and a communication method based on the signaling service system, and the method is applied to a first client, sends a bidirectional authentication request for a second client to a key management platform, receives a session key handle sent by the key management platform after the bidirectional authentication is passed, and sends the session key handle to the first client. Performing key negotiation with a second client through the key management platform, and receiving a negotiation key handle and first public key information sent by the key management platform; and sending a second key negotiation request to a second client, the second key negotiation request comprising a session key handle, a negotiation key length and first public key information, receiving a session key sent by the key management platform, and communicating with the second client according to the session key. Through an authentication mechanism based on a quantum encryption technology, bidirectional identity authentication and quantum key negotiation are carried out, the security of a signaling channel can be ensured, and the risks of information leakage and malicious attack are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of quantum secure communication, and in particular to a signaling service system and a communication method based on the signaling service system. Background Art

[0002] The communication dispatch signaling service system is a system used to manage and coordinate various signaling and control information in the communication network. It realizes information interaction and control between devices through standardized protocols and interfaces, and is mainly used to ensure that devices and users in the communication network can communicate efficiently and reliably. However, with the increase in network complexity and the number of devices, the signaling system faces security challenges. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a signaling service system and a communication method based on the signaling service system that overcome the above problems or at least partially solve the above problems.

[0004] In order to solve the above problem, an embodiment of the present invention discloses a communication method based on a signaling service system, which is applied to a first client. The method includes:

[0005] Sending a two-way authentication request for the second client to the key management platform, and receiving a session key handle sent by the key management platform after the two-way authentication is passed;

[0006] Sending a first key negotiation request to the key management platform, and receiving a negotiated key handle and first public key information sent by the key management platform;

[0007] Sending a second key negotiation request to the second client, where the second key negotiation request includes the session key handle, the negotiated key length, and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiated key length, and the first public key information;

[0008] Receiving second public key information sent by the second client; the second public key information is sent by the key management platform to the second client;

[0009] Sending a fourth key negotiation request to the key management platform, where the fourth key negotiation request includes the negotiated key handle;

[0010] Receive the session key sent by the key management platform, and communicate with the second client according to the session key.

[0011] Optionally, initiating a two-way authentication process for the second client to the key management platform, and receiving a session key handle sent by the key management platform after the two-way authentication process passes, includes:

[0012] Acquire first verification information from the key management platform;

[0013] Sending the first verification information to the second client, so that the second client verifies the first verification information through the key management platform;

[0014] receiving second verification information sent by the second client, where the second verification information is sent to the second client after the key management platform verifies that the first verification information has passed;

[0015] The second verification information is verified by the key management platform, and a session key handle is received after the key management platform verifies that the second verification information is successful.

[0016] Optionally, the method further includes:

[0017] Sending a registration session request to the identity authentication platform, wherein the registration session request includes third verification information;

[0018] Receiving an authorization code sent by the identity authentication platform after verifying that the third verification information has passed verification;

[0019] A connection establishment request is sent to the second client, wherein the connection establishment request includes the authorization code, so that the second client verifies the authorization code through the identity authentication platform, and after verifying the authorization code, receives an access code sent by the identity authentication platform.

[0020] Optionally, the communicating with the second client according to the session key includes:

[0021] The communication path information sent by the identity authentication platform is received, and a communication path is configured according to the communication path information, so as to communicate with the second client through the communication path according to the session key.

[0022] Optionally, the method further includes:

[0023] Receiving a session state synchronization request sent by the identity authentication platform; the session state synchronization request includes session state information;

[0024] The session state is synchronized with the second client according to the session state information.

[0025] Accordingly, an embodiment of the present invention discloses a communication method based on a signaling service system, which is applied to a key management platform. The method includes:

[0026] Receiving a two-way authentication request for a second client sent by a first client, and sending a session key handle to the first client after the two-way authentication passes;

[0027] receiving a first key negotiation request sent by the first client, and sending a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key length and the first public key information;

[0028] Receiving a third key negotiation request sent by a second client, the third key negotiation request including the session key handle, the negotiated key length and the first public key information; generating a session key and sending the second public key information to the second client;

[0029] A fourth key negotiation request sent by the first client is received, wherein the fourth key negotiation request includes the negotiation key handle; and a session key is sent to the first client, so that the first client communicates with the second client according to the session key.

[0030] Optionally, receiving a two-way authentication request for a second client sent by a first client, and sending a session key handle to the first client after the two-way authentication passes, includes:

[0031] receiving a first verification information acquisition request sent by the first client, and sending first verification information to the first client;

[0032] receiving a first verification information verification request sent by the second client, and after the first verification information is verified, sending second verification information to the second client;

[0033] A second verification information verification request sent by the first client is received, and after the second verification information is verified successfully, a session key handle is sent to the first client.

[0034] Accordingly, an embodiment of the present invention discloses a signaling service system, the system comprising a first client, a second client and a key management platform;

[0035] The first client is used to send a two-way authentication request for the second client to the key management platform and receive a session key handle sent by the key management platform after the two-way authentication is passed; send a first key negotiation request to the key management platform, receive the negotiated key handle and first public key information sent by the key management platform; send a second key negotiation request to the second client, the second key negotiation request includes the session key handle, the negotiated key length and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiated key length and the first public key information; receive the second public key information sent by the second client; the second public key information is sent by the key management platform to the second client; send a fourth key negotiation request to the key management platform, the fourth key negotiation request includes the negotiated key handle; receive the session key sent by the key management platform, and communicate with the second client according to the session key;

[0036] The second client is configured to receive a second key negotiation request sent by the first client; send a third key negotiation request to the key management platform, wherein the third key negotiation request includes the session key handle, the negotiated key length, and the first public key information; receive the second public key information sent by the key management platform; and send the second public key information to the first client;

[0037] The key management platform is used to receive a two-way authentication request sent by a first client for a second client, and send a session key handle to the first client after the two-way authentication is passed; receive a first key negotiation request sent by the first client, send a negotiation key handle and a first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key length and the first public key information; receive a third key negotiation request sent by the second client, the third key negotiation request includes the session key handle, the negotiation key length and the first public key information; generate a session key and send the second public key information to the second client; receive a fourth key negotiation request sent by the first client, the fourth key negotiation request includes the negotiation key handle; send a session key to the first client, so that the first client communicates with the second client according to the session key.

[0038] Optionally, the first client is used to obtain first verification information from the key management platform; send the first verification information to the second client, so that the second client verifies the first verification information through the key management platform; receive second verification information sent by the second client, the second verification information is sent to the second client after the key management platform verifies that the first verification information is passed; verify the second verification information through the key management platform, and receive a session key handle sent by the key management platform after the second verification information is verified to be passed;

[0039] The second client is configured to receive the first verification information sent by the first client; verify the first verification information through the key management platform, and receive second verification information sent by the key management platform after the first verification information is verified; and send the second verification information to the first client;

[0040] The key management platform is used to receive a first verification information acquisition request sent by the first client, and send the first verification information to the first client; receive a first verification information verification request sent by the second client, and after the first verification information is verified, send the second verification information to the second client; receive a second verification information verification request sent by the first client, and after the second verification information is verified, send a session key handle to the first client.

[0041] Optionally, the system further includes an identity authentication platform, and the first client is used to send a registration session request to the identity authentication platform, the registration session request including third verification information; receive an authorization code sent by the identity authentication platform after verifying that the third verification information is verified; send a connection establishment request to the second client, the connection establishment request including the authorization code, so that the second client verifies the authorization code through the identity authentication platform, and receives an access code sent by the identity authentication platform after verifying that the authorization code is passed; receive communication path information sent by the identity authentication platform, and configure a communication path according to the communication path information, so as to communicate with the second client through the communication path according to the session key;

[0042] The second client is configured to receive a connection establishment request sent by the first client; verify the authorization code through the identity authentication platform; and receive an access code sent by the identity authentication platform after the authorization code is verified;

[0043] The identity authentication platform is used to receive a registration session request sent by the first client, the registration session request includes third verification information; after the third verification information is verified, send an authorization code to the first client; receive an authorization code verification request sent by the second client, the authorization code verification request includes the authorization code; after the authorization code is verified, send an access code to the second client; send communication path information to the first client and the second client, so that the first client configures a communication path according to the communication path information, so as to communicate with the second client through the communication path according to the session key.

[0044] Optionally, the first client is used to receive a session state synchronization request sent by the identity authentication platform; the session state synchronization request includes session state information; and synchronize the session state with the second client according to the session state information;

[0045] The second client is used to receive a session state synchronization request sent by the identity authentication platform; the session state synchronization request includes session state information; and synchronize the session state with the first client according to the session state information;

[0046] The identity authentication platform is used to send a session state synchronization request to the first client and the second client, wherein the session state synchronization request includes session state information, so that the first client and the second client synchronize session states according to the session state information.

[0047] Accordingly, an embodiment of the present invention discloses a communication device based on a signaling service system, which is applied to a first client, and the device includes:

[0048] A two-way authentication request sending module, used to send a two-way authentication request for a second client to the key management platform, and receive a session key handle sent by the key management platform after the two-way authentication is passed;

[0049] A first key negotiation request sending module, used to send a first key negotiation request to the key management platform, and receive a negotiated key handle and first public key information sent by the key management platform;

[0050] a second key negotiation request sending module, configured to send a second key negotiation request to the second client, wherein the second key negotiation request includes the session key handle, the negotiated key length, and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiated key length, and the first public key information;

[0051] A second public key information receiving module, used to receive the second public key information sent by the second client; the second public key information is sent by the key management platform to the second client;

[0052] A fourth key negotiation request sending module, configured to send a fourth key negotiation request to the key management platform, wherein the fourth key negotiation request includes the negotiated key handle;

[0053] The session key receiving module is used to receive the session key sent by the key management platform and communicate with the second client according to the session key.

[0054] Optionally, the two-way authentication request sending module includes:

[0055] A first verification information acquisition submodule, used to obtain first verification information from the key management platform;

[0056] A first verification information sending submodule, used for sending the first verification information to the second client, so that the second client verifies the first verification information through the key management platform;

[0057] A second verification information acquisition submodule is used to receive second verification information sent by the second client, where the second verification information is sent to the second client after the key management platform verifies that the first verification information has passed;

[0058] The session key handle acquisition submodule is used to verify the second verification information through the key management platform, and receive the session key handle sent by the key management platform after the second verification information is verified successfully.

[0059] Optionally, the device further comprises:

[0060] A registration session request sending module, used to send a registration session request to the identity authentication platform, wherein the registration session request includes third verification information;

[0061] An authorization code receiving module, used to receive the authorization code sent by the identity authentication platform after verifying that the third verification information has passed the verification;

[0062] A connection request sending module is used to send a connection request to the second client, wherein the connection request includes the authorization code, so that the second client verifies the authorization code through the identity authentication platform and receives the access code sent by the key management platform after verifying the authorization code.

[0063] Optionally, the session key receiving module includes:

[0064] The communication submodule is used to receive the communication path information sent by the identity authentication platform and configure the communication path according to the communication path information so as to communicate with the second client through the communication path according to the session key.

[0065] Optionally, the device further comprises:

[0066] A session state synchronization request receiving module, used to receive a session state synchronization request sent by the identity authentication platform; the session state synchronization request includes session state information;

[0067] A session state synchronization module is used to synchronize the session state with the second client according to the session state information.

[0068] Accordingly, an embodiment of the present invention discloses a communication device based on a signaling service system, which is applied to a key management platform. The device includes:

[0069] A two-way authentication request receiving module, configured to receive a two-way authentication request sent by a first client to a second client, and to send a session key handle to the first client after the two-way authentication passes;

[0070] a first key negotiation request receiving module, configured to receive a first key negotiation request sent by the first client, and send a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key length and the first public key information;

[0071] A third key negotiation request receiving module, configured to receive a third key negotiation request sent by a second client, wherein the third key negotiation request includes the session key handle, the negotiation key length, and the first public key information; generate a session key and send the second public key information to the second client;

[0072] The fourth key negotiation request receiving module is used to receive a fourth key negotiation request sent by the first client, wherein the fourth key negotiation request includes the negotiation key handle; and send a session key to the first client so that the first client communicates with the second client according to the session key.

[0073] Optionally, the two-way authentication request receiving module includes:

[0074] A first verification information sending submodule, configured to receive a first verification information acquisition request sent by the first client, and send first verification information to the first client;

[0075] A second verification information sending submodule, configured to receive a first verification information verification request sent by the second client, and after the first verification information is verified, send second verification information to the second client;

[0076] The session key handle sending submodule is used to receive a second verification information verification request sent by the first client, and after the second verification information is verified, send a session key handle to the first client.

[0077] Correspondingly, an embodiment of the present invention discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the various steps of the above-mentioned communication method embodiment based on the signaling service system when executed by the processor.

[0078] Accordingly, an embodiment of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each step of the above-mentioned communication method embodiment based on the signaling service system is implemented.

[0079] The embodiments of the present invention include the following advantages:

[0080] The communication method based on the signaling service system of the embodiment of the present invention is applied to the first client, sending a two-way authentication request for the second client to the key management platform, and receiving the session key handle sent by the key management platform after the two-way authentication is passed; sending a first key negotiation request to the key management platform, receiving the negotiation key handle and the first public key information sent by the key management platform; sending a second key negotiation request to the second client, the second key negotiation request includes the session key handle, the negotiation key length and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiation key length and the first public key information; receiving the second public key information sent by the second client; the second public key information is sent by the key management platform to the second client; sending a fourth key negotiation request to the key management platform, the fourth key negotiation request includes the negotiation key handle; receiving the session key sent by the key management platform, and communicating with the second client according to the session key. Through the authentication and verification mechanism based on quantum encryption technology, two-way identity authentication and quantum key negotiation are performed, which can ensure the security of the signaling channel and reduce the risk of information leakage and malicious attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 is a flow chart of steps of a communication method based on a signaling service system according to an embodiment of the present invention;

[0082] Figure 2 It is a flow chart of another communication method based on a signaling service system according to an embodiment of the present invention;

[0083] Figure 3 It is a flow chart of another communication method based on a signaling service system according to an embodiment of the present invention;

[0084] Figure 4 It is a flow chart of another communication method based on a signaling service system according to an embodiment of the present invention;

[0085] Figure 5 is a flow chart of steps of another communication method based on a signaling service system according to an embodiment of the present invention;

[0086] Figure 6 is a structural block diagram of a communication device based on a signaling service system according to an embodiment of the present invention;

[0087] Figure 7 It is a structural block diagram of another communication device based on a signaling service system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0088] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0089] The communication dispatch signaling service system is a system used to manage and coordinate various signaling and control information in the communication network. It realizes information interaction and control between devices through standardized protocols and interfaces, and is mainly used to ensure that devices and users in the communication network can communicate efficiently and reliably. However, with the increase in network complexity and the number of devices, the signaling system faces security challenges.

[0090] One of the core concepts of the embodiments of the present invention is that based on security authentication, security authentication includes two-way identity authentication and key negotiation. Through an authentication mechanism based on quantum encryption technology, two-way identity authentication and quantum key negotiation are performed, which can ensure the security of the signaling channel and reduce the risk of information leakage and malicious attacks.

[0091] Reference Figure 1 , shows a flow chart of the steps of a communication method based on a signaling service system according to an embodiment of the present invention, which is applied to a first client and may specifically include the following steps:

[0092] Step 101: Send a two-way authentication request for a second client to a key management platform, and receive a session key handle sent by the key management platform after the two-way authentication is passed.

[0093] Specifically, Figure 2 A flow chart of another communication method based on a signaling service system in an embodiment of the present invention is shown, wherein a first client sends a two-way authentication request for a second client to a key management platform, and after the two-way authentication is passed, the key management platform receives a session key handle sent by the key management platform. The key management platform may be a key management service (KMS) platform, and the two-way authentication request may be a two-way identity authentication request, which is used for two-way identity authentication between the first client and the second client. The first client and the second client mutually verify each other's identity when establishing a connection, ensuring that only legal entities can communicate. Two-way identity authentication has multiple advantages and can enhance security. Two-way identity authentication ensures the identity of both parties in communication and prevents man-in-the-middle attacks. The first client and the second client mutually verify their identities to prevent counterfeit attacks. Two-way identity authentication establishes a trust relationship between the two parties in communication, ensuring that only legal entities can communicate, and meeting the requirements of various data protection regulations and standards. It is flexible and can be applied to a variety of protocols and scenarios, supporting a variety of identity authentication methods, such as certificates, tokens, biometrics, etc.

[0094] Step 102: Send a first key negotiation request to the key management platform, and receive a negotiated key handle and first public key information sent by the key management platform.

[0095] Specifically, after the two-way identity authentication is completed, the key negotiation process begins. The first client carries the negotiated key length and the initiator's identifier, that is, the identifier of the first client, and sends a first key negotiation request to the key management platform. The key management platform receives the negotiated key handle and the first public key information returned by the key management platform, and caches the negotiated key handle. The first public key information is the public key information of the first client, and the identifier of the first client can be the ID of the first client. The embodiment of the present invention does not limit this.

[0096] The key negotiation process is a key step in cryptography, which involves two or more entities securely generating or exchanging encryption keys over an insecure communication channel. This process ensures that even if the communication is eavesdropped, the attacker cannot easily obtain the key information. In the key negotiation of the embodiment of the present invention, when the communicating parties establish a connection, a symmetric key is generated through the quantum key distribution protocol for encryption and decryption of subsequent signaling messages.

[0097] Step 103: Send a second key negotiation request to the second client, where the second key negotiation request includes the session key handle, the negotiated key length and the first public key information, so that the second client sends a third key negotiation request to the key management platform based on the session key handle, the negotiated key length and the first public key information.

[0098] Specifically, after receiving the negotiated key handle and the first public key information returned by the key management platform, the first client carries the first client's identifier, the session key handle, the negotiated key length and the first public key information, and sends a second key negotiation request to the second client. After receiving the second key negotiation request sent by the first client, the second client carries the first client's identifier, the second client's identifier, the session key handle, the negotiated key length and the first public key information, and sends a third key negotiation request to the key management platform.

[0099] Step 104, receiving second public key information sent by the second client; the second public key information is sent by the key management platform to the second client.

[0100] Specifically, after the second client sends a third key negotiation request to the key management platform, the key management platform generates a session key and returns the second public key information and the negotiated key handle to the second client, wherein the second public key information is the public key information of the second client. After receiving the second public key information and the negotiated key handle returned by the key management platform, the second client returns the second public key information and the identifier of the second client to the first client, and the first client receives the second public key information and the identifier of the second client sent by the second client.

[0101] Step 105: Send a fourth key negotiation request to the key management platform, where the fourth key negotiation request includes the negotiated key handle.

[0102] Specifically, after receiving the second public key information and the identifier of the second client sent by the second client, a fourth key negotiation request is sent to the key management platform carrying the negotiated key handle.

[0103] Step 106: Receive the session key sent by the key management platform, and communicate with the second client according to the session key.

[0104] Specifically, after sending the fourth key negotiation request to the key management platform, the session key returned by the key management platform is received. At this point, the initiator first client and the recipient second client have established a secure channel link, and the first client can communicate with the second client based on the session key.

[0105] The communication method based on the signaling service system of the embodiment of the present invention is applied to the first client, sending a two-way authentication request for the second client to the key management platform, and receiving the session key handle sent by the key management platform after the two-way authentication is passed; sending a first key negotiation request to the key management platform, receiving the negotiation key handle and the first public key information sent by the key management platform; sending a second key negotiation request to the second client, the second key negotiation request includes the session key handle, the negotiation key length and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiation key length and the first public key information; receiving the second public key information sent by the second client; the second public key information is sent by the key management platform to the second client; sending a fourth key negotiation request to the key management platform, the fourth key negotiation request includes the negotiation key handle; receiving the session key sent by the key management platform, and communicating with the second client according to the session key. Through the authentication and verification mechanism based on quantum encryption technology, two-way identity authentication and quantum key negotiation are performed, which can ensure the security of the signaling channel and reduce the risk of information leakage and malicious attacks.

[0106] In the embodiment of the present invention, step 101 includes the following sub-steps:

[0107] Sub-step S11, obtaining first verification information from the key management platform.

[0108] Specifically, Figure 3 A flow chart of another communication method based on a signaling service system according to an embodiment of the present invention is shown. When a first client attempts to establish a connection with a second client, the first client initiates a request to a key management platform to obtain first verification information, the first verification information includes a random number RA and a signature of the random number RA, and receives the random number RA and the signature of the random number RA returned by the key management platform.

[0109] Sub-step S12: sending the first verification information to the second client, so that the second client verifies the first verification information through the key management platform.

[0110] Specifically, after obtaining the random number RA and the signature of the random number RA, the first client carries the random number RA, the signature of the random number RA and the SM2 certificate of the first client, and initiates a verification request to the second client. After the second client receives the random number RA, the signature of the random number RA and the SM2 certificate of the first client, it sends the random number RA, the signature of the random number RA and the SM2 certificate of the first client to the key management platform. After receiving the random number RA, the signature of the random number RA and the SM2 certificate of the first client, the key management platform verifies the signature of the random number RA according to the SM2 certificate of the first client.

[0111] SM2 certificate is a digital certificate based on SM2 elliptic curve public key cryptography algorithm (SM2 for short) issued by China National Cryptography Administration. SM2 algorithm is an asymmetric encryption algorithm, similar to RSA and ECC (elliptic curve cryptography), but with higher security and efficiency. SM2 certificate is usually used in scenarios such as identity authentication, digital signature and data encryption.

[0112] Sub-step S13, receiving second verification information sent by the second client, where the second verification information is sent to the second client after the key management platform verifies that the first verification information is passed.

[0113] Specifically, the second client verifies the signature of the random number RA through the key management platform. After the verification is passed, the second client initiates a request to the key management platform to obtain second verification information, and the second verification information includes the signature of the random number RB and the combination of the random number RB and the random number RB. The second client receives the signature of the random number RB and the combination of the random number RB and the random number RB returned by the key management platform, and sends the random number RB, the signature of the combination of the random number RB and the random number RB, and the SM2 certificate of the second client to the first client.

[0114] Sub-step S14: verifying the second verification information through the key management platform, and receiving a session key handle sent by the key management platform after verifying that the second verification information is successful.

[0115] Specifically, after receiving the random number RB, the signature of the combination of random number RB and random number RB, and the SM2 certificate of the second client sent by the second client, the first client carries the random number RB, the signature of the combination of random number RB and random number RB, and the SM2 certificate of the second client, and sends a verification request to the key management platform. The key management platform verifies the signature of the combination of random number RB and random number RB based on the SM2 certificate of the second client. After the verification is passed, the session key handle is returned to the first client. At this point, the two-way identity authentication process ends.

[0116] In an embodiment of the present invention, the method further includes:

[0117] Step 201: Send a registration session request to an identity authentication platform, wherein the registration session request includes third verification information.

[0118] Specifically, Figure 4 A flow chart of another communication method based on a signaling service system in an embodiment of the present invention is shown. In a cross-domain session scenario, the first client may be located in system A, and the second client may be located in system B. The two systems are connected via a network but may belong to different domains or network environments. Cross-domain refers to the interaction between different systems or network environments. These systems may be different physical servers, cloud service instances, virtual machines or physical machines, etc., which are connected via a network but are managed and maintained independently of each other. In a cross-domain session scenario, the key management platform of the first client is the key management platform of the domain where the first client is located, and the key management platform of the second client is the key management platform of the domain where the second client is located.

[0119] The first client sends a registration session request to the identity authentication platform with the third verification information, the third verification information is a token, and the token includes the second client's ID, IP address, port number and other information. The identity authentication platform can be an Identity and Access Management (IAM) platform, which has functions such as single sign-on, powerful authentication management, policy-based centralized authorization and auditing, dynamic authorization, and enterprise manageability.

[0120] Step 202: receiving an authorization code sent by the identity authentication platform after verifying that the third verification information has passed verification.

[0121] Specifically, the identity authentication platform verifies the token, generates a short-term valid code authorization code after the verification is passed, and returns the short-term valid code authorization code to the first client.

[0122] Step 203: Send a connection establishment request to the second client, wherein the connection establishment request includes the authorization code, so that the second client verifies the authorization code through the identity authentication platform, and after verifying the authorization code, receives the access code sent by the identity authentication platform.

[0123] Specifically, after receiving the authorization code, the first client carries the authorization code and initiates a connection request to the second client. The second client verifies the authorization code through the identity authentication platform and receives the access code sent by the identity authentication platform after the verification is successful. At this point, the session between the first client and the second client is successfully established.

[0124] In the embodiment of the present invention, the communicating with the second client according to the session key includes:

[0125] The communication path information sent by the identity authentication platform is received, and a communication path is configured according to the communication path information, so as to communicate with the second client through the communication path according to the session key.

[0126] Specifically, after the first client registers a session on the identity authentication platform, the identity authentication platform can identify and manage this cross-domain session. When the first client attempts to establish a connection with the second client, the identity authentication platform can determine a suitable communication path based on the registered session information, combined with the network topology and security policy. This path will involve firewall rules, NAT configuration, and VPN tunnels to ensure that data can safely traverse different networks and systems, and send the determined communication path information to the first client and the second client. The first client and the second client can configure the network settings based on the communication path information, thereby establishing a connection and starting communication.

[0127] In an embodiment of the present invention, the method further includes:

[0128] Receiving a session state synchronization request sent by the identity authentication platform; the session state synchronization request includes session state information;

[0129] The session state is synchronized with the second client according to the session state information.

[0130] Specifically, in order to ensure the consistency of session states between multiple systems, the identity authentication platform can periodically synchronize the session state information of the first client and the second client, and the session state information includes session ID, connection state, authentication information, and session timeout. Periodic synchronization rather than instant synchronization is for performance considerations to reduce network traffic and computing resource consumption.

[0131] The embodiment of the present invention adopts the quantum key distribution protocol to generate symmetric keys, and combines the digital signature technology to encrypt and verify the signaling messages. The authentication mechanism based on quantum encryption has higher security. Quantum encryption technology uses the principles of quantum mechanics to provide theoretically unconditional security, which cannot be cracked even in the face of quantum computers. In addition, digital signature technology ensures the integrity and authenticity of the message, and effectively prevents the message from being tampered with or forged. Therefore, the present invention greatly improves the security of the communication system and reduces the risk of information leakage and malicious attacks.

[0132] Through mechanisms such as session registration, session routing, and session synchronization, signaling and session intercommunication between different systems or networks is achieved. The cross-domain session management mechanism enhances the cross-domain intercommunication and interoperability of the system. It solves the compatibility issues between different systems or networks, allowing multiple independently deployed systems to connect and work together seamlessly. This not only improves the flexibility and scalability of the system, but also reduces the cost of system integration and maintenance.

[0133] AI technology can also be used to analyze historical data and real-time traffic, predict future communication needs, and dynamically adjust resource allocation and scheduling strategies accordingly. For example, when the system detects that a large number of users are trying to establish requests within a certain period of time, the AI ​​algorithm can predict the upcoming traffic peak and increase the system's bandwidth and server resources in advance. In addition, the AI ​​algorithm can also identify abnormal traffic and attack behaviors, such as DDoS attacks, and take corresponding security measures in a timely manner, such as limiting the flow and banning IP. AI optimized communication scheduling improves the scheduling efficiency and response speed of the system. The AI ​​algorithm can accurately predict communication needs and dynamically adjust resource allocation according to needs, thereby achieving rapid response and efficient processing of communication requests. This not only improves the operating efficiency of the system, but also reduces resource waste and cost expenditure. At the same time, the AI ​​algorithm can also automatically identify abnormal traffic and attack behaviors, and take corresponding security measures, further enhancing the security of the system.

[0134] Reference Figure 5 , shows a flow chart of another communication method based on a signaling service system according to an embodiment of the present invention, which is applied to a key management platform and may specifically include the following steps:

[0135] Step 301: receiving a two-way authentication request for a second client sent by a first client, and sending a session key handle to the first client after the two-way authentication passes.

[0136] Step 302: receive a first key negotiation request sent by the first client, and send a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key handle length and the first public key information.

[0137] Step 303: Receive a third key negotiation request sent by the second client, wherein the third key negotiation request includes the session key handle, the negotiation key handle length and the first public key information; generate a session key and send the second public key information to the second client.

[0138] Step 304: Receive a fourth key negotiation request sent by the first client, wherein the fourth key negotiation request includes the negotiation key handle; and send a session key to the first client, so that the first client communicates with the second client according to the session key.

[0139] In the embodiment of the present invention, step 301 may specifically include the following sub-steps:

[0140] Sub-step S21: receiving a first verification information acquisition request sent by the first client, and sending first verification information to the first client.

[0141] Sub-step S22, receiving a first verification information verification request sent by the second client, and after the first verification information is verified, sending second verification information to the second client.

[0142] Sub-step S23, receiving a second verification information verification request sent by the first client, and after the second verification information is verified, sending a session key handle to the first client.

[0143] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0144] In an embodiment of the present invention, the system includes a first client, a second client and a key management platform;

[0145] The first client is used to send a two-way authentication request for the second client to the key management platform and receive a session key handle sent by the key management platform after the two-way authentication is passed; send a first key negotiation request to the key management platform, receive the negotiation key handle and the first public key information sent by the key management platform; send a second key negotiation request to the second client, the second key negotiation request includes the session key handle, the negotiation key handle length and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiation key handle length and the first public key information; receive the second public key information sent by the second client; the second public key information is sent by the key management platform to the second client; send a fourth key negotiation request to the key management platform, the fourth key negotiation request includes the negotiation key handle; receive the session key sent by the key management platform, and communicate with the second client according to the session key;

[0146] The second client is configured to receive a second key negotiation request sent by the first client; send a third key negotiation request to the key management platform, wherein the third key negotiation request includes the session key handle, the negotiation key handle length and the first public key information; receive the second public key information sent by the key management platform; and send the second public key information to the first client;

[0147] The key management platform is used to receive a two-way authentication request sent by a first client for a second client, and send a session key handle to the first client after the two-way authentication is passed; receive a first key negotiation request sent by the first client, send a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key handle length and the first public key information; receive a third key negotiation request sent by the second client, the third key negotiation request includes the session key handle, the negotiation key handle length and the first public key information; generate a session key and send the second public key information to the second client; receive a fourth key negotiation request sent by the first client, the fourth key negotiation request includes the negotiation key handle; send a session key to the first client, so that the first client communicates with the second client according to the session key.

[0148] In an embodiment of the present invention, the first client is used to obtain first verification information from the key management platform; send the first verification information to the second client, so that the second client verifies the first verification information through the key management platform; receive second verification information sent by the second client, the second verification information is sent to the second client after the key management platform verifies that the first verification information is passed; verify the second verification information through the key management platform, and receive the session key handle sent by the key management platform after the second verification information is verified.

[0149] The second client is configured to receive the first verification information sent by the first client; verify the first verification information through the key management platform, and receive second verification information sent by the key management platform after the first verification information is verified; and send the second verification information to the first client;

[0150] The key management platform is used to receive a first verification information acquisition request sent by the first client, and send the first verification information to the first client; receive a first verification information verification request sent by the second client, and after the first verification information is verified, send the second verification information to the second client; receive a second verification information verification request sent by the first client, and after the second verification information is verified, send a session key handle to the first client.

[0151] In an embodiment of the present invention, the system further includes an identity authentication platform, and the first client is used to send a registration session request to the identity authentication key management platform, the registration session request includes third verification information; receive an authorization code sent by the identity authentication key management platform after verifying that the third verification information is verified; send a connection establishment request to the second client, the connection establishment request includes the authorization code, so that the second client verifies the authorization code through the identity authentication key management platform, and receives an access code sent by the identity authentication key management platform after verifying that the authorization code is passed; receive communication path information sent by the identity authentication key management platform, and configure a communication path according to the communication path information, so as to communicate with the second client through the communication path according to the session key;

[0152] The second client is used to receive the connection establishment request sent by the first client; verify the authorization code through the identity authentication key management platform; and receive the access code sent by the identity authentication key management platform after the authorization code is verified;

[0153] The identity authentication key management platform is used to receive a registration session request sent by the first client, the registration session request includes third verification information; after the third verification information passes verification, send an authorization code to the first client; receive an authorization code verification request sent by the second client, the authorization code verification request includes the authorization code; after the authorization code passes verification, send an access code to the second client; send communication path information to the first client and the second client, so that the first client configures a communication path according to the communication path information, so as to communicate with the second client through the communication path according to the session key.

[0154] In an embodiment of the present invention, the first client is used to receive a session state synchronization request sent by the identity authentication key management platform; the session state synchronization request includes session state information; and synchronize the session state with the second client according to the session state information;

[0155] The second client is used to receive a session state synchronization request sent by the identity authentication key management platform; the session state synchronization request includes session state information; and synchronize the session state with the first client according to the session state information;

[0156] The identity authentication key management platform is used to send a session state synchronization request to the first client and the second client, wherein the session state synchronization request includes session state information, so that the first client and the second client synchronize the session state according to the session state information.

[0157] Reference Figure 6 , shows a structural block diagram of a communication device based on a signaling service system according to an embodiment of the present invention, which is applied to a first client and may specifically include the following modules:

[0158] A two-way authentication request sending module 401 is used to send a two-way authentication request for a second client to a key management platform, and receive a session key handle sent by the key management platform after the two-way authentication is passed;

[0159] A first key negotiation request sending module 402, configured to send a first key negotiation request to the key management platform, and receive a negotiated key handle and first public key information sent by the key management platform;

[0160] A second key negotiation request sending module 403 is used to send a second key negotiation request to the second client, where the second key negotiation request includes the session key handle, the negotiated key length handle and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiated key length handle and the first public key information;

[0161] The second public key information receiving module 404 is used to receive the second public key information sent by the second client; the second public key information is sent by the key management platform to the second client;

[0162] A fourth key negotiation request sending module 405, configured to send a fourth key negotiation request to the key management platform, wherein the fourth key negotiation request includes the negotiated key handle;

[0163] The session key receiving module 406 is used to receive the session key sent by the key management platform and communicate with the second client according to the session key.

[0164] In an embodiment of the present invention, the two-way authentication request sending module includes:

[0165] A first verification information acquisition submodule, used to obtain first verification information from the key management platform;

[0166] A first verification information sending submodule, used for sending the first verification information to the second client, so that the second client verifies the first verification information through the key management platform;

[0167] A second verification information acquisition submodule is used to receive second verification information sent by the second client, where the second verification information is sent to the second client after the key management platform verifies that the first verification information has passed;

[0168] The session key handle acquisition submodule is used to verify the second verification information through the key management platform, and receive the session key handle sent by the key management platform after the second verification information is verified successfully.

[0169] In an embodiment of the present invention, the device further includes:

[0170] A registration session request sending module, used to send a registration session request to the identity authentication key management platform, wherein the registration session request includes third verification information;

[0171] An authorization code receiving module, used to receive the authorization code sent by the identity authentication key management platform after verifying that the third verification information has passed the verification;

[0172] A connection request sending module is used to send a connection request to the second client, wherein the connection request includes the authorization code, so that the second client verifies the authorization code through the identity authentication key management platform, and after verifying the authorization code, receives the access code sent by the key management platform.

[0173] In an embodiment of the present invention, the session key receiving module includes:

[0174] The communication submodule is used to receive the communication path information sent by the identity authentication key management platform, and configure the communication path according to the communication path information, so as to communicate with the second client through the communication path according to the session key.

[0175] In an embodiment of the present invention, the device further includes:

[0176] A session state synchronization request receiving module, used to receive a session state synchronization request sent by the identity authentication key management platform; the session state synchronization request includes session state information;

[0177] A session state synchronization module is used to synchronize the session state with the second client according to the session state information.

[0178] Reference Figure 7 , shows a structural block diagram of another communication device based on a signaling service system according to an embodiment of the present invention, which is applied to a key management platform and may specifically include the following modules:

[0179] A two-way authentication request receiving module 501 is used to receive a two-way authentication request sent by a first client to a second client, and send a session key handle to the first client after the two-way authentication passes;

[0180] A first key negotiation request receiving module 502 is configured to receive a first key negotiation request sent by the first client, and send a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key length and the first public key information;

[0181] The third key negotiation request receiving module 503 is configured to receive a third key negotiation request sent by a second client, wherein the third key negotiation request includes the session key handle, the negotiation key length and the first public key information; generate a session key and send the second public key information to the second client;

[0182] The fourth key negotiation request receiving module 504 is used to receive a fourth key negotiation request sent by the first client, wherein the fourth key negotiation request includes the negotiation key handle; and send a session key to the first client so that the first client communicates with the second client according to the session key.

[0183] In an embodiment of the present invention, the two-way authentication request receiving module includes:

[0184] A first verification information sending submodule, configured to receive a first verification information acquisition request sent by the first client, and send first verification information to the first client;

[0185] A second verification information sending submodule, configured to receive a first verification information verification request sent by the second client, and after the first verification information is verified, send second verification information to the second client;

[0186] The session key handle sending submodule is used to receive a second verification information verification request sent by the first client, and after the second verification information is verified, send a session key handle to the first client.

[0187] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0188] An embodiment of the present invention further provides an electronic device, including:

[0189] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned communication method embodiment based on the signaling service system are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0190] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned communication method embodiment based on the signaling service system are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0191] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0192] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0193] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0194] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0195] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0196] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0197] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0198] The signaling service system and the communication method based on the signaling service system provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A communication method based on a signaling service system, characterized in that: Applied to a first client, the method includes: Sending a two-way authentication request for the second client to the key management platform, and receiving a session key handle sent by the key management platform after the two-way authentication is passed; Sending a first key negotiation request to the key management platform, and receiving a negotiated key handle and first public key information sent by the key management platform; Sending a second key negotiation request to the second client, where the second key negotiation request includes the session key handle, the negotiated key length, and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiated key length, and the first public key information; Receiving second public key information sent by the second client; the second public key information is sent by the key management platform to the second client; Sending a fourth key negotiation request to the key management platform, where the fourth key negotiation request includes the negotiated key handle; Receive the session key sent by the key management platform, and communicate with the second client according to the session key.

2. The method according to claim 1, characterized in that The initiating a two-way authentication process for the second client to the key management platform, and receiving a session key handle sent by the key management platform after the two-way authentication process passes, includes: Acquire first verification information from the key management platform; Sending the first verification information to the second client, so that the second client verifies the first verification information through the key management platform; receiving second verification information sent by the second client, where the second verification information is sent to the second client after the key management platform verifies that the first verification information has passed; The second verification information is verified by the key management platform, and a session key handle is received after the key management platform verifies that the second verification information is successful.

3. The method according to claim 1, characterized in that The method further comprises: Sending a registration session request to the identity authentication platform, wherein the registration session request includes third verification information; Receiving an authorization code sent by the identity authentication platform after verifying that the third verification information has passed verification; A connection establishment request is sent to the second client, wherein the connection establishment request includes the authorization code, so that the second client verifies the authorization code through the identity authentication platform, and after verifying the authorization code, receives the access code sent by the key management platform.

4. The method according to claim 3, characterized in that The communicating with the second client according to the session key comprises: The communication path information sent by the identity authentication platform is received, and a communication path is configured according to the communication path information, so as to communicate with the second client through the communication path according to the session key.

5. The method according to claim 4, characterized in that The method further comprises: Receiving a session state synchronization request sent by the identity authentication; the session state synchronization request includes session state information; The session state is synchronized with the second client according to the session state information.

6. A communication method based on a signaling service system, characterized in that: Applied to a key management platform, the method comprises: Receiving a two-way authentication request for a second client sent by a first client, and sending a session key handle to the first client after the two-way authentication passes; receiving a first key negotiation request sent by the first client, and sending a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key length and the first public key information; Receiving a third key negotiation request sent by a second client, the third key negotiation request including the session key handle, the negotiated key length and the first public key information; generating a session key and sending the second public key information to the second client; A fourth key negotiation request sent by the first client is received, wherein the fourth key negotiation request includes the negotiation key handle; and a session key is sent to the first client, so that the first client communicates with the second client according to the session key.

7. The method according to claim 6, characterized in that The receiving a two-way authentication request for a second client sent by a first client, and sending a session key handle to the first client after the two-way authentication passes, comprises: receiving a first verification information acquisition request sent by the first client, and sending first verification information to the first client; receiving a first verification information verification request sent by the second client, and after the first verification information is verified, sending second verification information to the second client; A second verification information verification request sent by the first client is received, and after the second verification information is verified successfully, a session key handle is sent to the first client.

8. A signaling service system, characterized in that: The system includes a first client, a second client and a key management platform; The first client is used to send a two-way authentication request for the second client to the key management platform and receive a session key handle sent by the key management platform after the two-way authentication is passed; send a first key negotiation request to the key management platform, receive the negotiated key handle and first public key information sent by the key management platform; send a second key negotiation request to the second client, the second key negotiation request includes the session key handle, the negotiated key length and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiated key length and the first public key information; Receiving second public key information sent by the second client; the second public key information is sent by the key management platform to the second client; Sending a fourth key negotiation request to the key management platform, where the fourth key negotiation request includes the negotiated key handle; receiving a session key sent by the key management platform, and communicating with the second client according to the session key; The second client is used to receive a second key negotiation request sent by the first client; Sending a third key negotiation request to the key management platform, the third key negotiation request including the session key handle, the negotiated key length and the first public key information; receiving the second public key information sent by the key management platform; sending the second public key information to the first client; The key management platform is configured to receive a two-way authentication request sent by a first client for a second client, and send a session key handle to the first client after the two-way authentication passes; receive a first key negotiation request sent by the first client, and send a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key length and the first public key information; receiving a third key negotiation request sent by the second client, the third key negotiation request including the session key handle, the negotiated key length and the first public key information; generating a session key and sending the second public key information to the second client; receiving a fourth key negotiation request sent by the first client, the fourth key negotiation request including the negotiated key handle; A session key is sent to the first client, so that the first client communicates with the second client according to the session key.

9. The system according to claim 8, characterized in that The first client is configured to obtain first verification information from the key management platform; and send the first verification information to the second client, so that the second client verifies the first verification information through the key management platform; receiving second verification information sent by the second client, where the second verification information is sent to the second client after the key management platform verifies that the first verification information is passed; verifying the second verification information through the key management platform, and receiving a session key handle sent by the key management platform after the key management platform verifies that the second verification information is passed; The second client is used to receive the first verification information sent by the first client; Verifying the first verification information through the key management platform, and receiving second verification information sent by the key management platform after verifying that the first verification information is passed; and sending the second verification information to the first client; The key management platform is configured to receive a first verification information acquisition request sent by the first client, and send the first verification information to the first client; Receive a first verification information verification request sent by the second client, and after the first verification information is verified, send second verification information to the second client; receive a second verification information verification request sent by the first client, and after the second verification information is verified, send a session key handle to the first client.

10. The system according to claim 8, characterized in that The system also includes an identity authentication platform; The first client is used to send a registration session request to the identity authentication platform, wherein the registration session request includes third verification information; and receive an authorization code sent by the identity authentication platform after verifying that the third verification information has passed verification; Sending a connection establishment request to the second client, the connection establishment request including the authorization code, so that the second client verifies the authorization code through the identity authentication platform, and after verifying the authorization code, receives an access code sent by the identity authentication platform; receiving the communication path information sent by the identity authentication platform, and configuring the communication path according to the communication path information, so as to communicate with the second client through the communication path according to the session key; The second client is configured to receive a connection establishment request sent by the first client; verify the authorization code through the identity authentication platform; and receive an access code sent by the identity authentication platform after the authorization code is verified; The identity authentication platform is used to receive a registration session request sent by the first client, the registration session request includes third verification information; after the third verification information is verified, send an authorization code to the first client; receive an authorization code verification request sent by the second client, the authorization code verification request includes the authorization code; after the authorization code is verified, send an access code to the second client; send communication path information to the first client and the second client, so that the first client configures a communication path according to the communication path information, so as to communicate with the second client through the communication path according to the session key.

11. The system according to claim 8, characterized in that The first client is used to receive a session state synchronization request sent by the identity authentication platform; the session state synchronization request includes session state information; and synchronize the session state with the second client according to the session state information; The second client is used to receive a session state synchronization request sent by the identity authentication platform; the session state synchronization request includes session state information; and synchronize the session state with the first client according to the session state information; The identity authentication platform is used to send a session state synchronization request to the first client and the second client, wherein the session state synchronization request includes session state information, so that the first client and the second client synchronize session states according to the session state information.

12. A communication device based on a signaling service system, characterized in that: Applied to a first client, the device comprises: A two-way authentication request sending module, used to send a two-way authentication request for a second client to the key management platform, and receive a session key handle sent by the key management platform after the two-way authentication is passed; A first key negotiation request sending module, used to send a first key negotiation request to the key management platform, and receive a negotiated key handle and first public key information sent by the key management platform; a second key negotiation request sending module, configured to send a second key negotiation request to the second client, wherein the second key negotiation request includes the session key handle, the negotiated key length, and the first public key information, so that the second client sends a third key negotiation request to the key management platform according to the session key handle, the negotiated key length, and the first public key information; A second public key information receiving module, used to receive the second public key information sent by the second client; the second public key information is sent by the key management platform to the second client; A fourth key negotiation request sending module, configured to send a fourth key negotiation request to the key management platform, wherein the fourth key negotiation request includes the negotiated key handle; The session key receiving module is used to receive the session key sent by the key management platform and communicate with the second client according to the session key.

13. A communication device based on a signaling service system, characterized in that: Applied to a key management platform, the device comprises: A two-way authentication request receiving module, configured to receive a two-way authentication request sent by a first client to a second client, and to send a session key handle to the first client after the two-way authentication passes; a first key negotiation request receiving module, configured to receive a first key negotiation request sent by the first client, and send a negotiation key handle and first public key information to the first client, so that the first client sends a second key negotiation request to the second client according to the session key handle, the negotiation key length and the first public key information; A third key negotiation request receiving module, configured to receive a third key negotiation request sent by a second client, wherein the third key negotiation request includes the session key handle, the negotiation key length, and the first public key information; generate a session key and send the second public key information to the second client; The fourth key negotiation request receiving module is used to receive a fourth key negotiation request sent by the first client, wherein the fourth key negotiation request includes the negotiation key handle; and send a session key to the first client so that the first client communicates with the second client according to the session key.

14. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the communication method based on the signaling service system as described in any one of claims 1-5 or claims 6-7 are implemented.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the communication method based on the signaling service system as claimed in any one of claims 1 to 5 or claims 6 to 7 are implemented.

Images