Telephone encryption method and device based on IPPBX system, and medium

Abstract

The invention relates to a telephone encryption method and device based on an IPPBX system and a medium, and the method comprises the steps: adding a number encryption identifier on a calling channel before a call is initiated when the calling channel needs to be encrypted; when the called channel needs to be encrypted, adding a called encryption identifier on the calling channel before the call is initiated; when a calling incoming call is received, judging whether a calling channel contains a called encrypted identifier or not, and if so, adding a number encrypted identifier on a corresponding called channel; when the SIP packet needs to be sent to the calling channel, judging whether the calling channel contains the number encryption identifier, and if so, encrypting the number in the SIP packet; and when the SIP packet needs to be sent to the called channel, judging whether the called channel contains the number encryption identifier, and if so, encrypting the number in the SIP packet. According to the invention, powerful privacy protection is provided, and sensitive information such as telephone numbers is ensured not to be leaked.

Description

Technical Field

[0001] The present invention relates to the technical field of network calls, and in particular to a telephone encryption method, equipment and medium based on an IPPBX system. Background Art

[0002] As enterprises have increasingly higher requirements for communication security, IPPBX systems, as core components of internal enterprise communications, need to encrypt transmitted phone numbers and call content to prevent sensitive information leakage and illegal monitoring. If there is an IPPBX number encryption technology, it can ensure the secure transmission of numbers and voice data in VoIP communications, especially in long-distance communications between enterprises and branches.

[0003] In a globalized business environment, many companies have branches and offices in different regions. The IPPBX system interconnects internal networks through VPN technology, allowing internal calls to be made over the IP network. Therefore, an IPPBX number encryption technology is needed to ensure the security and privacy of these communications, especially when it comes to cross-border communications.

[0004] With the strengthening of data protection regulations (such as GDPR, etc.), enterprises need to ensure that personal and sensitive data is protected during communications. Therefore, an IPPBX number encryption technology is needed to help enterprises meet these regulatory requirements and avoid legal and financial penalties due to data leaks.

[0005] In VoIP communications, phone number forgery and fraud is an increasingly serious problem. Therefore, an IPPBX number encryption technology is needed to improve the security of call authentication, prevent illegal calls and phone fraud, and protect enterprises and individual users from economic losses. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a telephone encryption method, device and medium based on an IPPBX system.

[0007] The specific plan is as follows:

[0008] A telephone encryption method based on an IPPBX system comprises the following steps:

[0009] When the calling channel corresponding to the call needs to be encrypted, a number encryption mark is added to the calling channel corresponding to the call before the call is initiated; when the called channel corresponding to the call needs to be encrypted, a called encryption mark is added to the calling channel corresponding to the call before the call is initiated;

[0010] When receiving an incoming call, determine whether the corresponding calling channel contains the called party encryption identifier. If yes, add the number encryption identifier to the corresponding called party channel.

[0011] When it is necessary to send a SIP packet containing a number to a calling channel, determine whether the calling channel contains a number encryption identifier. If so, encrypt the number in the sent SIP packet; when it is necessary to send a SIP packet containing a number to a called channel, determine whether the called channel contains a number encryption identifier. If so, encrypt the number in the sent SIP packet.

[0012] Furthermore, when it is necessary to encrypt the number in the SIP packet, firstly determine which fields in the SIP packet need to be encrypted by the following steps:

[0013] S101: Determine whether there is a From header field in the SIP packet. If yes, parse the user and displayname fields in the From header field. When the contents of the displayname and user fields are consistent, encrypt the contents of both the displayname and user fields. When the displayname field is empty, only encrypt the content of the user field. Enter S102. Otherwise, end.

[0014] S102: Determine whether the Remote-Party-ID header field exists in the SIP packet. If so, parse the user and displayname fields in the Remote-Party-ID header field. When the contents of the displayname and user fields are consistent, encrypt the contents of both the displayname and user fields. When the displayname field is empty, only encrypt the content of the user field. Otherwise, end.

[0015] Furthermore, the number encryption method is:

[0016] S201: Determine whether the content to be encrypted is empty, if yes, end; otherwise, enter S202;

[0017] S202: Calculate the length of the content to be encrypted and determine whether the length is greater than or equal to 11 digits. If so, retain the first and last four digits and change the remaining digits to asterisks; otherwise, proceed to S203;

[0018] S203: Determine whether the length is greater than or equal to 6 digits. If so, retain the first and second digits of the data and change the remaining data to asterisks; otherwise, do not encrypt.

[0019] Furthermore, it also includes marking the encrypted end of the call when generating a call record after the call ends, which is specifically achieved by the following steps:

[0020] S301: When publishing a CDR node, determine whether the node has a channel snapshot at the local end. If yes, proceed to S302; otherwise, proceed directly to S303;

[0021] S302: Determine whether there is a number encryption identifier in the channel snapshot of the local end. If yes, add the local encryption identifier to the node and enter S303; otherwise, directly enter S303;

[0022] S303: Determine whether the node has a channel snapshot of the other end. If yes, proceed to S304; otherwise, proceed directly to S305;

[0023] S304: Determine whether there is a number encryption identifier in the channel snapshot of the other end. If yes, add the peer encryption identifier to the node and proceed to S305; otherwise, directly proceed to S305;

[0024] S305: Display the number encryption status according to the local encryption identifier and the peer encryption identifier contained in the node.

[0025] A telephone encryption terminal device based on an IPPBX system comprises a processor, a memory and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method described above in the embodiment of the present invention are implemented.

[0026] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described above in an embodiment of the present invention are implemented.

[0027] The present invention adopts the above technical solution and has the following beneficial effects:

[0028] (1) It provides strong privacy protection, ensuring that sensitive information such as phone numbers are not leaked, and meets the current strict requirements for personal privacy protection.

[0029] (2) Encryption technology can prevent numbers from being attacked by malware or hackers, thereby enhancing the security of the system.

[0030] (3) Compliance with data protection regulations helps companies avoid fines for violating privacy regulations.

[0031] (4) Different encryption strategies can be provided for numbers of different lengths to adapt to a variety of application scenarios.

[0032] (5) It can be integrated into existing systems as a module without large-scale changes to the existing architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1Shown is a flow chart of a method according to a first embodiment of the present invention. DETAILED DESCRIPTION

[0034] To further illustrate various embodiments, the present invention provides drawings. These drawings are part of the disclosure of the present invention, which are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in this field should be able to understand other possible implementations and advantages of the present invention.

[0035] The present invention will now be further described with reference to the accompanying drawings and specific implementation methods.

[0036] Embodiment 1:

[0037] The embodiment of the present invention provides a telephone encryption method based on an IPPBX system, such as Figure 1 As shown, the method comprises the following steps:

[0038] S1: When the calling channel corresponding to the call needs to be encrypted, a number encryption mark is added to the calling channel corresponding to the call before the call is initiated; when the called channel corresponding to the call needs to be encrypted, a called encryption mark is added to the calling channel corresponding to the call before the call is initiated.

[0039] S2: When receiving an incoming call, determine whether the corresponding calling channel contains a called party encryption identifier. If yes, add a number encryption identifier to the corresponding called party channel.

[0040] S3: When it is necessary to send a SIP packet containing a number to a calling channel, determine whether the calling channel contains a number encryption identifier. If so, encrypt the number in the sent SIP packet; when it is necessary to send a SIP packet containing a number to a called channel, determine whether the called channel contains a number encryption identifier. If so, encrypt the number in the sent SIP packet.

[0041] It should be noted that the above method is applicable to the case where both the calling channel and the called channel are SIP channels, and cannot be physical channels.

[0042] Whether the calling channel or called channel corresponding to the call needs to be encrypted needs to be determined according to the specific business. For example, when an external person calls an internal extension, the company manager does not want the internal person to obtain the external person's number for subsequent private contact. At this time, they would like the external person's number displayed on the internal extension to be encrypted. This situation is called called encryption (that is, the number displayed on the called end is an encrypted number).

[0043] In addition, if the calling channel needs to be encrypted, since the calling channel is determined, a number encryption mark can be added to the determined calling channel before the call is initiated, so that the number displayed on the subsequent calling end is an encrypted number. If the called channel needs to be encrypted, since the IPPBX system allocates the corresponding called channel only when receiving the incoming call, the called channel corresponding to the call is uncertain before the call is initiated, so it is not possible to implement called encryption by directly adding a number encryption mark to the called channel. In order to implement called encryption, in this embodiment, a called encryption mark is first added to the calling channel before the call is initiated to indicate that the encryption method of the call is called encryption, and then after the called channel is allocated, the number encryption mark is added to the corresponding called channel.

[0044] Since the number for display is sent through a SIP packet, and the SIP packet contains multiple fields containing the number, when the number needs to be encrypted, it is first necessary to determine which fields in the SIP packet need to be encrypted. In this embodiment, the determination is made through the following steps:

[0045] S101: Determine whether there is a From header field in the SIP packet. If yes, parse the user and displayname fields in the From header field. When the contents of the displayname and user fields are consistent, encrypt the contents of both the displayname and user fields. When the displayname field is empty, only encrypt the content of the user field. Enter S102. Otherwise, end.

[0046] S102: Determine whether the Remote-Party-ID header field exists in the SIP packet. If so, parse the user and displayname fields in the Remote-Party-ID header field. When the contents of the displayname and user fields are consistent, encrypt the contents of both the displayname and user fields. When the displayname field is empty, only encrypt the content of the user field. Otherwise, end.

[0047] Through the above steps, only how to select the fields to be encrypted in the SIP packet is determined. The following is the step of how to encrypt the field content.

[0048] S201: Determine whether the content to be encrypted is empty, if yes, end; otherwise, enter S202;

[0049] S202: Calculate the length of the content to be encrypted and determine whether the length is greater than or equal to 11 digits. If so, retain the first and last four digits and change the remaining digits to asterisks; otherwise, proceed to S203;

[0050] S203: Determine whether the length is greater than or equal to 6 digits. If so, retain the first and second digits of the data and change the remaining data to asterisks; otherwise, do not encrypt.

[0051] The above method introduces a conventional scenario in which a calling party dials a called party through an IPPBX system. In some special scenarios, the method of this embodiment may also be applicable.

[0052] For example, in the scenario of initiating a call through an API, in this scenario, the called number is first used to dial the caller through the API, and the called number is used to dial the called through the API at the same time. The corresponding calling channel for the call to the caller is Local2 and the called channel is A, and the corresponding calling channel for the call to the called is Local1 and the called channel is B. After the called party is connected, Local1 and Local2 are released, and channels A and B are bridged to realize a direct call between the caller and the called party. In the above scenario, if the called party B needs to be encrypted, it is only necessary to add a number encryption mark to the called party channel B in the above manner of this embodiment when dialing the called party using the calling number through the API. After releasing Local1 and Local2 to bridge channels A and B, the number encryption mark is retained on the called party channel B, and the calling number in the SIP packet sent to the called party will be encrypted.

[0053] Furthermore, this embodiment also includes marking the end of the call encryption when generating the call record after the call ends, which is specifically implemented by the following steps:

[0054] S301: when publishing a CDR (Call Detail Records) node, determine whether the node has a channel snapshot of the local end (party_a). If yes, proceed to S302; otherwise, directly proceed to S303.

[0055] The channel snapshot includes the channel information of the corresponding channel, including the number encryption identifier mentioned above.

[0056] S302: Determine whether there is a number encryption identifier in the channel snapshot of the local end. If yes, add the local encryption identifier to the node and enter S303; otherwise, directly enter S303.

[0057] S303: Determine whether the node has a channel snapshot of the other party (party_b). If yes, proceed to S304; otherwise, proceed directly to S305.

[0058] S304: Determine whether there is a number encryption identifier in the channel snapshot of the other end. If yes, add the peer encryption identifier to the node and enter S305; otherwise, directly enter S305.

[0059] S305: Display the number encryption status according to the local encryption identifier and peer encryption identifier contained in the node. There are four situations:

[0060] (1) If both the local encryption identifier and the peer encryption identifier are included, the numbers seen by the calling and called ends are both encrypted numbers;

[0061] (2) If only the local encryption identifier is included, the number seen by the called party is the encrypted number;

[0062] (3) If only the peer encryption identifier is included, then only the number seen by the calling party is the encrypted number;

[0063] (4) If neither the local encryption identifier nor the peer encryption identifier is included, the numbers seen by the calling and called ends are not encrypted.

[0064] Embodiment 2:

[0065] The present invention also provides a telephone encryption terminal device based on an IPPBX system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps in the above method embodiment of the first embodiment of the present invention are implemented.

[0066] Further, as an executable solution, the telephone encryption terminal device based on the IPPBX system can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The telephone encryption terminal device based on the IPPBX system may include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the composition structure of the telephone encryption terminal device based on the IPPBX system is only an example of the telephone encryption terminal device based on the IPPBX system, and does not constitute a limitation on the telephone encryption terminal device based on the IPPBX system. It may include more or less components than the above, or a combination of certain components, or different components. For example, the telephone encryption terminal device based on the IPPBX system may also include input and output devices, network access devices, buses, etc., and the embodiments of the present invention do not limit this.

[0067] Further, as an executable solution, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the telephone encryption terminal device based on the IPPBX system, and uses various interfaces and lines to connect various parts of the telephone encryption terminal device based on the IPPBX system.

[0068] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the telephone encryption terminal device based on the IPPBX system by running or executing the computer program and / or module stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required for a function; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0069] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method in the embodiment of the present invention are implemented.

[0070] If the module / unit integrated in the telephone encryption terminal device based on the IPPBX system is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory) and software distribution medium, etc.

[0071] Although the present invention has been specifically shown and described in conjunction with the preferred embodiments, it should be understood by those skilled in the art that various changes may be made to the present invention in form and details without departing from the spirit and scope of the present invention as defined by the appended claims, all of which are within the scope of protection of the present invention.

Claims

1. A telephone encryption method based on an IPPBX system, characterized in that: The following steps are involved: When the calling channel corresponding to the call needs to be encrypted, a number encryption mark is added to the calling channel corresponding to the call before the call is initiated; when the called channel corresponding to the call needs to be encrypted, a called encryption mark is added to the calling channel corresponding to the call before the call is initiated; When receiving an incoming call, determine whether the corresponding calling channel contains the called party encryption identifier. If yes, add the number encryption identifier to the corresponding called party channel. When it is necessary to send a SIP packet containing a number to a calling channel, determine whether the calling channel contains a number encryption identifier. If so, encrypt the number in the sent SIP packet; when it is necessary to send a SIP packet containing a number to a called channel, determine whether the called channel contains a number encryption identifier. If so, encrypt the number in the sent SIP packet.

2. The telephone encryption method based on the IPPBX system according to claim 1, characterized in that: When you need to encrypt the number in the SIP packet, first determine which fields in the SIP packet need to be encrypted by following the steps below: S101: Determine whether there is a From header field in the SIP packet. If yes, parse the user and displayname fields in the From header field. When the contents of the displayname and user fields are consistent, encrypt the contents of both the displayname and user fields. When the displayname field is empty, only encrypt the content of the user field. Enter S102. Otherwise, end. S102: Determine whether the Remote-Party-ID header field exists in the SIP packet. If so, parse the user and displayname fields in the Remote-Party-ID header field. When the contents of the displayname and user fields are consistent, encrypt the contents of both the displayname and user fields. When the displayname field is empty, only encrypt the content of the user field. Otherwise, end.

3. The telephone encryption method based on the IPPBX system according to claim 1, characterized in that: The number encryption method is: S201: Determine whether the content to be encrypted is empty, if so, end; Otherwise, proceed to S202; S202: Calculate the length of the content to be encrypted and determine whether the length is greater than or equal to 11 digits. If so, retain the first and last four digits and change the remaining digits to asterisks; otherwise, proceed to S203; S203: Determine whether the length is greater than or equal to 6 digits. If so, retain the first and second digits of the data and change the remaining data to asterisks; otherwise, do not encrypt.

4. The telephone encryption method based on the IPPBX system according to claim 1, characterized in that: The method also includes marking the encrypted end of the call when generating the call record after the call ends, which is specifically achieved by the following steps: S301: When publishing a CDR node, determine whether the node has a channel snapshot at the local end. If yes, proceed to S302; otherwise, proceed directly to S303; S302: Determine whether there is a number encryption identifier in the channel snapshot of the local end. If yes, add the local encryption identifier to the node and enter S303; otherwise, directly enter S303; S303: Determine whether the node has a channel snapshot of the other end. If yes, proceed to S304; otherwise, proceed directly to S305; S304: Determine whether there is a number encryption identifier in the channel snapshot of the other end. If yes, add the peer encryption identifier to the node and proceed to S305; otherwise, directly proceed to S305; S305: Display the number encryption status according to the local encryption identifier and the peer encryption identifier contained in the node.

5. A telephone encryption terminal device based on an IPPBX system, characterized in that: The method comprises a processor, a memory and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 4 when executing the computer program.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images