Signaling transmission method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a signaling transmission method and device, electronic equipment and a storage medium. The method comprises the following steps: sending an identity verification request to a first-level server; obtaining first encryption information obtained by the first-level server through the first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information; obtaining a digital certificate of the first-stage server, and verifying the validity of the digital certificate; under the condition that the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypting the first signaling through a second encryption tool to obtain second encrypted information, and encrypting the second encryption tool to obtain third encrypted information; and sending the second encrypted information and the third encrypted information to the first-level server. Therefore, according to the embodiment of the invention, the problem that the security of related services is affected due to the fact that the plaintext transmission of the signaling in the prior art has a relatively large potential safety hazard can be solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a signaling transmission method, device, electronic device and storage medium. Background Art

[0002] With the development of technology, terminals can perform a variety of services. For example, visual network terminals can access the visual network to implement visual network services, and Internet terminals can access the Internet to implement Internet services. Among them, the terminal can implement the corresponding services through interaction with the server. In addition, before executing the service, the server on the network side often needs to send management signaling to the terminal. However, the current network architecture tends to be complex, and the transmission process of management signaling often involves multiple servers. However, the current management signaling is transmitted in plain text on the entire transmission link, which poses a great security risk, thereby affecting the security of related services. Summary of the invention

[0003] The embodiments of the present application provide a signaling transmission method, device, electronic device and storage medium to solve the problem in the prior art that plain text transmission of signaling has great security risks, thereby affecting the security of related services.

[0004] In a first aspect, an embodiment of the present application provides a signaling transmission method, which is applied to a management server, and the method includes:

[0005] Send an authentication request to the first-level server;

[0006] Obtaining first encryption information obtained by the first-level server through a first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information;

[0007] Obtaining the digital certificate of the first-level server and verifying the validity of the digital certificate;

[0008] When the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypting the first signaling by the second encryption tool to obtain second encrypted information, and encrypting the second encryption tool to obtain third encrypted information;

[0009] The second encrypted information and the third encrypted information are sent to the first-level server.

[0010] In a second aspect, an embodiment of the present application provides a signaling transmission method, which is applied to a first-level server, and the method includes:

[0011] Upon receiving an identity authentication request initiated by a management server, obtaining first encryption information through a first encryption tool, and sending the first encryption information to the management server, so that the management server verifies the validity of the first encryption tool of the first-level server through the first encryption information;

[0012] Sending the digital certificate of the first-level server to the management server so that the management server verifies the validity of the digital certificate;

[0013] When the first encryption tool of the first-level server is valid and the digital certificate is valid, the second encryption information and the third encryption information sent by the management server are received, wherein the second encryption information is obtained by encrypting the first signaling through the second encryption tool, and the third encryption information is obtained by encrypting the second encryption tool.

[0014] In a third aspect, an embodiment of the present application provides a signaling transmission method, which is applied to a second-level server, and the method includes:

[0015] Receiving fourth encrypted information sent by the first-level server, wherein the fourth encrypted information is obtained by using a fourth encryption tool;

[0016] The fourth encryption tool is derived according to the third encryption tool and the address information of the second-level server;

[0017] Decrypting the fourth encrypted information by using the fourth encryption tool to obtain decrypted information;

[0018] Sending the decrypted information to the first-level server, so that the first-level server authenticates the second-level server through the decrypted information;

[0019] Receive second encrypted information and fifth encrypted information sent by the first-level server when the second-level server passes identity authentication, wherein the second encrypted information is obtained by encrypting the first signaling using the second encryption tool, and the fifth encrypted information is obtained by encrypting the second encryption tool using the fourth encryption tool.

[0020] In a fourth aspect, an embodiment of the present application provides a signaling transmission device, which is applied to a management server, and the device includes:

[0021] A first sending module, used for sending an identity authentication request to a first-level server;

[0022] A first verification module, used for obtaining first encryption information obtained by the first-level server through a first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information;

[0023] A second verification module is used to obtain the digital certificate of the first-level server and verify the validity of the digital certificate;

[0024] a first encryption module, configured to, when the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypt the first signaling by using a second encryption tool to obtain second encrypted information, and encrypt the second encryption tool to obtain third encrypted information;

[0025] The second sending module is used to send the second encrypted information and the third encrypted information to the first-level server.

[0026] In a fifth aspect, an embodiment of the present application provides a signaling transmission device, which is applied to a first-level server, and the device includes:

[0027] A first receiving module, configured to receive an identity authentication request initiated by a management server;

[0028] a third sending module, configured to obtain first encryption information through a first encryption tool, and send the first encryption information to the management server, so that the management server verifies the validity of the first encryption tool of the first-level server through the first encryption information;

[0029] A fourth sending module, configured to send the digital certificate of the first-level server to the management server, so that the management server verifies the validity of the digital certificate;

[0030] The second receiving module is used to receive the second encrypted information and the third encrypted information sent by the management server when the first encryption tool of the first-level server is valid and the digital certificate is valid, wherein the second encrypted information is obtained by encrypting the first signaling through the second encryption tool, and the third encrypted information is obtained by encrypting the second encryption tool.

[0031] In a sixth aspect, an embodiment of the present application provides a signaling transmission device, which is applied to a second-level server, and the device includes:

[0032] A third receiving module, used to receive fourth encrypted information sent by the first-level server, wherein the fourth encrypted information is obtained by a fourth encryption tool;

[0033] A first derivation module, used for deriving the fourth encryption tool according to the third encryption tool and the address information of the second-level server;

[0034] A first decryption module, used to decrypt the fourth encrypted information by using the fourth encryption tool to obtain decrypted information;

[0035] a fifth sending module, configured to send the decryption information to the first-level server, so that the first-level server authenticates the identity of the second-level server through the decryption information;

[0036] The fourth receiving module is used to receive the second encrypted information and the fifth encrypted information sent by the first-level server when the second-level server passes the identity authentication, wherein the second encrypted information is obtained by encrypting the first signaling through the second encryption tool, and the fifth encrypted information is obtained by encrypting the second encryption tool through the fourth encryption tool.

[0037] In a seventh aspect, an embodiment of the present application provides an electronic device, including:

[0038] one or more processors; and

[0039] One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, enable the electronic device to execute the signaling transmission method described in the first aspect above, or execute the signaling transmission method described in the second aspect above, or execute the signaling transmission method described in the third aspect above.

[0040] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that enables a processor to execute the signaling transmission method described in the first aspect above, or execute the signaling transmission method described in the second aspect above, or execute the signaling transmission method described in the first aspect above.

[0041] In some embodiments of the present application, the management server is able to send an identity authentication request to the first-level server, thereby obtaining the first encrypted information obtained by the first-level server through the first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encrypted information, and obtaining the digital certificate of the first-level server, and verifying the validity of the digital certificate, and then, when the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypt the first signaling through the second encryption tool to obtain the second encrypted information, encrypt the second encryption tool to obtain the third encrypted information, and send the second encrypted information and the third encrypted information to the first-level server.

[0042] It can be seen from this that in some embodiments of the present application, before the management server sends the first signaling to the first-level server, it can verify the validity of the first encryption tool and digital certificate of the first-level server to achieve identity authentication of the first-level server, so that when the verification is passed, the first signaling is encrypted and transmitted to the first-level server, thereby improving the security of the signaling transmission and further improving the security of related services. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flowchart of the steps of a signaling transmission method of the present application;

[0044] Figure 2 is a flowchart of another signaling transmission method of the present application;

[0045] Figure 3 is a flowchart of another signaling transmission method of the present application;

[0046] Figure 4 It is a schematic diagram of the deployment architecture of a visual networking system to which the signaling transmission method according to an embodiment of the present application is applicable;

[0047] Figure 5 It is a flowchart of a specific implementation method of the signaling transmission method of an embodiment of the present application;

[0048] Figure 6 It is a structural block diagram of a signaling transmission device of the present application;

[0049] Figure 7 It is a structural block diagram of another signaling transmission device of the present application;

[0050] Figure 8 It is a structural block diagram of another signaling transmission device of the present application. DETAILED DESCRIPTION

[0051] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0052] In the prior art, management signaling is transmitted in plain text over the entire transmission link, which poses a great security risk and thus affects the security of related services.

[0053] In some embodiments of the present application, the management server can send an identity authentication request to the first-level server, thereby obtaining the first encrypted information obtained by the first-level server through the first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encrypted information, and obtaining the digital certificate of the first-level server, and verifying the validity of the digital certificate, and then, if the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypt the first signaling through the second encryption tool to obtain the second encrypted information, encrypt the second encryption tool to obtain the third encrypted information, and send the second encrypted information and the third encrypted information to the first-level server.

[0054] It can be seen from this that in some embodiments of the present application, before the management server sends the first signaling to the first-level server, it can verify the validity of the first encryption tool and digital certificate of the first-level server to achieve identity authentication of the first-level server, so that when the verification is passed, the first signaling is encrypted and transmitted to the first-level server, thereby improving the security of the signaling transmission and further improving the security of related services.

[0055] Among them, the signaling transmission method of the embodiment of the present application can be applied to the visual network. In this case, the management server can be the service management server of the visual network, the first-level server can be the first-level core switching server directly connected to the service management server, and the second-level server can be the second-level core switching server (that is, the next-level core switching server of the first-level core switching server).

[0056] It can be understood that the application of the signaling transmission method of the embodiment of the present application is not limited to the visual network.

[0057] The signaling transmission method of the embodiment of the present application is introduced in detail below.

[0058] First, as Figure 1 As shown, an embodiment of the present application provides a signaling transmission method, which is applied to a management server. The method may include the following steps 101 to 104:

[0059] Step 101: Send an identity authentication request to the first-level server.

[0060] Among them, the management server may send an identity authentication request to the first-level server before sending the first signaling to the first-level server, for example, before sending the signaling for the first time. It is understandable that if the first-level server is authenticated before sending the signaling for the first time, and the first-level server passes the identity authentication, then when the management server sends the signaling to the first-level server again later, it is not necessary to authenticate the first-level server again. However, if a service interruption occurs during the process of the management server sending the signaling to the first-level server later, or the service is re-initiated, the first-level server needs to be authenticated again.

[0061] Step 102: Obtain first encryption information obtained by the first-level server through a first encryption tool, and verify the validity of the first encryption tool of the first-level server through the first encryption information.

[0062] Among them, the first encryption tool of the first-level server is pre-configured or assigned to the first-level server; optionally, the first encryption tool is the first private key corresponding to the signature certificate, that is, a signature certificate can be issued to the first-level server in advance by a predetermined organization, and the signature certificate contains a first public key. The first private key corresponding to the first public key can be used as the above-mentioned first encryption tool.

[0063] In addition, by verifying whether the first encryption tool of the first-level server is valid through the above-mentioned first encryption information, it is possible to verify whether the first encryption tool pre-configured or assigned to the first-level server has been tampered with; if it has been tampered with, it means that the first-level server cannot pass identity authentication.

[0064] Step 103: Obtain the digital certificate of the first-level server and verify the validity of the digital certificate.

[0065] Among them, the digital certificate may include a signature certificate and an encryption certificate; the digital certificate is issued in advance to the first-level server by a predetermined agency, and the validity of the digital certificate can indicate whether the first-level server is an authenticated server; if the digital certificate of the first-level server is invalid, it means that the first-level server has not been authenticated, and the identity cannot be verified.

[0066] From steps 102 to 103, it can be known that in some embodiments of the present application, the identity authentication of the first-level server can be achieved by verifying the validity of the first encryption tool and the digital certificate of the first-level server. That is, it can be understood that: if the first encryption tool of the first-level server is valid and the digital certificate is valid, it means that the first-level server has passed the identity authentication; if the first encryption tool of the first-level server is invalid or the digital certificate is invalid, it means that the first-level server has not passed the identity authentication.

[0067] In addition, it should be noted that the specific method for verifying the validity of the digital certificate can adopt any method in the prior art, which will not be described in detail here.

[0068] Step 104: When the first encryption tool of the first-level server is valid and the digital certificate is valid, the first signaling is encrypted by the second encryption tool to obtain second encrypted information, and the second encryption tool is encrypted to obtain third encrypted information.

[0069] Step 105: Send the second encrypted information and the third encrypted information to the first-level server.

[0070] It can be seen from steps 104 to 105 that when the management server transmits the first signaling to the first-level server, it can use the second encryption tool to encrypt it, and also encrypt the second encryption tool, and then transmit it to the first-level server. In this way, after the first-level server receives the above-mentioned second encrypted information and third encrypted information, it can first decrypt the third encrypted information to obtain the second encryption tool, and then use the second encryption tool to decrypt the second encrypted information to obtain the first signaling.

[0071] Optionally, the second encryption tool is an encryption tool of a target terminal, wherein the target terminal includes a terminal for receiving the first signaling.

[0072] It should be noted that the management server is connected to the first-level server in communication, and the first-level server is connected to at least one server, or the first-level server is connected to at least one terminal. It can be seen that the signaling is sent by the management server, and then sent to the terminal through at least one server.

[0073] That is, the first signaling that the management server needs to send is ultimately received by the terminal, wherein each terminal often uses the same key to decrypt the signaling. Therefore, in the process of transmitting the first signaling, the key of the terminal can be used for encryption, so that the terminal can receive the encrypted first signaling and decrypt it.

[0074] It can be seen from the above steps 101 to 105 that in some embodiments of the present application, the management server can send an identity authentication request to the first-level server, thereby obtaining the first encryption information obtained by the first-level server through the first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information, and obtaining the digital certificate of the first-level server, verifying the validity of the digital certificate, and then, when the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypt the first signaling through the second encryption tool to obtain the second encryption information, encrypt the second encryption tool to obtain the third encryption information, and send the second encryption information and the third encryption information to the first-level server.

[0075] It can be seen that in some embodiments of the present application, before the management server sends the first signaling to the first-level server, it can verify the validity of the first encryption tool and digital certificate of the first-level server to achieve identity authentication of the first-level server, so that when the verification is passed, the first signaling is encrypted and transmitted to the first-level server, thereby improving the security of signaling transmission and further improving the security of related services.

[0076] Optionally, when the digital certificate includes a signature certificate, the first encryption tool is a first private key corresponding to the signature certificate, and the first encrypted information is a first signature value;

[0077] In the above step 102, obtaining the first encryption information obtained by the first-level server through the first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information includes the following steps A-1 to A-4:

[0078] Step A-1: ​​Sending a first random number to the first-level server;

[0079] Step A-2: receiving the first signature value sent by the first-level server, wherein the first signature value is obtained by signing the first random number with the first private key;

[0080] Step A-3: verifying the first signature value by using the first public key in the signature certificate, wherein the first private key and the first public key constitute a key pair;

[0081] Step A-4: When the first signature value passes the verification, it is determined that the first private key is valid.

[0082] It should be noted that, for a key pair, data encrypted by the private key in the key pair can be decrypted by the public key in the key pair.

[0083] The signature certificate includes a first public key, and the first public key and a first private key corresponding to the signature certificate form a key pair.

[0084] In addition, in the above step A-3, the first signature value is verified by the first public key, that is: the first signature value is decrypted by the first public key to obtain a random number. If the obtained random number is the same as the above first random number, it means that the first signature value passes the verification; otherwise, the first signature value fails the verification.

[0085] In addition, the signature certificate corresponding to the above-mentioned first private key is pre-assigned to the first-level server (that is, only the allowed servers will be assigned signature certificates). If the first signature value obtained by the first-level server after signing the first random number with the first private key passes the signature verification, it means that the first private key is valid, that is, the first level is an approved device; otherwise, if the first signature value fails the signature verification, it means that the first private key is invalid, that is, the first-level server is not an approved device.

[0086] It can be seen from the above steps A-1 to A-4 that in some embodiments of the present application, the management server can generate a first random number and then send it to the first-level server, so that the first-level server can sign the first random number through the first private key corresponding to its signature certificate to obtain a first signature value, and then return the first signature value to the management server. In this way, the management server can verify the first signature value through the first public key corresponding to its stored first private key, thereby verifying the validity of the first private key.

[0087] Optionally, the first random number in step A-1 is carried in the above identity authentication request.

[0088] It is understandable that the first random number may not be carried in the above identity authentication request and may be sent separately to the first-level server.

[0089] Optionally, encrypting the second encryption tool to obtain third encrypted information includes:

[0090] In the case where the digital certificate includes an encryption certificate, the second encryption tool is encrypted by using the second public key in the encryption certificate to obtain the third encrypted information.

[0091] The encryption certificate includes a second public key, and the second public key and a second private key corresponding to the encryption certificate form a key pair.

[0092] In addition, as a part of the digital certificate, the encryption certificate can be used for the aforementioned step 103 to verify the validity, that is, to authenticate the identity of the first-level server. The second public key in the encryption certificate can also be used to encrypt the second encryption tool. In this way, there is no need to set up a key for encrypting the second encryption tool separately, thereby simplifying the relevant process of identity authentication.

[0093] In addition, after receiving the third encrypted information, the first-level server can use the second private key corresponding to the encryption certificate to decrypt the third encrypted information, thereby obtaining the second encryption tool.

[0094] Second, as Figure 2 As shown, an embodiment of the present application provides a signaling transmission method, which is applied to a first-level server. The method may include the following steps 201 to 204:

[0095] Step 201: Upon receiving an identity authentication request initiated by a management server, first encryption information is obtained through a first encryption tool, and the first encryption information is sent to the management server, so that the management server verifies the validity of the first encryption tool of the first-level server through the first encryption information.

[0096] Among them, the management server may send an identity authentication request to the first-level server before sending the first signaling to the first-level server, for example, before sending the signaling for the first time. It is understandable that if the first-level server is authenticated before sending the signaling for the first time, and the first-level server passes the identity authentication, then when the management server sends the signaling to the first-level server again later, it is not necessary to authenticate the first-level server again. However, if a service interruption occurs during the process of the management server sending the signaling to the first-level server later, or the service is re-initiated, the first-level server needs to be authenticated again.

[0097] In addition, the first encryption tool of the first-level server is pre-configured or assigned to the first-level server; optionally, the first encryption tool is the first private key corresponding to the signature certificate, that is, a signature certificate can be issued to the first-level server in advance by a predetermined agency, and the signature certificate contains a first public key. The first private key corresponding to the first public key can be used as the above-mentioned first encryption tool.

[0098] In addition, by verifying whether the first encryption tool of the first-level server is valid through the above-mentioned first encryption information, it is possible to verify whether the first encryption tool pre-configured or assigned to the first-level server has been tampered with; if it has been tampered with, it means that the first-level server cannot pass identity authentication.

[0099] Step 202: Send the digital certificate of the first-level server to the management server, so that the management server verifies the validity of the digital certificate.

[0100] Among them, the digital certificate may include a signature certificate and an encryption certificate; the digital certificate is issued in advance to the first-level server by a predetermined agency, and the validity of the digital certificate can indicate whether the first-level server is an authenticated server; if the digital certificate of the first-level server is invalid, it means that the first-level server has not been authenticated, and the identity cannot be verified.

[0101] From steps 201 to 202, it can be known that in some embodiments of the present application, the identity authentication of the first-level server can be achieved by verifying the validity of the first encryption tool and the digital certificate of the first-level server. That is, it can be understood that: if the first encryption tool of the first-level server is valid and the digital certificate is valid, it means that the first-level server has passed the identity authentication; if the first encryption tool of the first-level server is invalid or the digital certificate is invalid, it means that the first-level server has not passed the identity authentication.

[0102] Step 203: When the first encryption tool of the first-level server is valid and the digital certificate is valid, receive the second encryption information and the third encryption information sent by the management server.

[0103] The second encrypted information is obtained by encrypting the first signaling through a second encryption tool, and the third encrypted information is obtained by encrypting the second encryption tool.

[0104] From this, it can be seen that when the management server transmits the first signaling to the first-level server, it can use the second encryption tool to encrypt it, and also encrypt the second encryption tool, and then transmit it to the first-level server. In this way, after the first-level server receives the above-mentioned second encrypted information and third encrypted information, it can first decrypt the third encrypted information to obtain the second encryption tool, and then use the second encryption tool to decrypt the second encrypted information to obtain the first signaling.

[0105] Optionally, the second encryption tool is an encryption tool of a target terminal, wherein the target terminal includes a terminal for receiving the first signaling.

[0106] It should be noted that the management server is connected to the first-level server in communication, and the first-level server is connected to at least one server, or the first-level server is connected to at least one terminal. It can be seen that the signaling is sent by the management server, and then sent to the terminal through at least one server.

[0107] That is, the first signaling that the management server needs to send is ultimately received by the terminal, wherein each terminal often uses the same key to decrypt the signaling. Therefore, in the process of transmitting the first signaling, the key of the terminal can be used for encryption, so that the terminal can receive the encrypted first signaling and decrypt it.

[0108] It can be seen from the above steps 201 to 203 that in some embodiments of the present application, the management server can send an identity authentication request to the first-level server, so that the first-level server obtains the first encrypted information through the first encryption tool, and then sends the first encrypted information to the management server, so that the management server verifies the validity of the first encryption tool of the first-level server through the first encrypted information; and the first-level server also sends the digital certificate of the first-level server to the management server, so that the management server verifies the validity of the digital certificate, and then when the first encryption tool of the first-level server is valid and the digital certificate is valid, the first signaling is encrypted by the second encryption tool to obtain the second encrypted information, the second encryption tool is encrypted to obtain the third encrypted information, and the second encrypted information and the third encrypted information are sent to the first-level server.

[0109] It can be seen that in some embodiments of the present application, before the management server sends the first signaling to the first-level server, it can verify the validity of the first encryption tool and digital certificate of the first-level server to achieve identity authentication of the first-level server, so that when the verification is passed, the first signaling is encrypted and transmitted to the first-level server, thereby improving the security of signaling transmission and further improving the security of related services.

[0110] Optionally, when the digital certificate includes a signature certificate, the first encryption tool is a first private key corresponding to the signature certificate, and the first encrypted information is a first signature value;

[0111] In the above step 201, first encryption information is obtained by using a first encryption tool, and the first encryption information is sent to the first server, so that the first server verifies the validity of the first encryption tool of the second server by using the first encryption information, including the following steps B-1 to B-4:

[0112] Step B-1: receiving a first random number sent by the first server;

[0113] Step B-2: Sign the first random number using the first private key to obtain the first signature value;

[0114] Step B-3: Sending the first signature value to the first server, so that the first server verifies the first signature value by using the first public key in the signature certificate;

[0115] Step B-4: When the first signature value passes the verification, it is determined that the first private key of the second server is valid.

[0116] It should be noted that, for a key pair, data encrypted by the private key in the key pair can be decrypted by the public key in the key pair.

[0117] The signature certificate includes a first public key, and the first public key and a first private key corresponding to the signature certificate form a key pair.

[0118] In addition, in the above step B-3, the first server verifies the first signature value through the first public key, that is: the first server decrypts the first signature value through the first public key to obtain a random number. If the obtained random number is the same as the above first random number, it means that the first signature value passes the verification; otherwise, the first signature value fails the verification.

[0119] In addition, the signature certificate corresponding to the above-mentioned first private key is pre-assigned to the first-level server (that is, only the allowed servers will be assigned signature certificates). If the first signature value obtained by the first-level server after signing the first random number with the first private key passes the signature verification, it means that the first private key is valid, that is, the first level is an approved device; otherwise, if the first signature value fails the signature verification, it means that the first private key is invalid, that is, the first-level server is not an approved device.

[0120] It can be seen from the above steps B-1 to B-4 that in some embodiments of the present application, the management server can generate a first random number and then send it to the first-level server, so that the first-level server can sign the first random number through the first private key corresponding to its signature certificate to obtain a first signature value, and then return the first signature value to the management server. In this way, the management server can verify the first signature value through the first public key corresponding to its stored first private key, thereby verifying the validity of the first private key.

[0121] Optionally, in the case where the first-level server is connected to a second-level server on the path from the first-level server to the target terminal, the method further includes the following steps C-1 to C-5:

[0122] Step C-1: decrypting the third encrypted information to obtain the second encryption tool;

[0123] Step C-2: deriving a fourth encryption tool according to the third encryption tool and the address information of the second-level server;

[0124] Step C-3: authenticating the second-level server through the fourth encryption tool;

[0125] Step C-4: when the second-level server passes the identity authentication, encrypting the second encryption tool by the fourth encryption tool to obtain fifth encrypted information;

[0126] Step C-5: Sending the second encrypted information and the fifth encrypted information to the second-level server;

[0127] The target terminal includes a terminal for receiving the first signaling.

[0128] It can be seen that if the first-level server is connected to the second-level server on the path between the first-level server and the target terminal, the first-level server needs to transmit the first signaling to the second-level server. Before the first-level server sends the first signaling to the second-level server, it can also authenticate the identity of the second-level server, thereby further improving the security of signaling transmission.

[0129] The first-level server may derive the fourth encryption tool based on the third encryption tool and the address information of the second-level server, and thereby use the fourth encryption tool to authenticate the identity of the second-level server.

[0130] In addition, after the second-level server passes the identity authentication, the second encryption tool (i.e., the encryption tool used to encrypt the first signaling) can be encrypted by the derived fourth encryption tool to obtain the fifth encrypted information, and then the fifth encrypted information is transmitted to the second-level server. In this way, after the second-level server receives the fifth encrypted information, it can derive the fourth encryption tool according to the third encryption tool and its own address information, and then decrypt the fifth encrypted information by the fourth encryption tool to obtain the second encryption tool.

[0131] It should be noted that the third encryption tool mentioned above is stored in each level of server as a root key.

[0132] Therefore, it can be seen that in some embodiments, each level of server can derive a new encryption tool based on the third encryption tool and the address information of its next level server. In this way, it can be ensured that each level of server has its own encryption tool for encrypting the second encryption tool, and the protection encryption tool does not need to be transmitted over the network or stored on the device. It can be derived as needed, thereby reducing the risk of leakage of the encryption tool.

[0133] In addition, it should be noted that if the final receiving device of the first signaling is a terminal, after the first-level server receives the above-mentioned second encrypted information, if the first-level server is also connected to a second-level server, then, when the second encryption tool used to encrypt the first signaling is the key of the terminal, after the first-level server receives the second encrypted information, it can directly send the second encrypted information to the second-level server without decrypting it. In this way, the second-level server sends it to subsequent servers until it reaches the terminal, thereby reducing unnecessary decryption processes and shortening the signaling transmission time.

[0134] It is understandable that if each level of server uses different encryption tools to encrypt the first signaling, then after receiving the encrypted first signaling, each level of server needs to use the encryption tool of the previous level server to decrypt it, and then re-encrypt it using its own encryption tool, and then transmit it to the next level server. In this way, the encryption tools used by servers at each level to encrypt the first signaling are different, which can further improve the security of signaling transmission, but requires more encryption and decryption times.

[0135] Optionally, in the above step C-3, the authentication of the second-level server by the fourth encryption tool includes the following steps D-1 to D-4:

[0136] Step D-1: Obtain fourth encrypted information through the fourth encryption tool;

[0137] Step D-2: sending the fourth encrypted information to the second-level server, so that the second-level server derives the fourth encryption tool according to the third encryption tool and the address information of the second-level server, and decrypts the fourth encrypted information by the fourth encryption tool to obtain decrypted information;

[0138] Step D-3: receiving the decryption information sent by the second-level server;

[0139] Step D-4: Authenticate the second-level server through the decrypted information.

[0140] It can be seen from this that in the process of authenticating the second-level server based on the fourth encryption tool, both the first-level server and the second-level server need to derive the fourth encryption tool based on the third encryption tool and the address information of the second-level server. In this way, the first-level server can obtain the fourth encrypted information based on the fourth encryption tool it generated, and then send it to the second-level server. The second-level server can use the fourth encryption tool it generated to decrypt it, and then return the decrypted information to the first-level server. The first-level server can authenticate the second-level server based on the decrypted information.

[0141] Optionally, in step D-1, the first-level server may generate a second random number, and then encrypt the second random number through a fourth encryption tool to obtain fourth encrypted information; correspondingly, in step D-3, the decrypted information obtained by the second-level server is a random number, for example, the third random number, then in step D-4, if the third random number is consistent with the second random number, it indicates that the second-level server has passed the identity authentication; if the third random number is inconsistent with the second random number, it indicates that the second-level server has not passed the identity authentication.

[0142] It is understandable that the second random number here can also be replaced by other objects, such as specific numbers or characters.

[0143] In addition, optionally, in the above step C-3, the authentication of the second-level server by using the fourth encryption tool includes:

[0144] Sending a fourth random number to the second-level server, so that the second-level server derives the fourth encryption tool according to the third encryption tool and the address information of the second-level server, and encrypts the fourth random number by the fourth encryption tool to obtain sixth encrypted information;

[0145] receiving the sixth encrypted information sent by the second-level server;

[0146] Decrypting the sixth encrypted information by using the fourth encryption tool to obtain a fifth random number;

[0147] In a case where the fifth random number is the same as the fourth random number, determining that the second-level server passes the identity authentication;

[0148] When the fifth random number is different from the fourth random number, it is determined that the second-level server has failed identity authentication.

[0149] Optionally, the second encryption tool is an encryption tool of the target terminal; when the target terminal accesses the first-level server, the method further includes:

[0150] Sending the second encrypted information to the target terminal;

[0151] The target terminal includes a terminal for receiving the first signaling.

[0152] From this, it can be seen that if the terminal used to receive the first signaling is connected to the first-level server, the first-level server can send the second encrypted information to the target terminal, so that the target terminal can use its own key to decrypt the second encrypted information, obtain the first signaling, and thus execute the first signaling.

[0153] Thirdly, Figure 3 As shown, an embodiment of the present application provides a signaling transmission method, which is applied to a second-level server. The method may include the following steps 301 to 305:

[0154] Step 301: Receive fourth encrypted information sent by the first-level server.

[0155] The fourth encrypted information is obtained through a fourth encryption tool.

[0156] Step 302: derive the fourth encryption tool according to the third encryption tool and the address information of the second-level server.

[0157] The third encryption tool is stored in each level of server as a root key.

[0158] Step 303: Decrypt the fourth encrypted information using the fourth encryption tool to obtain decrypted information.

[0159] Step 304: Sending the decrypted information to the first-level server, so that the first-level server authenticates the second-level server through the decrypted information;

[0160] Step 305: Receive the second encrypted information and the fifth encrypted information sent by the first-level server when the second-level server passes the identity authentication.

[0161] The second encrypted information is obtained by encrypting the first signaling through the second encryption tool, and the fifth encrypted information is obtained by encrypting the second encryption tool through the fourth encryption tool.

[0162] It can be seen from this that before the first-level server sends the first signaling to the second-level server, it can also authenticate the identity of the second-level server, thereby further improving the security of signaling transmission.

[0163] Among them, the first-level server can derive the fourth encryption tool based on the third encryption tool and the address information of the second-level server, and then use the fourth encryption tool to authenticate the second-level server. After the second-level server passes the identity authentication, the second encryption tool (that is, the encryption tool used to encrypt the first signaling) can be encrypted by the derived fourth encryption tool to obtain the fifth encrypted information, and then the fifth encrypted information is transmitted to the second-level server. In this way, after the second-level server receives the fifth encrypted information, it can derive the fourth encryption tool based on the third encryption tool and its own address information, and then decrypt the fifth encrypted information by the fourth encryption tool to obtain the second encryption tool.

[0164] It can be seen that in some embodiments, each level of server can derive a new encryption tool based on the third encryption tool and the address information of its next level server. In this way, it can be ensured that each level of server has its own encryption tool for encrypting the second encryption tool, and the protection encryption tool does not need to be transmitted on the network or stored on the device. It can be derived as needed, thereby reducing the risk of leakage of the encryption tool.

[0165] It can be seen from the above steps 301 to 305 that in some embodiments of the present application, before the first-level server sends the first signaling to the second-level server, it can use the derived fourth encryption tool to authenticate the identity of the second-level server, so that when the verification is passed, the first signaling is encrypted and transmitted to the second-level server, thereby improving the security of the signaling transmission and further improving the security of related services.

[0166] Optionally, the first-level server can generate a second random number, and then encrypt the second random number through a fourth encryption tool to obtain fourth encrypted information; accordingly, in step 303, the decrypted information obtained by the second-level server is a random number, for example, the third random number, then in step 304, if the third random number is consistent with the second random number, it means that the second-level server has passed the identity authentication; if the third random number is inconsistent with the second random number, it means that the second-level server has not passed the identity authentication.

[0167] It is understandable that the second random number here can also be replaced by other objects, such as specific numbers or characters.

[0168] Optionally, the second encryption tool is an encryption tool of the target terminal;

[0169] In the case where the target terminal accesses the second-level server, the method further includes:

[0170] Sending the second encrypted information to the target terminal;

[0171] The target terminal includes a terminal for receiving the first signaling.

[0172] From this, it can be seen that if the terminal used to receive the first signaling is connected to the second-level server, the second-level server can send the second encrypted information to the target terminal, so that the target terminal can use its own key to decrypt the second encrypted information, obtain the first signaling, and thus execute the first signaling.

[0173] In addition, it should be noted that if the second-level server is connected to a third-level server on the path from the second-level server to the target terminal (i.e., the terminal for receiving the first signaling), the second-level server needs to interact with the third-level server to verify the identity of the third-level server, and after the verification is passed, encrypt and transmit the first signaling to the third-level server. The specific implementation process here is the same as the process of the first-level server and the second-level server interacting to authenticate the identity of the second-level server, and the process of the first server encrypting and transmitting the first signaling to the second-level server, and will not be repeated here.

[0174] In summary, when the signaling transmission method of the embodiment of the present application is applied to the visual network, the specific implementation method can be described as follows:

[0175] In order to facilitate understanding of the correspondence between the present implementation and the signaling transmission method described above, the following concepts are firstly established in correspondence, as shown in Table 1:

[0176] Table 1 Conceptual correspondence

[0177]

[0178] Secondly, the deployment architecture of the visual networking system is as follows Figure 4 As shown, the cryptographic server is connected to the service management server; a plurality of core switching servers are included in a visual networking autonomous domain, wherein a first-level core switching server is connected to the service management server, and at least one second-level core switching server is connected to the first-level core switching server; it can be understood that the second-level core switching server can also be connected to at least one third-level core switching server...; at least one visual networking terminal can access the required core switching server, for example, some visual networking terminals can access the first-level core server, and some visual networking terminals can access the second-level core switching server.

[0179] Among them, the core switching server of the visual network, as the core switching platform of the visual network, carries the eight-layer cascade of the visual network and the real-time exchange of a large number of devices, and is responsible for the core switching functions such as the creation, management and data forwarding of the data exchange channels of the visual network.

[0180] Again, based on the above-mentioned visual networking architecture, the specific implementation method of the signaling transmission method of the embodiment of the present application is as follows: Figure 5 As shown, it includes the following steps 1 to 17:

[0181] It should be noted that before the encrypted signaling transmission, the network access authentication process of the visual network terminal Y has been completed, so that the visual network terminal Y has obtained the key NKx from the business management server; and, an encryption chip can be built into the core switching server, and the preset root key EKroot (EKroot is unique in each autonomous domain) can be stored in the encryption chip in advance; the first-level core switching server directly connected to the business management server has applied for an asymmetric encryption algorithm (SM2) dual certificate (i.e., a signature certificate and a digital certificate) from the cryptographic server through the business management server, and stored the dual certificate and encryption key pair (i.e., the public key in the encryption certificate and the corresponding private key).

[0182] Step 1: Before sending the first encrypted signaling, the service management server sends an identity authentication request to the first-level core switching server, carrying the first random number;

[0183] Step 2: The first-level core switching server signs the first random number using the private key corresponding to the signature certificate to obtain a first signature value;

[0184] Step 3: The first-level core switching server sends the first signature value and its own signature certificate and encryption certificate to the service management server;

[0185] Step 4: The business management server calls the cryptographic server to verify the validity of the signature certificate and encryption certificate;

[0186] Step 5: The service management server verifies the first signature value using the public key in the signature certificate;

[0187] Step 6: If the first signature value passes the verification, and both the signature certificate and the encryption certificate are valid, the verification status is recorded;

[0188] Step 7: The service management server sends ciphertext-1 and ciphertext-2 to the first-level core switching server, wherein ciphertext-1 is obtained by encrypting the first signaling through NKx, and ciphertext-2 is obtained by encrypting NKx through the public key in the encryption certificate;

[0189] Step 8: The first-level core switching server uses the private key corresponding to its own encryption certificate to decrypt the ciphertext-2 to obtain NKx, and then uses NKx to decrypt the ciphertext-1 to obtain the first signaling;

[0190] If the first signaling needs to be sent to the second-level core switching server in the next step, the first-level core switching server uses EKroot and the media access control (MAC) address of the second-level core switching server Y to derive EKx; wherein the second-level core switching server Y is the second-level core switching server on the path between the first-level core switching server and the visual network terminal x;

[0191] If the first signaling needs to be sent to the terminal in the next step, the first-level core switching server directly sends the ciphertext-1 to the terminal (ie, the first-level core switching server executes step 15);

[0192] Step 9: The first-level core switching server generates a second random number, and sends the ciphertext-3 to the second-level core switching server Y, wherein the ciphertext-3 is obtained by encrypting the second random number using EKx;

[0193] Step 10: The second-level core switching server Y uses its own MAC address and EKroot to derive EKx, and then decrypts the ciphertext-3 through EKx to obtain the third random number;

[0194] Step 11: The second core switching server X sends a third random number in plain text to the first-level core switching server;

[0195] Step 12: The second-level core switching server Y verifies the correctness of the third random number (i.e., compares whether the third random number is the same as the second random number);

[0196] When the third random number is correct (i.e., the third random number is the same as the second random number), execute step 13;

[0197] Step 13: The first-level core switching server sends ciphertext-4 and ciphertext-5 to the second-level core switching server Y, wherein ciphertext-4 is obtained by encrypting the first signaling through NKx, and ciphertext-5 is obtained by encrypting NKx through EKx;

[0198] Step 14: The second-level core switching server Y uses its own EKx to decrypt the ciphertext-5 to obtain NKx, and uses NKx to decrypt the ciphertext-4 to obtain the first signaling;

[0199] If the first signaling needs to be sent to the next-level core switching server in the next step, the second-level core switching server repeats step 9 and subsequent processes;

[0200] If the first signaling needs to be sent to the video network terminal x in the next step, the second-level core switching server executes step 15;

[0201] Step 15: Send the ciphertext -4 to the visual network terminal x;

[0202] Step 16: The visual network terminal x uses NKx to decrypt the ciphertext-4 to obtain the first signaling, thereby executing the first signaling;

[0203] At this point, the encrypted transmission of the first signaling (i.e., the first signaling) is completed;

[0204] Step 17: Continue to encrypt and transmit the signaling using NKx according to the following path: service management server ←→ first-level core switching server ←→ second-level core switching server Y ←→ visual network terminal x, until the signaling transmission service is terminated.

[0205] It should be noted that after the first signaling transmission is completed, the core switching server will no longer be authenticated during the subsequent signaling transmission process unless the service is interrupted or re-initiated.

[0206] From the above, it can be seen that, combined with the business process of the visual network, the business management signaling is from the business management server → the first-level core switching server → the second-level core switching server → ... → the visual network terminal, so if the signaling full chain encrypted transmission is completed, the signaling encryption key needs to be unified. Among them, after the visual network terminal passes the network authentication, the business management server knows the network key NKx of the visual network terminal. On this basis, the embodiment of the present application adds the identity authentication of the visual core switching server. After the authentication is passed, the business management server sends the network key NKx of the target visual network terminal x to the core switching server (which can be encrypted and sent step by step according to the core switching server), and uses NKx to encrypt the signaling data to be transmitted.

[0207] In short, the visual network realizes the interconnection between the upper platform and the lower platform through the carrier Ethernet Layer 2 dedicated line link, and adopts a tree-like networking architecture, supports an eight-level hierarchical cascade architecture, and meets the networking requirements of multi-level networking and global real-time switching networks. The embodiment of the present application is based on the current cascade architecture of the visual network, and adopts a combination of asymmetric cryptographic technology and symmetric cryptographic technology to solve the identity authentication problem of the core switching server of the visual network. After the identity authentication is passed, the encrypted session key is issued, thereby realizing the encrypted transmission of some business signaling of the visual network, solving the security risks caused by the plain text transmission of some management and control signaling, and improving the overall business security of the visual network system, thereby improving the market competitiveness of visual network products and services.

[0208] It should also be noted that in the embodiment of the present application, a combination of asymmetric cryptographic technology and symmetric cryptographic technology is used to solve the identity authentication problem of the core switching server of the visual network, which can not only ensure the security of the business, but also shorten the authentication time and improve business performance. Among them, the symmetric cryptographic technology authentication adopts the method of pre-setting the root key and the derived key to ensure that each core server has a unique protection key, and the protection key does not need to be transmitted on the network or stored on the device, and is derived as needed, reducing the risk of key leakage.

[0209] In a fourth aspect, an embodiment of the present application provides a signaling transmission device, which is applied to a management server, such as Figure 6 As shown, the device may include the following modules:

[0210] The first sending module 601 is used to send an identity authentication request to the first-level server;

[0211] A first verification module 602 is used to obtain first encryption information obtained by the first-level server through the first encryption tool, and verify the validity of the first encryption tool of the first-level server through the first encryption information;

[0212] The second verification module 603 is used to obtain the digital certificate of the first-level server and verify the validity of the digital certificate;

[0213] The first encryption module 604 is used to encrypt the first signaling by using the second encryption tool to obtain the second encrypted information, and encrypt the second encryption tool to obtain the third encrypted information when the first encryption tool of the first-level server is valid and the digital certificate is valid;

[0214] The second sending module 605 is used to send the second encrypted information and the third encrypted information to the first-level server.

[0215] Optionally, when the digital certificate includes a signature certificate, the first encryption tool is a first private key corresponding to the signature certificate, and the first encrypted information is a first signature value;

[0216] The first verification module 602 is specifically used for:

[0217] Sending a first random number to the first-level server;

[0218] Receiving the first signature value sent by the first-level server, wherein the first signature value is obtained by signing the first random number with the first private key;

[0219] Verifying the first signature value by using the first public key in the signature certificate, wherein the first private key and the first public key constitute a key pair;

[0220] When the first signature value passes the verification, it is determined that the first private key is valid.

[0221] Optionally, the second encryption tool is an encryption tool of a target terminal, wherein the target terminal includes a terminal for receiving the first signaling.

[0222] Optionally, when the first encryption module 604 encrypts the second encryption tool to obtain the third encrypted information, it is specifically used to:

[0223] In the case where the digital certificate includes an encryption certificate, the second encryption tool is encrypted by using the second public key in the encryption certificate to obtain the third encrypted information.

[0224] In a fifth aspect, an embodiment of the present application provides a signaling transmission device, which is applied to a first-level server, such as Figure 7 As shown, the device may include the following modules:

[0225] The first receiving module 701 is used to receive an identity authentication request initiated by a management server;

[0226] The third sending module 702 is used to obtain first encryption information through the first encryption tool, and send the first encryption information to the management server, so that the management server verifies the validity of the first encryption tool of the first-level server through the first encryption information;

[0227] The fourth sending module 703 is used to send the digital certificate of the first-level server to the management server, so that the management server verifies the validity of the digital certificate;

[0228] The second receiving module 704 is used to receive the second encryption information and the third encryption information sent by the management server when the first encryption tool of the first-level server is valid and the digital certificate is valid, wherein the second encryption information is obtained by encrypting the first signaling with the second encryption tool, and the third encryption information is obtained by encrypting the second encryption tool.

[0229] Optionally, in the case where the first-level server is connected to a second-level server on the path from the first-level server to the target terminal, the device further includes:

[0230] A second decryption module, used for decrypting the third encrypted information to obtain the second encryption tool;

[0231] A second derivation module, used to derive a fourth encryption tool according to the third encryption tool and the address information of the second-level server;

[0232] A third verification module, used for authenticating the second-level server through the fourth encryption tool;

[0233] A second encryption module, configured to encrypt the second encryption tool by using the fourth encryption tool to obtain fifth encrypted information when the second-level server passes identity authentication;

[0234] a sixth sending module, configured to send the second encrypted information and the fifth encrypted information to the second-level server;

[0235] The target terminal includes a terminal for receiving the first signaling.

[0236] Optionally, the third verification module is specifically used to:

[0237] Obtain fourth encrypted information through the fourth encryption tool;

[0238] Sending the fourth encrypted information to the second-level server, so that the second-level server derives the fourth encryption tool according to the third encryption tool and the address information of the second-level server, and decrypts the fourth encrypted information by the fourth encryption tool to obtain decrypted information;

[0239] receiving the decryption information sent by the second-level server;

[0240] The second-level server is authenticated by the decrypted information.

[0241] Optionally, the second encryption tool is an encryption tool of the target terminal;

[0242] In the case where the target terminal accesses the first-level server, the device further includes:

[0243] a seventh sending module, configured to send the second encrypted information to the target terminal;

[0244] The target terminal includes a terminal for receiving the first signaling.

[0245] In a sixth aspect, an embodiment of the present application provides a signaling transmission device, which is applied to a second-level server, such as Figure 8 As shown, the device may include the following modules:

[0246] A third receiving module 801 is used to receive fourth encrypted information sent by the first-level server, wherein the fourth encrypted information is obtained by a fourth encryption tool;

[0247] A first derivation module 802, configured to derive the fourth encryption tool according to the third encryption tool and the address information of the second-level server;

[0248] A first decryption module 803, configured to decrypt the fourth encrypted information using the fourth encryption tool to obtain decrypted information;

[0249] A fifth sending module 804 is configured to send the decryption information to the first-level server, so that the first-level server authenticates the identity of the second-level server through the decryption information;

[0250] The fourth receiving module 805 is used to receive the second encrypted information and the fifth encrypted information sent by the first-level server when the second-level server passes the identity authentication, wherein the second encrypted information is obtained by encrypting the first signaling by the second encryption tool, and the fifth encrypted information is obtained by encrypting the second encryption tool by the fourth encryption tool.

[0251] Optionally, the second encryption tool is an encryption tool of the target terminal;

[0252] In the case where the target terminal accesses the second-level server, the device further includes:

[0253] an eighth sending module, configured to send the second encrypted information to the target terminal;

[0254] The target terminal includes a terminal for receiving the first signaling.

[0255] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0256] In the seventh aspect, an embodiment of the present application also provides a signaling transmission system, including a management server, a first-level server, and a second-level server; the management server is used to execute the signaling transmission method described in the first aspect above, the first-level server is used to execute the signaling transmission method described in the second aspect above, and the second-level server is used to execute the signaling transmission method described in the third aspect above.

[0257] In the eighth aspect, an embodiment of the present application also provides an electronic device, comprising: one or more processors; and one or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, enables the electronic device to execute the signaling transmission method described in the first aspect above, or execute the signaling transmission method described in the second aspect above, or execute the signaling transmission method described in the third aspect above.

[0258] In the ninth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that enables a processor to execute the signaling transmission method described in the first aspect above, or execute the signaling transmission method described in the second aspect above, or execute the signaling transmission method described in the third aspect above.

[0259] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0260] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0261] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0262] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0263] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0264] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0265] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0266] The above is a detailed introduction to a signaling transmission method, device, electronic device and storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A signaling transmission method, characterized in that: Applied to a management server, the method comprises: Send an authentication request to the first-level server; Obtaining first encryption information obtained by the first-level server through a first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information; Obtaining the digital certificate of the first-level server and verifying the validity of the digital certificate; When the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypting the first signaling by the second encryption tool to obtain second encrypted information, and encrypting the second encryption tool to obtain third encrypted information; The second encrypted information and the third encrypted information are sent to the first-level server.

2. The method according to claim 1, characterized in that In the case where the digital certificate includes a signature certificate, the first encryption tool is a first private key corresponding to the signature certificate, and the first encrypted information is a first signature value; The obtaining of the first encryption information obtained by the first-level server through the first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information, includes: Sending a first random number to the first-level server; Receiving the first signature value sent by the first-level server, wherein the first signature value is obtained by signing the first random number with the first private key; Verify the first signature value by using the first public key in the signature certificate, wherein the first private key and the first public key constitute a key pair; When the first signature value passes the verification, it is determined that the first private key is valid.

3. The method according to claim 1, characterized in that The second encryption tool is an encryption tool of a target terminal, wherein the target terminal includes a terminal for receiving the first signaling.

4. The method according to claim 1, characterized in that: The step of encrypting the second encryption tool to obtain third encrypted information includes: In the case where the digital certificate includes an encryption certificate, the second encryption tool is encrypted by using the second public key in the encryption certificate to obtain the third encrypted information.

5. A signaling transmission method, characterized in that: Applied to the first-level server, the method comprises: Upon receiving an identity authentication request initiated by a management server, obtaining first encryption information through a first encryption tool, and sending the first encryption information to the management server, so that the management server verifies the validity of the first encryption tool of the first-level server through the first encryption information; Sending the digital certificate of the first-level server to the management server so that the management server verifies the validity of the digital certificate; When the first encryption tool of the first-level server is valid and the digital certificate is valid, the second encryption information and the third encryption information sent by the management server are received, wherein the second encryption information is obtained by encrypting the first signaling through the second encryption tool, and the third encryption information is obtained by encrypting the second encryption tool.

6. The method according to claim 5, characterized in that In the case where the first-level server is connected to a second-level server on the path from the first-level server to the target terminal, the method further includes: decrypting the third encrypted information to obtain the second encryption tool; Deriving a fourth encryption tool according to the third encryption tool and the address information of the second-level server; authenticating the second-level server through the fourth encryption tool; When the second-level server passes the identity authentication, encrypting the second encryption tool by the fourth encryption tool to obtain fifth encrypted information; sending the second encrypted information and the fifth encrypted information to the second-level server; The target terminal includes a terminal for receiving the first signaling.

7. The method according to claim 6, characterized in that The step of authenticating the second-level server by using the fourth encryption tool includes: Obtain fourth encrypted information through the fourth encryption tool; Sending the fourth encrypted information to the second-level server, so that the second-level server derives the fourth encryption tool according to the third encryption tool and the address information of the second-level server, and decrypts the fourth encrypted information by the fourth encryption tool to obtain decrypted information; receiving the decryption information sent by the second-level server; The second-level server is authenticated by the decrypted information.

8. The method according to claim 5, characterized in that The second encryption tool is an encryption tool of the target terminal; In the case where the target terminal accesses the first-level server, the method further includes: Sending the second encrypted information to the target terminal; The target terminal includes a terminal for receiving the first signaling.

9. A signaling transmission method, characterized in that: Applied to the second-level server, the method comprises: Receiving fourth encrypted information sent by the first-level server, wherein the fourth encrypted information is obtained by using a fourth encryption tool; The fourth encryption tool is derived according to the third encryption tool and the address information of the second-level server; Decrypting the fourth encrypted information by using the fourth encryption tool to obtain decrypted information; Sending the decrypted information to the first-level server, so that the first-level server authenticates the second-level server through the decrypted information; Receive second encrypted information and fifth encrypted information sent by the first-level server when the second-level server passes identity authentication, wherein the second encrypted information is obtained by encrypting the first signaling through the second encryption tool, and the fifth encrypted information is obtained by encrypting the second encryption tool through the fourth encryption tool.

10. The method according to claim 9, characterized in that The second encryption tool is an encryption tool of the target terminal; In the case where the target terminal accesses the second-level server, the method further includes: Sending the second encrypted information to the target terminal; The target terminal includes a terminal for receiving the first signaling.

11. A signaling transmission device, characterized in that: Applied to a management server, the device comprises: A first sending module, used for sending an identity authentication request to a first-level server; A first verification module, used for obtaining first encryption information obtained by the first-level server through the first encryption tool, and verifying the validity of the first encryption tool of the first-level server through the first encryption information; A second verification module is used to obtain the digital certificate of the first-level server and verify the validity of the digital certificate; a first encryption module, configured to, when the first encryption tool of the first-level server is valid and the digital certificate is valid, encrypt the first signaling by using a second encryption tool to obtain second encrypted information, and encrypt the second encryption tool to obtain third encrypted information; The second sending module is used to send the second encrypted information and the third encrypted information to the first-level server.

12. A signaling transmission device, characterized in that: Applied to the first-level server, the device comprises: A first receiving module, configured to receive an identity authentication request initiated by a management server; a third sending module, configured to obtain first encryption information through a first encryption tool, and send the first encryption information to the management server, so that the management server verifies the validity of the first encryption tool of the first-level server through the first encryption information; A fourth sending module, configured to send the digital certificate of the first-level server to the management server, so that the management server verifies the validity of the digital certificate; The second receiving module is used to receive the second encrypted information and the third encrypted information sent by the management server when the first encryption tool of the first-level server is valid and the digital certificate is valid, wherein the second encrypted information is obtained by encrypting the first signaling through the second encryption tool, and the third encrypted information is obtained by encrypting the second encryption tool.

13. A signaling transmission device, characterized in that: Applied to the second-level server, the device comprises: A third receiving module, used to receive fourth encrypted information sent by the first-level server, wherein the fourth encrypted information is obtained by a fourth encryption tool; A first derivation module, used for deriving the fourth encryption tool according to the third encryption tool and the address information of the second-level server; A first decryption module, used to decrypt the fourth encrypted information by using the fourth encryption tool to obtain decrypted information; a fifth sending module, configured to send the decryption information to the first-level server, so that the first-level server authenticates the identity of the second-level server through the decryption information; The fourth receiving module is used to receive the second encrypted information and the fifth encrypted information sent by the first-level server when the second-level server passes the identity authentication, wherein the second encrypted information is obtained by encrypting the first signaling through the second encryption tool, and the fifth encrypted information is obtained by encrypting the second encryption tool through the fourth encryption tool.

14. An electronic device, characterized in that: include: one or more processors; and One or more machine-readable media having instructions stored thereon, when executed by the one or more processors, cause the electronic device to execute the signaling transmission method as described in any one of claims 1 to 4, or execute the signaling transmission method as described in any one of claims 5 to 8, or execute the signaling transmission method as described in any one of claims 9 to 10.

15. A computer-readable storage medium, characterized in that: The computer program stored therein enables the processor to execute the signaling transmission method as described in any one of claims 1 to 4, or execute the signaling transmission method as described in any one of claims 5 to 8, or execute the signaling transmission method as described in any one of claims 9 to 10.

Images