Trusted communication method, electronic device, and storage medium

Abstract

The application discloses a trusted communication method, an electronic device and a storage medium. The method comprises the following steps: in the case that a first terminal calls a second terminal with an authentication identity, the first terminal encrypts a communication token and uploads the communication token to a verification server; the verification server decrypts the communication token and performs trusted identity verification, and obtains a first verification result; the communication token comprises certificate information matched with the authentication identity; in the case that the verification is passed, the verification server forwards a call request to the second terminal; in the case that the second terminal receives the call request, the second terminal requests the verification server to perform trusted identity verification on the communication token, and obtains a second verification result; in the case that the second verification result is passed, the verification server sends identity information corresponding to the authentication identity to the second terminal; and the second terminal displays an incoming call interface, and the incoming call interface displays the identity information. The authentication identity can be displayed on the called terminal, and the authentication identity realizes trusted identity authentication during communication, thereby guaranteeing the credibility of the displayed identity information.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to a reliable communication method, electronic device, and storage medium. Background Technology

[0002] With the rapid development of the mobile internet, various platforms (such as Douyin, Weibo, WeChat official accounts, Xiaohongshu, etc.) have become important carriers of social identity.

[0003] However, when telephone communication systems are used for communication, they only display contact information, such as phone numbers and user-added notes, and cannot display platform identity information, nor can they guarantee the credibility of the displayed platform identity information. Summary of the Invention

[0004] This application provides a trusted communication method, electronic device, and storage medium that can associate an authenticated identity with a user's first terminal. When a user makes a call, the identity corresponding to the user's authenticated identity can be displayed on the called terminal. Furthermore, during communication, a certificate certified by an authentication authority is used to achieve trusted authentication, ensuring the credibility of the identity information displayed on the called terminal.

[0005] On one hand, embodiments of this application provide a trusted communication method, the method comprising: When the first terminal calls the second terminal with an authenticated identity, the first terminal encrypts and generates a communication token and uploads it to the verification server. The verification server decrypts the communication token and performs trusted identity verification to obtain a first verification result. The communication token includes certificate information that matches the authenticated identity. The certificate is issued by the certification authority after the authenticated identity has been verified. If the first verification result is successful, the call request is forwarded to the second terminal; Upon receiving the call request, the second terminal requests the verification server to perform trusted authentication on the communication token again, and obtains a second verification result; If the second verification result is successful, the verification server sends the identity information corresponding to the authenticated identity to the second terminal; The second terminal displays an incoming call interface, which shows the identity information.

[0006] On the other hand, embodiments of this application provide an electronic device, which includes a processor and a memory. The memory stores a computer program, and the processor executes the trusted communication method as described in any of the above embodiments by calling the computer program stored in the memory.

[0007] On the other hand, embodiments of this application provide a computer-readable storage medium storing a computer program adapted for loading by a processor to execute the trusted communication method as described in any of the above embodiments.

[0008] In the trusted communication method, electronic device, and storage medium provided in this application embodiment, the first terminal (calling terminal) has a built-in certificate for trusted identity verification. The certificate is associated with the authenticated identity and is obtained by the first terminal after the authenticated identity has been verified by an authentication authority. When the first terminal makes a call, it generates a communication token based on the certificate. After the verification server verifies the trusted identity, the token is forwarded to the second terminal (called terminal). After receiving the call, the called terminal requests the verification server to verify the trusted identity of the communication token again. After the second verification is successful, the verification server provides the identity information corresponding to the authenticated identity to the called terminal, thereby displaying the authenticated identity information on the called terminal.

[0009] Furthermore, during communication, a certificate certified by a certification authority is used to achieve dual trusted identity authentication when the calling party makes a call and when the called party makes an incoming call, ensuring the credibility of the identity information displayed by the called party. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of an example battery production system provided in an embodiment of this application.

[0012] Figure 2 This is a first flowchart illustrating the trusted communication method provided in an embodiment of this application.

[0013] Figure 3 This is a second flowchart illustrating the trusted communication method provided in an embodiment of this application.

[0014] Figure 4 This is a schematic diagram of a first scenario for the trusted communication method provided in the embodiments of this application.

[0015] Figure 5 This is a schematic diagram of a second scenario for the trusted communication method provided in the embodiments of this application.

[0016] Figure 6 This is a first overall flowchart illustrating the trusted communication method provided in the embodiments of this application.

[0017] Figure 7This is a third flowchart illustrating the trusted communication method provided in the embodiments of this application.

[0018] Figure 8 This is a second overall flowchart illustrating the trusted communication method provided in the embodiments of this application.

[0019] Figure 9 This is a schematic diagram of the structure of a trusted communication device provided in an embodiment of this application.

[0020] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] This application provides a trusted communication method, apparatus, storage medium, device, and program product. Specifically, the trusted communication method of this application can be executed by an electronic device, which can be a terminal or server, etc.

[0023] The terminal can be a smartphone, tablet, laptop, smart TV, wearable smart device, smart vehicle terminal, etc. The terminal can also include a client, which can be a game client, browser client, instant messaging client, or mini-program, etc.

[0024] A server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0025] For example, when this trusted communication method operates on a terminal device, the terminal device may include a display screen and a processor. The display screen is used to present an interface and receive instructions generated by the user interacting with the interface. The processor is used to store applications, run the applications, generate the interface, respond to instructions, and control the display of the interface on the display screen. When the user operates the interface through the display screen, the interface can control the local content of the terminal device in response to the received operation instructions. The terminal device can provide the graphical user interface to the user in various ways, such as rendering it on the terminal device's display screen or presenting the graphical user interface through holographic projection.

[0026] For example, when this trusted communication method runs on a server, it can be implemented and executed based on a cloud system. A cloud system refers to a program execution method based on cloud computing. A cloud system includes servers and client devices. The application's execution entity and interface presentation entity are separate; the storage and execution of the trusted communication method are completed on the server, while the interface presentation is completed on the client. The client is mainly used for data reception, transmission, and interface presentation. For example, the client can be a display device with data transmission capabilities located close to the user, such as a mobile terminal, television, computer, PDA, personal digital assistant, or head-mounted display device. However, the terminal device for data processing is the server in the cloud. When executing the trusted communication method, the user operates the client to send instructions to the server. The server processes the data according to the instructions, encodes and compresses the interface data, returns it to the client via the network, and finally, the client decodes and outputs the interface.

[0027] It should be noted that in the embodiments of this application, the executing entity of the trusted communication method can be a terminal device or a server, and the embodiments of this application do not limit the type of executing entity.

[0028] It is understood that in the specific implementation of this application, user object data, context data and other related data are involved. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0029] For example, in conjunction with the above description, Figure 1 This application illustrates a communication system 1000 for implementing a trusted communication method, as provided in an embodiment of this application. The communication system 1000 may include at least one terminal 1001, at least one server 1002, at least one database 1003, and a network. The terminal 1001 can connect to different servers via the network. The terminal is any device with computing hardware capable of supporting and executing software application tools corresponding to the program.

[0030] In the aforementioned communication system 1000, terminal 1001 is used to install and run applications (such as communication programs). During the execution of the trusted communication method, terminal 1001 interacts with server 1002, sends various information to server 1002, and displays a communication interface to the user based on the data sent by server 1002.

[0031] In possible application scenarios, different terminals 1001 may be served by different servers 1002. Therefore, in order to distinguish the servers 1002 corresponding to different terminals 1001, the embodiments of this application will use the first and second methods for description.

[0032] Furthermore, when the communication system 1000 includes multiple terminals, multiple servers, and multiple networks, different terminals can connect to each other through different networks and different servers. The network can be a wireless network or a wired network; for example, wireless networks include wireless local area networks (WLAN), local area networks (LAN), cellular networks, 2G networks, 3G networks, 4G networks, 5G networks, etc. Additionally, different terminals can also connect to other terminals or to servers using their own Bluetooth networks or hotspot networks. Furthermore, the system 100 can include multiple databases coupled to different servers, and can continuously store game-related information in the databases while different users are playing multiplayer games online.

[0033] It should be noted that, Figure 1 The schematic diagram of the communication system shown is merely an example. The communication system 1000 described in this application embodiment is intended to more clearly illustrate the technical solutions of this application embodiment and does not constitute a limitation on the technical solutions provided in this application embodiment. As those skilled in the art will know, with the evolution of communication systems and the emergence of new business scenarios, the technical solutions provided in this application embodiment are also applicable to similar technical problems.

[0034] In one example, terminal 1001 includes a first terminal and a second terminal, the first terminal being the calling terminal and the second terminal being the called terminal, and server 1002 includes a first operator server to which the calling terminal belongs and a second operator server to which the called terminal belongs.

[0035] During communication, the calling end runs a communication program, selects an authentication identity through the communication program, and then dials the called end through the communication program. The call request is sent to the first operator's server, which then forwards the call request to the second operator's server. The second operator's server then calls the called end, and the called end can display the authentication identity information, thus realizing communication between the calling end and the called end.

[0036] The technical solution of this application will be described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0037] Please see Figure 2 It should be noted that the steps shown may be executed in a logical order different from that shown in the flowchart. The trusted communication method of this application may include the following steps: Step 011: When the first terminal calls the second terminal with an authenticated identity, the first terminal encrypts and generates a communication token and uploads it to the verification server. The verification server decrypts the communication token and performs trusted identity verification to obtain the first verification result. The communication token includes certificate information that matches the authenticated identity. The certificate is issued by the certification authority after the authenticated identity has been verified.

[0038] In this context, the verified identity refers to the externally displayed identity associated with the user on the primary terminal. Examples include verified identities such as blogger on the platform, company employee, and government worker. It can be understood that a single user can have one or more verified identities, and each verified identity must be verified by a verification authority.

[0039] Among them, a communication token is an authorization credential in a network and distributed system. Essentially, it is an encrypted / formatted string or control frame used to prove identity, grant permissions, or control the right to send data, ensuring secure and orderly communication.

[0040] In one alternative embodiment, the communication token includes certificate information that matches the authenticated identity, facilitating trusted identity authentication by the verification server.

[0041] CHAKEN (Trusted Communication, GB / T 43779-2024) is China's independent national standard for trusted communication. Its core uses national cryptographic algorithms (SM2 / SM3 / SM4) for call authentication to prevent identity tampering and solve the problem of harassing / fraudulent calls. Its core network nodes are message servers and ticket servers, with clear division of labor and close cooperation to complete trusted calls.

[0042] The verification server is the server that performs trusted authentication.

[0043] In one alternative embodiment, the verification server may include a CHAKEN message server and a CHAKEN ticket server.

[0044] The message server temporarily stores and forwards communication tokens, and is responsible for the token transfer between the calling party and the called party.

[0045] The ticket server stores and issues trusted identity credentials (tickets / certificates) certified by the CA, and is responsible for endorsing the authenticity of the identity.

[0046] Among them, certification authorities include Certificate Authorities (CAs), which are nationally authorized third-party authoritative institutions with electronic certification qualifications. They are responsible for real-name verification, issuing national cryptographic digital certificates, and managing the certificate lifecycle, providing users / enterprises with unforgeable, traceable, and legally valid "communication digital ID cards".

[0047] The first terminal has a built-in certificate, which is issued by a certification authority after the identity has been verified. The certificate can be stored in the security chip of the first terminal to ensure that the certificate does not leave the security chip, thereby improving security.

[0048] When the first terminal calls the second terminal with an authenticated identity, the first terminal generates a communication token based on its built-in certificate and uploads it to the verification server. The verification server decrypts the communication token and performs trusted identity verification to obtain the first verification result, thereby determining whether the first terminal's authentication identity has been verified.

[0049] Specifically, when the first terminal calls the second terminal with an authenticated identity, the first terminal generates a communication token based on its built-in certificate and uploads it to the message server. After decryption, the message server performs trusted identity authentication, such as verifying the certificate information in the communication token (e.g., the credential field, which is the unique number / index used to find the certificate in CHAKEN). This verifies whether the communication token was issued by a trusted user of CHAKEN. After successful verification, the message server caches the communication token.

[0050] Please see Figure 3 In an optional embodiment, step 011, whereby the first terminal encrypts and generates a communication token and uploads it to the verification server, includes: Step 0111: The first terminal encrypts and generates a communication token and uploads it to the first operator server to which the first terminal belongs. The first operator server forwards the communication token to the verification server and receives the first verification result returned by the verification server.

[0051] It is understandable that both the first terminal and the second terminal rely on the operator to achieve communication. After the first terminal encrypts and generates a communication token, it will first send it to the server of the first operator to which the first terminal belongs. Then, the first operator server forwards the communication token to the verification server and receives the first verification result returned by the verification server (such as a message server).

[0052] In an optional embodiment, the communication token further includes a randomly generated random index value. When the verification server detects that the random index value of the communication token is duplicated with the random index value of any stored token, it determines that the first verification result is verification failure.

[0053] Thus, by generating a random index value for the communication token, replay attacks (i.e., repeatedly sending the same communication token) can be avoided.

[0054] Step 012: If the first verification result is successful, forward the call request to the second terminal.

[0055] If the first verification result is successful, the first terminal is determined to be the terminal of a trusted user of CHAKEN. At this point, communication can be allowed, and the call request is forwarded to the second terminal to realize communication between the first terminal and the second terminal.

[0056] In one optional embodiment, forwarding a call request to a second terminal can be achieved by the first operator server forwarding the call request to the second operator server to which the second terminal belongs, and then the second operator server calling the second terminal.

[0057] Step 013: Upon receiving a call request, the second terminal requests the verification server to perform trusted authentication of the communication token again, and obtains a second verification result.

[0058] It is understandable that the message server only verifies whether the communication token was initiated by a trusted CHAKEN user. However, if the second terminal wants to display the authentication identity of the first terminal, it needs to authenticate the authentication identity to ensure the credibility of the identity information corresponding to the authentication identity displayed by the second terminal.

[0059] Therefore, when the second terminal receives a call request, it will request the verification server to perform trusted authentication of the communication token again to obtain a second verification result. This not only verifies the trusted identity of the communication token, but also obtains the identity information corresponding to the authenticated identity, thereby displaying the identity information.

[0060] Please refer to it again. Figure 3 In an optional embodiment, the call request includes a token index of the communication token. In step 013, upon receiving the call request, the second terminal requests the verification server to perform trusted authentication of the communication token again, obtaining a second verification result, including: Step 0131: Upon receiving a call request, the second operator's server to which the second terminal belongs downloads a communication token from the verification server based on the token index. Step 0132: The second operator server requests the verification server to verify the communication token again in order to obtain a second verification result.

[0061] It is understandable that the second operator's server to which the second terminal belongs will first receive the call request and communication token. When the call request is received, it will first perform a hash calculation on the call request to obtain the token index of the communication token, and then download the communication token with the same token index from the message server.

[0062] Subsequently, using this communication token, a request is made to the ticket server to perform trusted authentication of the communication token, such as verifying whether the certificate information of the communication token exists in the ticket server, thereby obtaining the real identity of the user of the first terminal. Furthermore, the ticket server also stores the identity information corresponding to the authenticated identity associated with each user's real identity, thus achieving trusted identity authentication.

[0063] Step 014: If the second verification result is successful, the verification server sends the identity information corresponding to the authenticated identity to the second terminal.

[0064] Among them, the identity information corresponding to the authenticated identity is used to represent the platform identity information corresponding to the authenticated identity.

[0065] In one optional embodiment, the identity information corresponding to the authenticated identity includes the platform ID (Identifier) ​​and / or nickname to which the authenticated identity belongs. Thus, by using the platform identifier or nickname, the platform identity information corresponding to the authenticated identity can be quickly found in the public information of the corresponding platform.

[0066] After successful authentication, the ticket server can send the identity information corresponding to the authenticated identity to the second terminal and initiate a call request to the second terminal, thereby enabling communication with the second terminal and providing a data basis for the second terminal to display the identity information corresponding to the authenticated identity.

[0067] Step 015: The second terminal displays the incoming call interface, which shows the caller's identity information.

[0068] After receiving a call request, the second terminal displays the incoming call interface, which can show the caller's identity information.

[0069] For example, identity information may include the platform ID, nickname, and other information related to the identity verification, allowing users on the second terminal to quickly understand the verified identity of the caller. Since the verified identity has undergone trusted identity verification, the credibility of the displayed identity information is guaranteed, thereby preventing users on the second terminal from hanging up due to not knowing the identity and location of the caller. This helps reduce the risk of telecom fraud and increases the success rate of business cooperation and communication among platform users.

[0070] Please refer to it again. Figure 3In an optional embodiment, the communication token further includes an identity index corresponding to the authentication identity. Step 014, if the second verification result is successful, the verification server sends the identity information corresponding to the authentication identity to the second terminal, including: Step 0141: If the second verification result is successful, the verification server sends the identity information corresponding to the identity index to the second operator server to which the second terminal belongs. The second operator server generates identity display information based on the information display method supported by the second terminal and the identity information and sends it to the second terminal. The identity display information includes at least the information related to the authenticated identity. Step 015: The second terminal displays the incoming call interface, which shows the caller's identity information, including: Step 0151: The second terminal sends an incoming call notification and displays the incoming call interface, which shows the caller's identity information.

[0071] It can be understood that the identity index is the hash value obtained by irreversibly hashing the identity information (such as platform ID) of the authenticated identity. There is a mapping relationship between the identity index and the identity information of the authenticated identity. This mapping relationship can exist on the ticket server or on the server of the authentication authority. If the second verification result is successful, the ticket server can quickly obtain the corresponding identity information based on the identity index.

[0072] It is understandable that when displaying identity information, in addition to displaying identity information (such as platform ID and nickname), other information related to the verified identity can also be displayed, such as the identity type of the verified identity (such as ordinary user or verified user), profile picture, gender, number of followers, and other publicly available information on the platform. Through the identity information, other information related to the verified identity can be found in the public information of the corresponding platform, thereby generating identity display information.

[0073] It is understandable that, since the second terminal supports different information display methods, when generating identity display information, it is necessary to adapt to the information display methods supported by the second terminal to ensure that the identity display information can be accurately and completely displayed on the incoming call interface of the second terminal.

[0074] In one optional embodiment, the information display method includes a first display method and a second display method. The first display method is a display method that supports rich media display, and the second display method is a display method that does not support rich media display. The identity display information corresponding to the first display method includes rich media information corresponding to the authenticated identity.

[0075] It's understandable that when the second terminal supports rich media display, it can generate rich media-type identity display information, resulting in a better visual effect. For example... Figure 4As shown, when Zhang San, a certified blogger on platform A, calls, the incoming call interface on the second terminal displays Zhang San's avatar, nickname, certified identity, number of followers, etc., allowing users to view richer and more visually appealing identity information.

[0076] When the second terminal does not support rich media display, plain text information is generated as identity display information to ensure that users on the second terminal can at least see the identity display information. For example... Figure 5 As shown, when Zhang San, a certified blogger on platform A, calls, the incoming call interface on the second terminal does not display rich media information, but only displays nickname, certified identity, number of followers, etc. Users can view identity display information in text message type.

[0077] In the trusted communication method of this application, the first terminal (calling terminal) has a built-in certificate for trusted identity verification. The certificate is associated with the authenticated identity and is obtained by the first terminal after the authenticated identity has been verified by an authentication authority. When the first terminal makes a call, it generates a communication token based on the certificate. After the verification server verifies the trusted identity, the token is forwarded to the called terminal. After receiving the call, the called terminal requests the verification server to verify the trusted identity of the communication token again. After the second verification is successful, the verification server provides the identity information corresponding to the authenticated identity to the called terminal, thereby displaying the authenticated identity information on the called terminal.

[0078] Please see Figure 6 The following is a specific example illustrating the entire communication process between the first terminal and the second terminal in this application.

[0079] STEP 1: At the first terminal (e.g.) Figure 6 The calling terminal and the second terminal (such as the calling terminal) Figure 6 When communicating with the called party (the party in the call), the user first selects a trusted identity (i.e., an authenticated identity) to make the call; STEP2 and STEP3: Then, the calling party's CHAKEN token generation service generates a token for this call based on the built-in certificate, and uses national cryptographic algorithms to encrypt it (such as using SM2 and SM3 algorithms to achieve combined encryption) to obtain an encrypted token (i.e., a communication token).

[0080] STEP4: The first terminal sends a call request to the calling operator's core network (such as the first operator's server), and the calling operator's core network.

[0081] STEP5 and STEP6: The calling operator's core network forwards the communication token to the CHAKEN verification node (such as a message server), and then the CHAKEN verification node returns the signature verification result (i.e., the first verification result).

[0082] STEP7: If the signature verification is successful, the calling operator's core network forwards the call request to the called operator's core network (such as the second operator's server).

[0083] STEP8 and STEP9: After receiving the call request, the called operator's core network also requests the CHAKEN verification node to perform identity decoding service. Specifically, based on the token identifier in the call request, it first downloads the corresponding communication token from the message server, and then requests the ticket server to perform trusted identity authentication on the communication token. After successful authentication, it returns the identity information corresponding to the authenticated identity to the called operator's core network.

[0084] STEP10: After receiving the signature data (i.e., identity information), the called operator's core network decrypts and verifies the signature, and then transmits the verified trusted identity information to the called end's CHAKEN SDK (Software Development Kit) component.

[0085] The called operator's core network generates and sends corresponding identity display information to the called party based on whether the called party supports rich media display, and then calls the called party through a pop-up window. If the called party supports rich media display, it sends complete identity information (such as rich media information including avatar) to the called party. If the called party does not support rich media display, it sends simplified identity information (such as text information) to the called party.

[0086] STEP11: The called party sends a notification message (such as ringing) and displays the incoming call interface to show identity information.

[0087] Please see Figure 7 In some embodiments, the trusted communication method further includes: Step 016: The first terminal sends an identity authorization request of the target user to the target platform server to obtain identity authorization information, and uploads the identity authorization information to the authentication server corresponding to the authentication authority. The authentication server verifies the identity authorization information, and after the verification is successful, performs irreversible hash processing on the identification information of the target user to generate an identity index of the authenticated identity. Step 017: The first terminal uploads identity authentication information to the authentication server. The identity authentication information includes at least name, ID number and mobile phone number. The authentication server performs identity authentication on the identity authentication information, and after successful authentication, generates a certificate corresponding to the target user and sends it to the first terminal. The certificate includes at least certificate identifier, identity index and certificate validity period.

[0088] To ensure the credibility of the authenticated identity, it must first be verified. The user must first send an authorization request to the target platform server via their primary terminal to obtain the authorization information issued by the target platform for the authenticated identity. Then, the user uploads this authorization information to the authentication authority's server, which verifies it. This verification process may involve the authentication server calling the target platform's authentication interface to check the credibility of the authorization information.

[0089] After successful verification, the target user's identification information (such as platform ID, nickname, etc.) is irreversibly hashed to generate an identity index corresponding to the authenticated identity. The identity index is associated with the target user's identification information. Based on the identity index, the target user's identification information can be quickly determined to confirm the authenticated identity.

[0090] Next, the target user's real identity is verified to ensure its credibility. The first terminal uploads identity verification information to the authentication server, which includes at least the name, ID number, and mobile phone number. The authentication server verifies this information to achieve three-factor authentication. For example, the name and ID number are verified through an official database, and the mobile phone number is verified through a mobile carrier server.

[0091] Once the real identity is successfully verified, a certificate corresponding to the target user can be generated and sent to the first terminal. The certificate is associated with the identity index of the verified identity, including the certificate identifier, identity index, and certificate validity period, making it convenient to quickly obtain the identity information corresponding to the verified identity through the certificate.

[0092] In one optional embodiment, when verifying a mobile phone number, the authentication server sends a first verification code to the terminal where the mobile phone number is located. If the second verification code sent by the first terminal is successfully verified, a certificate is issued to the first terminal. If the second verification code matches the first verification code, the second verification code is considered verified. This improves the reliability of mobile phone number authentication.

[0093] In one alternative embodiment, the first terminal determines whether the certificate is valid based on the certificate's validity period, and if the certificate is valid, encrypts and generates a communication token.

[0094] It is understandable that certificates have an expiration date. Certificates become invalid when they are not within their validity period. Communication tokens can only be generated to achieve trusted communication when the certificate is within its validity period. Users need to authenticate their identity in a timely manner after the validity period expires before the certificate will be reissued to further improve the communication security of trusted communication.

[0095] In one optional embodiment, if the certificate expires, the identity authentication information is re-uploaded based on the certificate cached by the first terminal through offline verification or online authentication through the authentication server; if the offline verification or online authentication is successful, the certificate validity period is updated.

[0096] In addition to the initial certificate issuance for identity authentication, subsequent identity authentication can be performed not only by re-authenticating the re-uploaded identity authentication information through the authentication server, but also, in cases of network instability, by performing offline verification using the certificate cached on the first terminal (e.g., verifying whether the certificate identifier stored in the security chip matches the locally cached certificate identifier). This allows for updating the certificate's validity period after successful authentication, ensuring its continued use. Thus, secondary identity authentication can be achieved both online and offline. In one example, please refer to Figure 8 The following is a specific example illustrating the process of the first terminal applying for a certificate in this application.

[0097] STEP 1: First terminal (e.g.) Figure 8 After a user terminal logs into the application of the target platform, it can send a login authorization request (i.e., identity authorization request) to the self-media platform API (Application Programming Interface). The self-media platform API will return the user's consent (i.e., identity authorization information).

[0098] STEP2: The user terminal uploads its identity authorization information to the CHAKEN authentication platform (i.e., the authentication server). After the authentication server authenticates the identity, it generates an irreversible hash value based on the identity identifier information (such as the platform ID) to obtain the identity index corresponding to the authentication identity.

[0099] STEP 3: On the user's terminal, open the authentication and activation interface of the CHAKEN application. After checking the box to agree to the authorization statement, the user can upload the identity authentication information (i.e., the three elements of information (such as name, ID number and mobile phone number)) to the CHAKEN authentication platform, which will then perform real-name authentication.

[0100] STEP 4: The CHAKEN authentication platform uses the authentication authority's cryptographic machine (such as an HSM cryptographic machine (Hardware Security Module)) to implement encryption, and then calls the API of the preset database to implement real-name authentication (such as verifying whether the name and ID number exist in the database); it calls the operator's real-name authentication interface to implement real-name authentication of the mobile phone number, such as whether the real-name information of the mobile phone number is consistent with the name and ID number in the identity authentication information.

[0101] STEP 5: After the three elements of real-name authentication are passed, proceed with mobile phone verification.

[0102] STEP6 and STEP7: After both real-name authentication and verification code verification are successful, the authentication server can generate an identity activation credential (i.e., certificate). If real-name authentication or verification code verification fails, the authentication failure will be reported to the user terminal, and the user terminal will display an error message (such as real-name authentication failure, verification code error, etc.).

[0103] STEP8 and STEP9: Create encrypted mapping records based on identity authentication information and identity index, and sign them using the SM2 or SM4 algorithm. Store the mapping relationship between real-name information and authentication identity in the cryptographic machine to ensure the security of identity information.

[0104] STEP10 and STEP11: Send the certificate to the user terminal and store it in the user terminal's local security zone (such as in the user terminal's security chip) to activate the authentication identity while ensuring certificate security.

[0105] All of the above technical solutions can be combined in any way to form optional embodiments of this application, and will not be described in detail here.

[0106] In summary, this application has the following beneficial effects: (1) The identity index of the platform is used to bind the CHAKEN certificate, so as not to disclose the real mobile phone number to the third-party platform; the CA institution establishes the identity index in the HSM hardware cryptographic machine. The real-name encrypted mapping table (name + ID number + mobile phone number) complies with the traceability requirement of Article 25 of the Anti-Telecommunications Network Fraud Law.

[0107] (2) When communicating, a token is generated to forward the call. The original identity can only be traced by the CA (in compliance with the Personal Information Protection Law), which can avoid the risk of privacy leakage.

[0108] (3) CA authoritative certification + national cryptographic algorithm endorsement, eliminates false persona impersonation, has legal effect, can realize cross-platform certification, and the called party can verify whether it is a real person or AI agent.

[0109] (4) The completion of the three-factor real-name authentication complies with the reliable authentication standard of Article 13 of the Electronic Signature Law, which ensures the reliability of the authenticated identity, improves the trust level of the called party, and reduces the user rejection rate.

[0110] To facilitate better implementation of the trusted communication method of this application embodiment, this application embodiment also provides a trusted communication device. Please refer to... Figure 9 , Figure 9 A schematic diagram of the structure of a trusted communication device provided in an embodiment of this application. The trusted communication device 200 may include: The first verification module 201 is used to, when the first terminal calls the second terminal with an authenticated identity, encrypt and generate a communication token and upload it to the verification server, the verification server decrypts the communication token and performs trusted identity verification to obtain a first verification result, the communication token includes certificate information matching the authenticated identity, the certificate is issued by the certification authority after the authenticated identity is authenticated, and the verification server decrypts the communication token and performs trusted identity verification based on the certificate information; Call module 202 is used to forward a call request to the second terminal if the first verification result is successful. The second verification module 203 is used to request the verification server to perform trusted authentication of the communication token again when the second terminal receives the call request, so as to obtain a second verification result; Sending module 204 is used to send the identity information corresponding to the authenticated identity to the second terminal when the second verification result is successful; The display module 205 is used to display the incoming call interface on the second terminal, and the incoming call interface displays the identity information.

[0111] Each module or unit in the aforementioned trusted communication device can be implemented entirely or partially through software, hardware, or a combination thereof. Each unit can be embedded in or independent of the processor in the electronic device in hardware form, or stored in the memory of the electronic device in software form, so that the processor can call and execute the operations corresponding to each unit.

[0112] The trusted communication device 200 can be integrated into a terminal or server that has storage and a processor and thus computing power, or the trusted communication device 200 can be the terminal or server.

[0113] Optionally, this application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0114] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may be a terminal or a server. Figure 10As shown, the electronic device 300 includes a processor 301 with one or more processing cores, a memory 302 with one or more computer-readable storage media, and a computer program stored in the memory 302 and executable on the processor. The processor 301 and the memory 302 are electrically connected. Those skilled in the art will understand that the electronic device structure shown in the figures does not constitute a limitation on the electronic device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0115] The processor 301 is the control center of the electronic device 300. It connects various parts of the electronic device 300 through various interfaces and lines. By running or loading software programs and / or modules stored in the memory 302, and calling data stored in the memory 302, it executes various functions of the electronic device 300 and processes data, thereby performing overall processing of the electronic device 300.

[0116] Optional, such as Figure 10 As shown, the electronic device 300 also includes: a display screen 303, a radio frequency circuit 304, an audio circuit 305, an input unit 306, and a power supply 307. The processor 301 is electrically connected to the display screen 303, the radio frequency circuit 304, the audio circuit 305, the input unit 306, and the power supply 307. Those skilled in the art will understand that... Figure 10 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0117] The display screen 303 can be used to display a graphical user interface (GUI) and receive operation commands generated by the user interacting with the GUI. The display screen 303 may include a display panel and a touch panel. The display panel can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces of the electronic device. These graphical user interfaces can be composed of graphics, text, icons, video, and any combination thereof. The touch panel can be used to collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel), generate corresponding operation commands, and execute the corresponding program. Optionally, the touch panel may include a touch detection device and a touch controller. The touch detection device detects the user's touch location and the signal generated by the touch operation, and transmits the signal to the touch controller. The touch controller receives touch information from the touch detection device, converts it into touch point coordinates, sends it to the processor 301, and can receive and execute commands from the processor 301. The touch panel can cover the display panel. When the touch panel detects a touch operation on or near it, it transmits the information to the processor 301 to determine the type of touch event. Subsequently, the processor 301 provides corresponding visual output on the display panel according to the type of touch event. In this embodiment, the touch panel and the display panel can be integrated into the display screen 303 to achieve input and output functions. However, in some embodiments, the touch panel and the display screen 303 can be implemented as two independent components to achieve input and output functions. That is, the display screen 303 can also be used as part of the input unit 306 to achieve input functions.

[0118] The radio frequency circuit 304 can be used to transmit and receive radio frequency signals to establish wireless communication with network devices or other electronic devices, and to transmit and receive signals with network devices or other electronic devices.

[0119] Audio circuitry 305 can be used to provide an audio interface between a user and an electronic device via a speaker and a microphone. Audio circuitry 305 converts received audio data into electrical signals, transmits them to the speaker, and the speaker converts them into sound signals for output. Conversely, the microphone converts collected sound signals into electrical signals, which are then received by audio circuitry 305, converted back into audio data, and then processed by processor 301 before being transmitted via radio frequency circuitry 304 to, for example, another electronic device, or output to memory 302 for further processing. Audio circuitry 305 may also include an earphone jack to facilitate communication between peripheral headphones and electronic devices.

[0120] The input unit 306 can be used to receive input numbers, characters, or object feature information (such as fingerprints, irises, facial information, etc.), and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to user settings and function control.

[0121] Power supply 307 is used to supply power to various components of electronic device 300. Optionally, power supply 307 can be logically connected to processor 301 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. Power supply 307 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0122] although Figure 10 As not shown in the diagram, the electronic device 300 may also include a camera, sensor, wireless fidelity module, Bluetooth module, etc., which will not be described in detail here.

[0123] This application also provides a computer-readable storage medium for storing a computer program. This computer-readable storage medium can be applied to an electronic device, and the computer program causes the electronic device to execute corresponding processes in the trusted communication method described in the embodiments of this application; for brevity, these will not be elaborated further here.

[0124] This application also provides a computer program product including computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the corresponding processes in the trusted communication method described in the embodiments of this application. For the sake of brevity, further details are omitted here.

[0125] It should be understood that the processor in this application may be an integrated circuit chip with signal processing capabilities. In implementation, the steps of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor described above can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0126] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0127] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0128] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0129] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0130] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0131] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0132] In addition, the functional units in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0133] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer or a server) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0134] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A reliable communication method, characterized in that, include: When the first terminal calls the second terminal with an authenticated identity, the first terminal encrypts and generates a communication token and uploads it to the verification server. The verification server decrypts the communication token and performs trusted identity verification to obtain a first verification result. The communication token includes certificate information that matches the authenticated identity. The certificate is issued by the certification authority after the authenticated identity has been verified. If the first verification result is successful, the call request is forwarded to the second terminal; Upon receiving the call request, the second terminal requests the verification server to perform trusted authentication on the communication token again, and obtains a second verification result; If the second verification result is successful, the verification server sends the identity information corresponding to the authenticated identity to the second terminal; The second terminal displays an incoming call interface, which shows the identity information.

2. The trusted communication method according to claim 1, characterized in that, The first terminal encrypts and generates a communication token and uploads it to the verification server, including: The first terminal encrypts and generates a communication token and uploads it to the first operator server to which the first terminal belongs. The first operator server forwards the communication token to the verification server and receives the first verification result returned by the verification server.

3. The trusted communication method according to claim 1, characterized in that, The call request includes the token index of the communication token. Upon receiving the call request, the second terminal requests the verification server to perform trusted authentication of the communication token again, obtaining a second verification result, including: Upon receiving the call request, the second operator's server to which the second terminal belongs downloads the communication token from the verification server based on the token index; The second operator server requests the verification server to verify the communication token again to obtain a second verification result.

4. The trusted communication method according to claim 1, characterized in that, The communication token also includes an identity index corresponding to the authenticated identity. When the second verification result is successful, the verification server sends the identity information corresponding to the authenticated identity to the second terminal, including: If the second verification result is successful, the verification server sends the identity information corresponding to the identity index to the second operator server to which the second terminal belongs. The second operator server generates identity display information based on the information display method supported by the second terminal and the identity information and sends it to the second terminal. The identity display information includes at least the information related to the authenticated identity. The second terminal displays an incoming call interface, which shows the identity information, including: The second terminal issues an incoming call notification and displays the incoming call interface, which shows the identity information.

5. The trusted communication method according to claim 4, characterized in that, The information display method includes a first display method and a second display method. The first display method is a display method that supports rich media display, and the second display method is a display method that does not support rich media display. The identity display information corresponding to the first display method includes rich media information corresponding to the authenticated identity.

6. The trusted communication method according to claim 1, characterized in that, Also includes: The first terminal sends an identity authorization request of the target user to the target platform server to obtain identity authorization information, and uploads the identity authorization information to the authentication server corresponding to the authentication authority. The authentication server verifies the identity authorization information, and after the verification is successful, performs irreversible hash processing on the identification information of the target user to generate the identity index of the authenticated identity. The first terminal uploads identity authentication information to the authentication server. The identity authentication information includes at least a name, ID number, and mobile phone number. The authentication server performs identity authentication on the identity authentication information, and after successful authentication, generates a certificate corresponding to the target user and sends it to the first terminal. The certificate includes at least a certificate identifier, the identity index, and the certificate validity period.

7. The trusted communication method according to claim 6, characterized in that, The authentication server sends a first verification code to the terminal where the mobile phone number is located, and if the second verification code sent by the first terminal is successfully verified, the certificate is issued to the first terminal. When the second verification code is consistent with the first verification code, the second verification code is successfully verified.

8. The trusted communication method according to claim 1, characterized in that, The first terminal determines whether the certificate is valid based on the certificate's validity period, and if the certificate is valid, encrypts and generates the communication token.

9. The trusted communication method according to claim 1 or 8, characterized in that, Also includes: In the event that the certificate expires, the identity authentication information is re-uploaded based on the certificate cached by the first terminal through offline verification or online authentication through the authentication server. If offline verification or online authentication is successful, the certificate validity period is updated.

10. The trusted communication method according to claim 1, characterized in that, The communication token also includes a randomly generated random index value. When the verification server detects that the random index value of the communication token is the same as the random index value of any stored token, it determines that the first verification result is a verification failure.

11. An electronic device, characterized in that, include: A processor and a memory, wherein the memory stores a computer program, and the processor executes the trusted communication method according to any one of claims 1-10 by invoking the computer program stored in the memory.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted for loading by a processor to perform the trusted communication method as described in any one of claims 1-10.

Images