VoLTE voice encryption communication method, terminal and system

Abstract

The present invention discloses a VoLTE voice encryption communication method, terminal and system, which belongs to the technical field of wireless communication, and the method includes: a calling terminal and a called terminal complete identity authentication to their own encryption key management platform by the authentication encryption key stored in their corresponding security chips; the calling terminal starts a call and sends a verification request to a cloud encrypted session service management platform to obtain an encrypted session identifier returned by the cloud encrypted session service management platform; after connecting the call, the calling terminal and the called terminal play a prompt and apply for a session encryption key of the current call to their own encryption key management platform according to the encrypted session identifier; the calling terminal and the called terminal synchronize the encryption key acquisition state of the calling terminal and the called terminal through a media channel according to the session encryption key, and then make an encrypted voice call; when the call is hung up, both send an encryption end message to end the current encryption key call. The present invention does not require a certificate management module, has a fast calculation speed, high security, high synchronization efficiency, and good user experience.

Description

[Technical field]

[0001] The present invention relates to the technical field of wireless communication, and in particular to a VoLTE voice encryption communication method, terminal and system. [Background technology]

[0002] Voice over Long Term Evolution (VoLTE) is a voice service based on IP Multimedia Subsystem (IMS), an IP data transmission technology. VoLTE does not require 2G / 3G network, all services are included in 4G network, and it can realize shorter connection latency, higher quality, and more natural voice-video call effect. IMS itself provides a set of complex and more secure authentication and authorization mechanisms, but as malicious eavesdropping becomes more frequent, VoLTE needs special encryption mechanisms to ensure the security of its calls.

[0003] Currently, there are three main issues facing the realization of VoLTE voice encryption and subsequent mass adoption: First, the traditional VoLTE encryption provides a security mechanism that relies on certificates, and this function cannot be realized unless the terminal always installs the APP, so the VoLTE encryption key transmission process relies on the certificate security mechanism. Since the mechanism relies on mathematical calculations such as Pollard-Law factorization, there is a problem that the security gradually decreases with increasing frequency of use, and since the certificate mechanism involves end-to-end negotiation in the transmission and negotiation process of the session encryption key, there is also a problem with the supervision and management of the encryption key on the platform side.

[0004] Second, for the realization of VoLTE encrypted calls, the existing solution is an extended SIP protocol stack, which starts a call session process with preset conditions to support operations such as identifying encrypted calls, identifying non-encrypted / encrypted incoming calls, answering incoming calls, and controlling interoperability in connection states. For this purpose, it is necessary to search, verify and improve the IMS network across the entire network to ensure that the SIP extension field can be initially set to use a pass-through method, so that the terminal modem chips on both sides of the communication can identify and process the SIP extension field, and to customize and improve the terminal modem chip to support the SIP extension field and analyze and process the extension content. This solution requires improvements for mobile terminals, modules and IMS networks, and the amount of improvement is large and it is difficult to automatically update smoothly with the evolution of terminal versions.

[0005] Third, with the development of QKD network construction, each region has a need to build an encryption management system, and most encryption management systems realize the filling of security media within the system. However, in reality, VoLTE-based services have a need for wide-area switching of call services, and each independent encryption management system needs to have the function of negotiating encryption keys and transmitting session encryption keys. Therefore, it is necessary to integrate the security requirements of customers' own encryption system construction with the switching needs of the whole network, and improve the compatibility of VoLTE encryption services.

[0006] In the related art, the invention patent application of Publication No. CN114040385A discloses a system and method for encrypted calls based on VoLTE, the system includes a cloud encrypted session service management platform, an operator network and a mobile terminal assembly, the cloud encrypted session service management platform is for providing user management and certificate management based on VoLTE voice call service and distribution of session encryption keys, the operator network is for carrying and transmitting data between the cloud encrypted session service management platform and the mobile terminal, the mobile terminal assembly is for providing encrypted call function and encrypting and decrypting call data in real time during the call process. This solution can realize users to make VoLTE encrypted calls between carrier networks without improving the carrier's IMS network and extending the signaling control protocol SIP protocol. However, the cloud encrypted session service management platform only provides an API interface for the key management center client, and performs identity verification when a user logs in and sends the client's SM2 encryption certificate. The certificate management module still needs to call the API interface of the key management center to perform application, download and deletion management operations for the user's SM2 encryption certificate, and relies on the certificate security mechanism in the encryption key transmission process.

[0007] Invention patent application publication number CN106941403A discloses a quantum key-based secure mobile communication system and method, which includes a quantum key service station, a number of mobile terminals and a public communication network, the quantum key service station and the mobile terminals communicate with each other via the public communication network, the quantum key service station provides a quantum key download service to the mobile terminals to complete secure management of the quantum keys, the mobile terminals realize basic call functions and additional secure communication functions, and the public communication network realizes a data transmission function. The solution is an encrypted communication method in which a quantum key service station provides an encryption key, and in a specific embodiment, an electronic tag is used to perform a monitoring function for the encryption keys of both mobiles, and the mobile terminals of the sender and receiver perform identity authentication at the quantum key service station and download a shared quantum key with an electronic tag added, the quantum key is applied for in advance, when an encryption session is to be established, the sender transmits its electronic tag authentication information to reach the receiver via a public communication network, the receiver identifies the electronic tag and feeds back the receiver's electronic tag authentication information to the sender via a public communication network, and both parties perform tag authentication respectively, and after authentication is successful, the sender and receiver call the stored quantum keys to start secure communication. However, a tag system needs to be used in the communication exchange process, and the exchange process is complicated. Summary of the Invention [Problem to be solved by the invention]

[0008] The technical problem that the present invention aims to solve is how to solve the problem of relying on certificates in authentication by VoLTE mobile terminals. [Means for solving the problem]

[0009] The present invention achieves solving the above technical problems by the following technical means. In one aspect, the present invention provides a VoLTE voice encryption communication method, wherein a security chip is integrated in a calling terminal and a called terminal, respectively, and the method includes: Each of the calling terminal and the called terminal completes identity authentication to the encryption key management platform to which it belongs by using the authentication encryption key stored in the corresponding security chip; A calling terminal initiates a call, and the calling terminal and the called terminal send a verification request to a cloud encrypted session service management platform, thereby obtaining an encrypted session identifier returned by the cloud encrypted session service management platform; After the call is connected, the calling terminal and the called terminal play a prompt, and apply for a session encryption key of the call to the encryption key management platform to which they belong based on the encryption session identifier, and the session encryption key is distributed via a quantum key distribution network; the calling terminal and the called terminal synchronize the encryption key acquisition states of the calling terminal and the called terminal through a media channel based on the session encryption key, and then perform an encrypted voice call; The calling terminal and the called terminal send an encryption end message to end the current encryption key call.

[0010] In the present invention, a security chip is integrated in both the calling terminal and the called terminal, and the calling terminal and the called terminal complete identity authentication to the encryption key management platform to which they belong by using the authentication encryption key stored in the security chip integrated in each of them, and the encryption key management platform stores a session encryption key pair distributed via a quantum key distribution network, and the authentication and encryption key distribution by the VoLTE terminal are realized by a symmetric encryption key algorithm, and the certificate management module is not required, and the encryption call has the characteristics of faster calculation speed and higher security than the certificate system. And the encrypted call starts the process by VoLTE, and performs the encryption key negotiation process after connecting to the non-encrypted session, avoiding the encryption key negotiation being too early, avoiding the problem that the user answers the phone too early and the requirement for the encryption key negotiation is too high, and when the non-encrypted session is really started, a prompt sound is played first, and a real encryption session is performed until the encryption key negotiation is performed, so that the user only senses the encryption session, and the user experience is good. And the media channel after the connection is used as the encryption key status synchronization interface, so that the encryption key synchronization time can be synchronized by the media channel, improving the synchronization efficiency.

[0011] In addition, the calling terminal and the called terminal complete identity authentication to the encryption key management platform by the authentication encryption key stored in the corresponding security chip respectively; Each of the security chips obtains an identifier of an encryption key management platform to which it belongs; The calling terminal and the called terminal respectively call up the authentication encryption key stored in the corresponding security chip to complete identity authentication to the encryption key management platform to which they belong; The calling terminal and the called terminal upload the identifiers of the encryption key management platforms to which they belong and their terminal identifiers to the cloud encrypted session service management platform, so that the cloud encryption key service management platform generates and stores a correspondence table between the terminal identifiers and the encryption key management platform identifiers.

[0012] Further, a calling terminal initiates a call, and the calling terminal and the called terminal send a verification request to a cloud encrypted session service management platform to obtain an encrypted session identifier returned by the cloud encrypted session service management platform, The calling terminal and the called terminal report the calling number and the called number of the current call to the cloud encrypted session service management platform, so that the cloud encrypted session service management platform generates the encrypted session identifier of the current call according to the calling number and the called number; When the cloud encrypted session service management platform determines based on the comparison table that the encryption key management platform identifiers to which the calling terminal and the called terminal belong do not match, the calling terminal and the called terminal obtain the encrypted session identifier returned by the cloud encrypted session service management platform and the identifier of the encryption key management platform to which the other terminal belongs.

[0013] In addition, after the call is connected, the calling terminal and the called terminal play a prompt, and apply for a session encryption key for the call to the encryption key management platform to which they belong based on the encryption session identifier, and the session encryption key is distributed by a quantum key distribution system; the receiving terminal sends a first encryption key request to the encryption key management platform to which it belongs, and the encryption key management platform obtains an encryption key identifier from an encryption machine and returns it to the receiving terminal, and the first encryption key request includes the encryption session identifier and an identifier of the encryption key management platform to which the other end belongs; The receiving terminal pushes the encryption key identifier and the encrypted session identifier to the cloud encrypted session service management platform, whereby the cloud encrypted session service management platform pushes the encryption key identifier and the encrypted session identifier to the calling terminal; The calling terminal sends a second encryption key request to an encryption key management platform to which the calling terminal belongs, whereby the encryption key management platform returns the session encryption key to the calling terminal, and the second encryption key request includes the encryption key identifier and the encrypted session identifier.

[0014] Furthermore, the encryption key management platform obtains an encryption key identifier from the encryption machine and returns it to the receiving terminal, the encryption key management platform sends a first encryption key request to the encryption machine, so that the encryption machine initiates a second encryption key request to the QKD network to which it is connected based on the first encryption key request; information included in the first encryption key request includes the encryption session identifier, the calling number, the called number, and an identifier of the encryption key management platform to which the other end belongs; and information included in the second encryption key request includes an identifier of the encryption key management platform to which the other end belongs; The QKD network obtains a symmetric encryption key of one of the QKD nodes to which the calling terminal and the called terminal belong according to the second encryption key request, and returns the symmetric encryption key to the encryption machine; The encryptor returns the symmetric encryption key and an encryption key identifier to the called terminal via the encryption key management platform.

[0015] Furthermore, performing an encrypted voice call after the calling terminal and the called terminal synchronize the encryption key acquisition state of the calling terminal and the called terminal through a media channel based on the session encryption key, the calling terminal and the called terminal obtaining the session encryption key; The calling terminal and the called terminal synchronize notification information obtained by the encryption key to the cloud encrypted session service management platform, so that the cloud encrypted session service management platform passes through the notification information to the calling terminal and the called terminal to complete synchronization of the encryption key acquisition state.

[0016] Furthermore, when at least one of the calling terminal and the called terminal is a SIP terminal that delivers a cipher session participation identifier in response to a SIP extension field request, the method further comprises: The cloud encrypted session service management platform and the IMS network complete a user synchronization interface and a encrypted session identifier push interface; The cloud encrypted session service management platform or the IMS network generates the encrypted session identifier, and the IMS network sends the corresponding encrypted session identifier to the SIP terminal, the SIP terminal including an encryption key middleware and a voice middleware; The voice middleware obtains an encrypted session identifier processed by a baseband chip, and calls the encryption key middleware to apply to the encryption key management platform to obtain the session encryption key.

[0017] The present invention further provides a VoLTE voice encryption communication terminal, the terminal being provided with a security chip and an intermediate assembly, the security chip storing an authentication encryption key, the intermediate assembly including encryption key middleware, service middleware and voice middleware; The encryption key middleware is for completing identity authentication to the encryption key management platform to which it belongs by using the authentication encryption key stored in the security chip; the service middleware requests to log in to a cloud encrypted session service management platform; and the voice middleware is self-launched; The service middleware is for obtaining an encrypted session identifier returned by the cloud encrypted session service management platform by sending a verification request to the cloud encrypted session service management platform after both parties start a call, and for calling the encryption key middleware to apply for a session encryption key of the current call to the encryption key management platform to which it belongs based on the encrypted session identifier after the terminal plays a prompt sound after connecting to the call, and the session encryption key is distributed via a quantum key distribution network; the encryption key middleware is for transmitting the session encryption key to the voice middleware, and performing a voice call in which both sides of the call are encrypted after the voice middleware completes synchronization of encryption key acquisition states of both sides of the call via a media channel; After hanging up the call, the voice middleware transmits an encryption end message to end the current encryption key call.

[0018] The service middleware further comprises a UI display module, an encrypted session notification module, an encrypted session identifier synchronization module, and an encryption key negotiation initiation module; The UI display module is for displaying, in cooperation with the cloud encrypted session service management platform, judgment information for making a user contract, notification and identifier synchronization information for the current encrypted session, and an encryption key negotiation status for starting the current encrypted session; The encrypted session notification module is for interacting with an interface of the cloud encrypted session service management platform; The encrypted session identifier synchronization module is for obtaining the encrypted session identifier and the acquisition status of the other end returned by the cloud encrypted session service management platform after the cloud encrypted session service management platform determines that both sides of the call have encrypted session call qualifications and conditions, and completing the transmission and synchronization of the encrypted session identifier; The encryption key negotiation initiation module is for initiating an encryption key request to the encryption key middleware based on the encryption key identifier after completing synchronization of the encryption key identifier, and obtaining a corresponding encryption key negotiation status.

[0019] The encryption key middleware further comprises an external service interface, a general-purpose cryptographic service module, and a cryptographic device service module; The external service interface is for connecting to an external application in the manner of inter-process communication; The general-purpose cryptographic service module is for providing cryptographic key management, identity authentication and cryptographic key calculation interface; The cryptographic device service module is for obtaining an authentication encryption key stored in the security chip.

[0020] Further, the voice middleware comprises a voice interception module, a voice speed selection module, a voice encryption module and a voice backhaul module; The voice interception module is for intercepting a voice digital channel in a current terminal system, and intercepting and backhauling voice call data; The voice speed selection module is for receiving and detecting the voice call data transmitted by the voice interception module to obtain AMR payload data; The voice encryption module is for processing encryption keys, negotiating session encryption key status, and encrypting / decrypting and transmitting voice data; The voice backhaul module is for transmitting the AMR payload data to the voice encryption module in a single-frame manner, and backhauling the voice encryption data processed by the voice encryption module to the voice speed selection module.

[0021] The present invention further provides a VoLTE voice encryption communication system, the system comprising: a quantum key distribution network, a calling terminal, a called terminal, a first encryption key management platform, a second encryption key management platform, a first encryption machine, a second encryption machine, a cloud encrypted session service management platform and an operator network; A security chip is integrated into each of the calling terminal and the called terminal, and an authentication encryption key is stored in the security chip; the calling terminal connects to the first encryption key management platform, the called terminal connects to the second encryption key management platform, the first encryption key management platform accesses the quantum key distribution network through the first cryptographic machine, the second encryption key management platform accesses the quantum key distribution network through the second cryptographic machine, and the calling terminal and the called terminal respectively access the cloud encrypted session service management platform via the carrier network; An intermediate assembly is provided in each of the calling terminal and the called terminal, the intermediate assembly includes an encryption key middleware, a service middleware and a voice middleware, the encryption key middleware connects to the first encryption key management platform or the second encryption key management platform, the service middleware connects to the cloud encrypted session service management platform, and the voice middleware connects to a lower layer data transmission channel; The encryption key middleware is for completing identity authentication to the encryption key management platform to which it belongs by the authentication encryption key stored in the corresponding security chip, the service middleware requests to log in to the cloud encrypted session service management platform, and the voice middleware is self-launched; After a calling terminal initiates a call, the service middleware sends a verification request to a cloud encrypted session service management platform to obtain an encrypted session identifier returned by the cloud encrypted session service management platform; After the call is connected, the calling terminal and the called terminal play a prompt, and the service middleware calls the encryption key middleware to apply for a session encryption key for the current call from the encryption key management platform to which it belongs based on the encryption session identifier, and the session encryption key is distributed via a quantum key distribution network; the encryption key middleware transmits the session encryption key to the voice middleware, and after the voice middleware completes synchronization of the encryption key acquisition states of the calling terminal and the called terminal via a media channel, the calling terminal and the called terminal perform an encrypted voice call; After hanging up the call, the voice middleware sends an encryption end message to end the current encryption key call. Effect of the Invention

[0022] The advantages of the present invention are as follows: First, in the present invention, a security chip is integrated in both the calling terminal and the called terminal, and the calling terminal and the called terminal complete identity authentication to the encryption key management platform to which they belong by using the authentication encryption key stored in the security chip integrated in each of them, and the encryption key management platform stores a session encryption key pair distributed via a quantum key distribution network, and the authentication and encryption key distribution by the VoLTE terminal are realized by a symmetric encryption key algorithm, and the certificate management module is not required, and the encryption call has the characteristics of faster calculation speed and higher security than the certificate system. And the encrypted call starts the process by VoLTE, and performs the encryption key negotiation process after connecting to an unencrypted session, avoiding the encryption key negotiation being too early, avoiding the problem that the user answers the phone too early and the requirements for the encryption key negotiation are too high, and when the unencrypted session is really started, a prompt of one section is first played, and a real encryption session is performed until the encryption key negotiation is performed, so that the user only senses the encryption session, and the user experience is good. And the media channel after the connection is used as the encryption key status synchronization interface, so that the encryption key synchronization time can be synchronized by the media channel, improving the synchronization efficiency.

[0023] Secondly, the present invention can complete an end-to-end implementation from the perspective of the terminal internal processing process, the cloud encrypted session service management platform, the encryption key management platform and the corresponding quantum key distribution network.

[0024] Thirdly, the present invention can realize the VoLTE exchange problem in encryption key exchange between different encryption key management platforms in two QKD nodes.

[0025] Fourth, both SIP terminals and non-SIP terminals can use the solution of the present invention, and the two types of terminals can be implemented without modification, which is easy to implement.

[0026] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. [Brief description of the drawings]

[0027] [Figure 1] 2 is a flowchart of a VoLTE voice encryption communication method according to a first embodiment of the present invention. [Diagram 2] FIG. 4 is a schematic diagram of a subdivision step of step S10 according to the first embodiment of the present invention. [Diagram 3] FIG. 4 is a schematic diagram of a subdivision step of step S20 according to the first embodiment of the present invention. [Figure 4] FIG. 4 is a schematic diagram of a subdivision step of step S30 according to the first embodiment of the present invention. [Diagram 5] FIG. 4 is a schematic diagram of a subdivision step of step S40 according to the first embodiment of the present invention. [Figure 6] FIG. 2 is a structural schematic diagram of a VoLTE voice encryption communication terminal according to a second embodiment of the present invention; [Figure 7] FIG. 11 is a schematic connection diagram of an intermediate assembly according to a second embodiment of the present invention. [Figure 8] FIG. 4 is a structural schematic diagram of a VoLTE voice encryption communication system according to a third embodiment of the present invention; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] In order to make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention are described below in a clear and complete manner through the embodiments of the present invention, and obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, any other embodiments obtained by a person skilled in the art without inventive efforts are all within the protection scope of the present invention.

[0029] Referring to FIG. 1, a first embodiment of the present invention provides a VoLTE voice encryption communication method, in which a security chip is integrated in a calling terminal and a called terminal respectively, and the method includes the following steps. S10: the calling terminal and the called terminal complete identity authentication to the encryption key management platform to which they belong by using the authentication encryption key stored in the corresponding security chip; In addition, each encryption key management platform realizes the filling of the security chip connected thereto through the filling function, and the calling terminal and the called terminal respectively obtain the filled encryption key. The filled encryption key is used as the authentication encryption key, and there is no correlation between the filled encryption keys. In this embodiment, the security chip preset encryption key is used as the authentication encryption key, so as to solve the problem of relying on certificates in authentication by VoLTE mobile terminals, and to realize the function of primary authentication and primary encryption key.

[0030] S20: A calling terminal initiates a call, and the calling terminal and the called terminal send a verification request to a cloud encrypted session service management platform, thereby obtaining an encrypted session identifier returned by the cloud encrypted session service management platform; In addition, when both the calling and receiving parties start a call, and the receiving terminal starts to ring, the calling terminal and the receiving terminal apply to the cloud encrypted session service management platform for verification of both parties' contract information. The cloud encrypted session service management platform determines whether both parties have subscribed to the encrypted session service according to the records in its service system. After completing the verification, it generates a unique identifier for this call, i.e., an encrypted session identifier, based on the accounts of both the calling and receiving parties and sends it to the calling terminal and the receiving terminal.

[0031] S30 After the call is connected, the calling terminal and the called terminal play a prompt, and apply for a session encryption key for the call to the encryption key management platform to which they belong based on the encryption session identifier, and the session encryption key is distributed via the quantum key distribution network; In addition, in order to avoid both the calling and receiving terminals being performed in advance in the unencrypted session mode, the calling terminal and the receiving terminal play a prompt sound for encryption key negotiation before performing the unencrypted session mode, and both terminals are temporarily unable to talk. Then, based on the encrypted session identifier, they apply for the session encryption key for the current call to the encryption key management platform to which they belong. The encryption key management platform applies for the session encryption key for the current call to the encryption machines connected to each of them. The quantum keys stored in the encryption machines are distributed via the quantum key distribution network, i.e., they are used as the session encryption key for the current call.

[0032] S40, the calling terminal and the called terminal synchronize the encryption key acquisition state of the calling terminal and the called terminal through the media channel based on the session encryption key, and then perform an encrypted voice call; In addition, by using the connected media channel as an encryption key state synchronization interface, it is possible to synchronize the encryption key synchronization time using the media channel, thereby improving synchronization efficiency. When the calling terminal and the called terminal start to perform an encrypted voice call, the voice is intercepted and voice data that meets the conditions is encrypted and transmitted.

[0033] S50: The calling terminal and the called terminal transmit an encryption end message to end the current encryption key communication.

[0034] When the calling terminal and the called terminal hang up the phone, they send an encrypted call end message, and both end the encrypted key call.

[0035] In this embodiment, the calling terminal and the called terminal are both integrated with a security chip, and the calling terminal and the called terminal complete identity authentication to the encryption key management platform to which they belong by using the authentication encryption key stored in the security chip integrated in each of them, and the encryption key management platform stores a session encryption key pair distributed via a quantum key distribution network, and the authentication and encryption key distribution by the VoLTE terminal are realized by a symmetric encryption key algorithm, and the certificate management module is not required, and the encryption call has the characteristics of faster calculation speed and higher security than the certificate system. And the encrypted call starts the process by VoLTE, and performs the encryption key negotiation process after connecting to the non-encrypted session, avoiding the encryption key negotiation being too early, avoiding the problem that the user answers the phone too early and the requirements for the encryption key negotiation are too high, and when the non-encrypted session is really started, a prompt sound is first played, and a real encryption session is performed until the encryption key negotiation is performed, so that the user only senses the encryption session, and the user experience is good. And the media channel after the connection is used as the encryption key status synchronization interface, so that the encryption key synchronization time can be synchronized by the media channel, improving the synchronization efficiency.

[0036] Furthermore, in the encryption key loading step of the present invention, the encryption key is directly loaded into the security chips of both the sender and the receiver as an authentication encryption key by the encryption key management platform, regardless of the authentication encryption key stored in both the sender and the receiver. Its main role is to realize identity authentication of both the sender and the receiver to the encryption key management platform through the encryption key stored in each chip, and to realize the primary authentication and primary encryption key of identity authentication. During the voice communication stage, when both the sender and the recipient apply for the current communication encryption key, the encryption key management platform will use a new encryption key in the security chips of both the sender and the recipient as the protection encryption key to send the session encryption key. The plaintext of the session encryption key is the same, but the authentication encryption keys stored in the security chips of both the sender and the recipient are different, so the encrypted text of the encryption key obtained by both the sender and the recipient do not match, providing the function of primary authentication and primary encryption key to send the session encryption key. The entire process does not use a tag system, omits the exchange process, and does not require the encryption keys of both the sender and the recipient to be the same throughout the process. This realizes the de-coupling of the root encryption key filled in the security chips of the sender and the recipient and the session encryption key required for actual voice communication, providing higher adaptability and better adapting to actual service conditions.

[0037] In one embodiment, referring to FIG. 2, said step S10 includes the following subdivision steps: S11: each of the security chips obtains an identifier of the encryption key management platform to which it belongs; In addition, each encryption key management platform uses a charging function to realize charging of the security chip connected to it, and during the charging process, the identifier of the encryption key management platform is written into the security chip connected to it, and this identifier is unique in the quantum key distribution QKD network.

[0038] S12: The calling terminal and the called terminal respectively access the authentication encryption key stored in the corresponding security chip to complete identity authentication to the encryption key management platform to which they belong; In addition, when the terminal is started, it calls the authentication encryption key stored in the encryption key in the security chip to complete the login authentication to the encryption key management platform to which it belongs, and the terminal also provides encryption key services to the outside.

[0039] S13: The calling terminal and the called terminal upload the identifiers of the encryption key management platforms to which they belong and their terminal identifiers to the cloud encrypted session service management platform, so that the cloud encryption key service management platform generates and stores a correspondence table between the terminal identifiers and the encryption key management platform identifiers. In addition, the cloud encrypted session service management platform stores the correspondence between the user terminal and each encryption key management platform as a user resource information base to which multiple encryption key management platforms connect, and provides an encryption key negotiation query service between the encryption key management platforms, thereby adapting to the VoLTE service exchange problem among multiple encryption key platforms in the QKD network.

[0040] In one embodiment, referring to FIG. 3, step S20 includes: The calling terminal and the called terminal report the calling number and the called number of the current call to the cloud encrypted session service management platform, so that the cloud encrypted session service management platform generates the encrypted session identifier of the current call based on the calling number and the called number (S21); If the cloud encrypted session service management platform determines based on the comparison table that the encryption key management platform identifiers to which the calling terminal and the called terminal belong do not match, the calling terminal and the called terminal obtain the encrypted session identifier returned by the cloud encrypted session service management platform and the identifier of the encryption key management platform to which the other terminal belongs (S22).

[0041] In addition, the calling terminal and the called terminal report the calling and receiving numbers of the current call to the cloud encrypted session service management platform, and the cloud encrypted session service management platform determines whether the current call has the conditions to enter an encrypted session according to the contract status of the encrypted sessions of both the calling and called terminals; the cloud encrypted session service management platform checks the most recent login status of both the calling and called terminals; if it finds that both statuses are normal, it generates an encrypted session identifier for the current call based on the calling and called terminal numbers, and checks the identifiers of the encryption key management platforms to which both terminals belong based on the comparison table; if they are not consistent, the cloud encrypted session service management platform returns the encryption key platform identifier and encrypted session identifier to which the other end belongs to to this terminal.

[0042] The acquisition of the encryption session identifier in this embodiment can meet the VoLTE service exchange problem of multiple encryption key platforms in a QKD network, because the service identifier cannot directly replace the encryption key identifier in multiple encryption key management platforms.

[0043] In one embodiment, referring to FIG. 4, step S30 includes: the receiving terminal sends a first encryption key request to the encryption key management platform to which it belongs, and the encryption key management platform obtains an encryption key identifier from an encryption machine and returns it to the receiving terminal, the first encryption key request including the encryption session identifier and an identifier of the encryption key management platform to which the other terminal belongs; In addition, the receiving terminal is generally regarded as the active side, and requests an encryption key from the encryption key management platform to which it belongs based on parameters (platform identifier to which the other terminal belongs, encryption session identifier) ​​S31; The called terminal pushes the encryption key identifier and the encrypted session identifier to the cloud encrypted session service management platform, whereby the cloud encrypted session service management platform pushes the encryption key identifier and the encrypted session identifier to the calling terminal S32; and the calling terminal sending a second encryption key request to the encryption key management platform to which it belongs, so that the encryption key management platform returns the session encryption key to the calling terminal, and the second encryption key request includes the encryption key identifier and the encrypted session identifier S33.

[0044] In addition, in the case of a single encryption key management platform, since the generation of the encryption keys is performed by one platform, the encryption session identifier can be directly used as the encryption key identifier to complete the acquisition of both encryption keys, and both the sender and the receiver can obtain the encryption key from the same encryption key management platform using the encryption session identifier. However, in the case of multiple encryption key management platforms, since the encryption key management platform mainly completes the negotiation of both encryption keys by providing an encryption key interface via the QKD network, an encryption key identifier is returned when an encryption key is negotiated, and the encryption key identifier can be obtained from the encryption key application active side, but the other side cannot uniquely identify an encryption key with the same encryption session identifier, and the synchronization of the encryption keys cannot be realized.

[0045] However, in this embodiment, the encryption key identifier after the remote negotiation of the encryption key by QKD is associated with the encryption session identifier for the current VoLTE call, thereby solving the encryption key distribution problem in multiple encryption key management platforms and truly realizing encryption key synchronization.

[0046] In one embodiment, in the step S31, the encryption key management platform obtains an encryption key identifier from the encryption machine and returns it to the receiving terminal, the encryption key management platform sends a first encryption key request to the encryption machine, so that the encryption machine initiates a second encryption key request to the QKD network to which it is connected based on the first encryption key request; information included in the first encryption key request includes the encryption session identifier, the calling number, the called number, and an identifier of the encryption key management platform to which the other end belongs; and information included in the second encryption key request includes an identifier of the encryption key management platform to which the other end belongs; The QKD network obtains a symmetric encryption key of one of the QKD nodes to which the calling terminal and the called terminal belong according to the second encryption key request, and returns the symmetric encryption key to the encryption machine; The encryptor returns the symmetric encryption key and an encryption key identifier to the called terminal via the encryption key management platform.

[0047] In addition, this embodiment can complete an end-to-end example from the perspective of the terminal internal processing process, the cloud encrypted session service management platform, the encryption key management platform and the corresponding quantum key distribution network, and can realize the VoLTE exchange problem in encryption key exchange between different encryption key management platforms in two QKD nodes.

[0048] In one embodiment, referring to FIG. 5, step S40 includes: S41, in which the calling terminal and the called terminal obtain the session encryption key; and The calling terminal and the called terminal synchronize notification information obtained by the encryption key to the cloud encrypted session service management platform, so that the cloud encrypted session service management platform passes through the notification information to the calling terminal and the called terminal to complete synchronization of the encryption key acquisition state.

[0049] In addition, in some scenarios, after both the calling and called parties obtain the relevant encryption keys, the user may wish to enter an encryption session upon connecting to the phone, rather than connecting to the phone and then delivering the encryption key, thereby improving the user's experience of the VoLTE encryption session. This embodiment can realize an optimized implementation of synchronizing encryption keys independent of media information streams through the terminal push mechanism, and can realize synchronization of encryption key acquisition states in the same encryption key platform and different encryption key platforms of both parties in the call, with a certain adaptability.

[0050] Furthermore, in some scenarios, there is a solution in which a customized terminal (SIP terminal) that requires delivery of an encryption session participation identifier based on a SIP extension field and a customized terminal (non-SIP terminal) that does not rely on a SIP extension field coexist. The main difference between the two customized terminals is that the SIP-based terminal improves the module side to realize the processing ability of the SIP extension field, and they are the same in that they have similar encryption key middleware and voice middleware structures to realize encryption key negotiation and voice encryption / decryption. Therefore, once the cloud management platform and the IMS complete the connection with the service AS (service authorization platform) that is responsible for the delivery of the encryption key identifier, the VoLTE exchange function without modifying the terminal can be realized, and this solution has the characteristic of being easy to implement without modifying the two existing types of terminals. Specific implementation steps include: (1) The IMS Assembly service AS (service authorization platform) responsible for delivering the encryption key identifier and the cloud encryption session service management platform complete the user synchronization interface and the encryption session identifier push interface; (2-1) In the first type of scenario, one of the two parties in the call is a SIP terminal, and the SIP terminal is the caller; After the caller initiates a call, the call request is sent to a service AS (service authorization platform) where the IMS network is responsible for delivering the encryption key identifier, and the AS queries a local synchronization database to determine the type of the account terminal, and if the encrypted session participation conditions are met, generates a corresponding encrypted session identifier and sends the identifier to a cloud encrypted session service management platform, which pushes the encrypted session identifier to the other terminal, and continues to send the encrypted session identifier via the AS in the case of a SIP terminal to complete the encrypted session participation.

[0051] (2-2) In the second scenario, the SIP terminal is the receiving party, and the calling party starts a call normally. The other end is queried by the cloud encrypted session service management platform, and the other end is a SIP terminal. The cloud encrypted session service management platform generates an encrypted session identifier and pushes the corresponding encrypted session identifier to a service AS (service authorization platform) in which the IMS network is responsible for delivering the encryption key identifier, and the AS sends the corresponding encrypted session participation identifier to the corresponding SIP extension plan terminal to complete the encrypted session participation.

[0052] (3) After sending the encrypted session identifier, the SIP terminal transmits the encrypted session participation identifier after being processed by the baseband chip to the voice middleware, and the voice middleware calls the encryption key middleware to obtain the encryption key from the encryption key management platform based on the encrypted session participation identifier. For non-SIP-based extended fields, the service middleware pushes the encryption session participation identifier to the encryption key middleware to achieve the acquisition of the encryption key.

[0053] (4) Both the sending and receiving parties complete obtaining the encryption key through the encryption key middleware, and realize the voice encryption function according to the process of steps S40 to S50.

[0054] Also, referring to FIG. 6 to FIG. 7, a second embodiment of the present invention provides a VoLTE voice encryption communication terminal, in which a security chip 4 and an intermediate assembly are provided in the terminal, an authentication encryption key is stored in the security chip 4, and the intermediate assembly includes an encryption key middleware 3, a service middleware 1, and a voice middleware 2; The encryption key middleware 3 is for completing identity authentication to the encryption key management platform to which it belongs by the authentication encryption key stored in the security chip 4, the service middleware 1 requests to log in to a cloud encrypted session service management platform, and the voice middleware 2 is self-launched; The service middleware 1 is for obtaining an encrypted session identifier returned by the cloud encrypted session service management platform by sending a verification request to the cloud encrypted session service management platform after both parties start a call, and for calling the encryption key middleware to apply for a session encryption key of the current call to the encryption key management platform to which it belongs based on the encrypted session identifier after the terminal plays a prompt sound after connecting to the call, and the session encryption key is distributed via a quantum key distribution network; the encryption key middleware 3 is for transmitting the session encryption key to the voice middleware, and performing a voice call in which both sides of the call are encrypted after completing synchronization of encryption key acquisition states of both sides of the call by the voice middleware 2 through a media channel; After the call is ended, the voice middleware 2 transmits an encryption end message to end the current encryption key call.

[0055] In this embodiment, entity authentication is realized between three middlewares inside the terminal using an encryption key in the security chip, rather than a public / private key between the middlewares and from the middleware to the platform, thereby realizing primary authentication and primary encryption key, and having the characteristic of fast authentication speed.

[0056] Specifically, the encryption key middleware is for exchanging with the security chip integrated in the terminal, and supports multiple channel protocols to realize the reading and operation of encryption keys in different types of security chips. Since the security chip is often single-channel, it is necessary for the encryption key middleware to have an external unified service function, and can complete the functions of application authorization, access control, scheduling and the like of the application to be accessed. At the same time, the encryption key middleware can also complete the functions of identity authentication, encryption key negotiation, session encryption key acquisition, encryption and destruction based on the encryption key management platform and the security chip, and realize the unified management and service of encryption security functions by the middleware.

[0057] The service middleware communicates with a cloud encrypted session service management platform to complete the functions of notifying a VoLTE encrypted session, synchronizing an encrypted session identifier, and calling an encryption middleware to complete the negotiation of an encryption key. In a middleware initialization stage, the service middleware can complete the function of filling a platform identifier into a security chip and reporting it, and the cloud encrypted session service management platform can establish a correspondence between a global user and an encryption key management platform based on the reported information.

[0058] The service middleware can feed back the current call progress according to the call process state, and at the same time, the service middleware is further located in the mobile phone in the manner of an independent process, self-launched when started, and maintains the process from being rejected by the mobile phone system.

[0059] The voice middleware runs in the mobile phone middleware in the manner of an independent process, and mainly completes interactions with the lower-layer voice processing and transmission modules of the mobile phone, realizes blocking of the silent detection mechanism and blocking of the recording function during encrypted calls, eavesdrops on the voice call status at the lower layer of the mobile phone system, and can call the encryption operation interface provided by the encryption middleware to realize the encryption and decryption function of the voice stream.

[0060] In one embodiment, referring to FIG. 6, the service middleware includes a UI display module, an encrypted session notification module, an encrypted session identifier synchronization module, and an encryption key negotiation initiation module; The UI display module is for displaying, in cooperation with the cloud encrypted session service management platform, judgment information for making a user contract, notification and identifier synchronization information for the current encrypted session, and an encryption key negotiation status for starting the current encrypted session; The encrypted session notification module is for interacting with an interface of the cloud encrypted session service management platform; The encrypted session identifier synchronization module is for obtaining the encrypted session identifier and the acquisition status of the other end returned by the cloud encrypted session service management platform after the cloud encrypted session service management platform determines that both sides of the call have encrypted session call qualifications and conditions, and completing the transmission and synchronization of the encrypted session identifier; The encryption key negotiation initiation module is for initiating an encryption key request to the encryption key middleware based on the encryption key identifier after completing synchronization of the encryption key identifier, and obtaining a corresponding encryption key negotiation status.

[0061] Specifically, the UI display module is for performing UI display of each stage in the process of establishing an encrypted session, and mainly includes displaying a plurality of processes such as displaying judgment information for making a user contract in cooperation with a cloud encrypted session service management platform, displaying notification and identifier synchronization information of the current encrypted session, and displaying the encryption key negotiation status for starting the current encrypted session.

[0062] The crypto session notification module interacts with a cloud crypto session service management platform interface to realize the functions of determining crypto session contract entitlements for both the outgoing and incoming crypto session, determining the current network statuses of both, and pushing messages to the cloud crypto session service management platform.

[0063] The encrypted session identifier synchronization module is for the cloud encrypted session service management platform to generate an identifier for this call and push it to the service middleware after the cloud encrypted session service management platform determines that both sides have the qualifications and conditions for an encrypted session call, and the service middleware obtains the acquisition status of the other end through the cloud encrypted session service management platform, and completes the sending and synchronization of the encrypted session identifier. This interface is mainly used for user VoLTE calls between multiple encryption key management platforms, and users in the same encryption key platform do not need this function before.

[0064] The encryption key negotiation initiation module is for, after completing an encryption key identifier synchronization interface, the service middleware initiates an encryption key application request to the encryption key middleware through the identifier to obtain a corresponding encryption key negotiation status.

[0065] In one embodiment, referring to FIG. 6, the encryption key middleware comprises an external service interface, a general-purpose cryptographic service module, and a cryptographic device service module; The external service interface is for connecting to an external application in the manner of inter-process communication; The general-purpose cryptographic service module is for providing cryptographic key management, identity authentication and cryptographic key calculation interface; The cryptographic device service module is for obtaining an authentication encryption key stored in the security chip.

[0066] Specifically, the external service mainly includes functions such as authorization, access control, and process communication of external applications, to realize secure access of external applications, and the external applications access the encryption key middleware in the manner of inter-process communication.

[0067] The general-purpose cryptographic service module mainly includes cryptographic key management, identity authentication, and cryptographic key operation interface, and provides cryptographic key services to external applications.

[0068] Specifically, the encryption key middleware obtains the encryption key in the security chip through the encryption device service interface during the startup process, and uses one of the encryption keys in the security chip as the authentication encryption key to complete identity authentication to the encryption key management platform. The entire authentication process realizes the primary authentication and primary encryption key in the authentication process based on the secondary identity authentication mechanism specified in the 15843.2 standard, thereby avoiding the problems of complex authentication and large calculation volume required by the certificate system.

[0069] The service middleware completes the basic encryption session identifier synchronization and transmits it to the encryption key middleware through the external interface of the encryption key middleware. The encryption key middleware uses the encryption session identifier and the calling and receiving numbers as encryption key identifiers to apply for a corresponding session encryption key from the encryption key management platform, thereby achieving the application and acquisition of the current call session encryption key.

[0070] The encryption device service module mainly realizes device management of the security chip, card capacity, file application management, encryption key management, and operation interface invocation.

[0071] In one embodiment, referring to FIG. 6, the voice middleware comprises: a voice interception module, a voice speed selection module, a voice encryption module, and a voice backhaul module; The voice interception module is for intercepting a voice digital channel in a current terminal system, and intercepting and backhauling voice call data; The voice speed selection module is for receiving and detecting the voice call data transmitted by the voice interception module to obtain AMR payload data; The voice encryption module is for processing encryption keys, negotiating session encryption key status, and encrypting / decrypting and transmitting voice data; The voice backhaul module is for transmitting the AMR payload data to the voice encryption module in a single-frame manner, and backhauling the voice encryption data processed by the voice encryption module to the voice speed selection module.

[0072] Specifically, the voice intercepting module is mainly for intercepting the voice digital channel in the current mobile phone system, and for intercepting and backhauling the voice call data.

[0073] The voice speed selection module is for receiving and detecting the voice call data sent from the voice data interception module, and for the voice call data, it can perform data processing on the VoLTE voice data according to the VoLTE voice quality setting rule, and theoretically can realize processing of VoLTE voice data with different code rates to adapt to different network environments, and for obtaining AMR payload data for the voice data that meets the conditions, and pushing the AMR payload data to the voice backhaul module. According to the 3GPP protocol, the AMR payload data that meets the conditions is pushed to the voice backhaul module, and other voice data that does not meet the requirements is returned to the voice digital channel of the mobile phone.

[0074] The voice backhaul module is for transmitting the AMR payload data to the negotiation encryption module in real time in a single-frame manner, receiving the VoLTE voice encryption data processed by the negotiation encryption module, and backhauling it to the voice speed selection module.

[0075] The voice encryption module is responsible for processing encryption keys, negotiating session encryption key status, and encrypting / decrypting, transmitting / receiving voice data.

[0076] Specifically, the encryption key processing function mainly involves the voice middleware realizing a session encryption key through interaction with the encryption key middleware, the session encryption key being protected by an encryption method, and the encryption key processing function completing the processing of the session encryption key and ciphertext data to initialize the encryption environment.

[0077] The session encryption key negotiation includes the following: After completing the acquisition of the session encryption key, both sides of the call need to send a voice information related to this encryption session identifier through the voice digital channel of the existing system, and receive the reply information of the other side through the voice speed selection module. When the reply information of the other side is selected, it is explained that both voice data are transmitted in the operator VoLTE environment, the AMR payload rates of both are matched, and at the same time, the other side has also completed the session encryption key negotiation according to the requirements of the encryption session establishment command and prepared the session encryption key of the encrypted call. If the reply information of the other side is not selected, it is indicated that one side is not located in the VoLTE environment or fails to acquire the session encryption key, the AMR payload rate does not match, and the negotiation of the encrypted call has failed. If the negotiation is successful, it enters into the encryption of the voice data.

[0078] The encryption / decryption of the voice data includes: after both initiators complete the negotiation of the session encryption key, the voice backhaul module transmits the VoLTE voice data; the encryption module has a function of self-adapting to the VoLTE coding rate; and within the entire life cycle of the data encryption / decryption, for the uplink / downlink voice data stream, the encryption / decryption module constructs data encryption / decryption start and end messages to realize encryption / decryption state control and synchronization.

[0079] The encryption terminal in this embodiment has the services provided for VoLTE encryption, encryption keys, functional features of voice middleware and similar programs in the terminal to ensure the implementation of the VoLTE encryption service.

[0080] In one embodiment, in order to meet the VoLTE service exchange problem of multiple encryption key platforms in a QKD network, the encryption key middleware is to complete identity authentication to the encryption key management platform to which it belongs by the authentication encryption key stored in the security chip, the service middleware requests to log in to the cloud encrypted session service management platform, and the voice middleware is self-activated, specifically as follows: a1) The encryption key management platform realizes the charging of the security chip through the charging function, and during the charging process, the encryption key management platform identifier of this platform is written into the security chip, and this identifier is unique in the QKD network. a2) After the security chip is integrated with the terminal and the terminal is started up, the encryption key middleware calls the encryption key stored in the encryption key storage device in the security chip to complete login authentication to the encryption key management platform, and the encryption key middleware provides encryption key services to the outside. a3) The service middleware accesses the encryption key middleware to obtain the filled encryption key management platform identifier, and uploads its own information (terminal information) and the encryption key management platform identifier to the cloud encrypted session service management platform. a4) The cloud encrypted session service management platform stores the correspondence between users and each encryption key management platform as a user resource information base connected to multiple encryption key management platforms, and provides encryption key negotiation query service between the encryption key management platforms.

[0081] In one embodiment, after both parties start a call, the service middleware sends a verification request to a cloud encrypted session service management platform to obtain an encrypted session identifier returned by the cloud encrypted session service management platform, specifically as follows: b1) The terminal reports the outgoing and incoming call numbers of the current call to the cloud encrypted session service management platform through the service middleware, and the cloud encrypted session service management platform determines whether the current call has a condition to enter an encrypted session according to the contract states of the outgoing and incoming encrypted sessions; the cloud encrypted session service management platform checks the most recent login states of the outgoing and incoming middleware; if it finds that the states of both middleware are normal, it generates an encrypted session identifier for the current call based on the outgoing and incoming call numbers, and checks the encryption key management platform identifiers to which both parties belong; if they are not consistent, the cloud encrypted session service management platform returns the encryption key platform identifier to which the other end belongs, and generates an encrypted session identifier for the current call in the service middleware. b2) After the encryption key negotiation phase is started, the service middleware in the terminal sends the encryption key platform identifier to which the other party belongs and the encryption session identifier generated by the cloud encryption session service management platform to the encryption key middleware.

[0082] In one embodiment, after connecting to the call, the terminal plays a prompt, and the service middleware calls the encryption key middleware to apply for a session encryption key for the current call from the encryption key management platform to which it belongs based on the encryption session identifier, specifically as follows: c1) The called party is generally considered to be the active party, and the cryptographic middleware requests an encryption key from its encryption key management platform based on parameters (platform identifier to which the other party belongs, encryption session identifier). c2) The encryption key management platform obtains an encryption key from the encryption machine based on the encryption session identifier, the calling and called numbers, and the encryption key platform identifier to which the other end belongs, and the encryption machine initiates an application for an encryption key to the QKD network to which it is connected based on the indication of the encryption key platform. c3) In response to the request, the QKD network obtains one symmetric encryption key of the QKD node to which the specified caller belongs according to the encryption key platform identifier to which the caller belongs, and returns the corresponding encryption key identifier to the encryption machine. c4) The encryption machine feeds back the corresponding encryption key, and returns the encryption key and the encryption key identifier to the called party through the encryption key management platform. c5) The receiving side's cryptographic middleware pushes the encryption key identifier to the service middleware, and the service middleware further pushes the encryption key identifier and the encrypted session identifier to the cloud encrypted session service management platform. c6) The cloud encrypted session service management platform pushes the encryption key identifier and the encrypted session identifier to the originator. c7) The service middleware of the originating side pushes an encryption key identifier and an encryption session identifier to its encryption key middleware, and the encryption key middleware of the originating side obtains a session encryption key from its encryption key management platform based on these two parameters.

[0083] In one embodiment, the encryption key middleware transmits the session encryption key to the voice middleware, and the voice middleware completes synchronization of the encryption key acquisition status of both sides of the call via the media channel, specifically as follows: d1) The encryption key middleware on the calling and called sides obtains the session encryption key for the current call and notifies the respective service middleware of the encryption key acquisition status. d2) Both service middlewares synchronize with the cloud encrypted session service management platform notification information that the current call session encryption key has been obtained. d3) The cloud encrypted session service management platform passes both pieces of push information through to the respective service middleware to complete the synchronization of the encryption key acquisition state. d4) Each service middleware synchronizes state information to the middleware to complete synchronization of encryption key acquisition state. In addition, the push mechanism directly using the service middleware realizes an optimized implementation of synchronizing encryption keys without relying on media information streams. This solution does not rely on encryption key middleware, realizes synchronization of encryption key acquisition status in both the same encryption key platform and different encryption key platforms of the call, and has a certain adaptability.

[0084] In one embodiment, after synchronizing the encryption key acquisition status of the calling terminal and the called terminal, the calling terminal and the called terminal perform an encrypted voice call, specifically as follows. e1) The encryption key middleware of the calling terminal and the called terminal transmit the encrypted session encryption key to the voice middleware to complete the initialization of the encryption state of the voice middleware, and the voice middleware completes synchronization of the encryption key acquisition state of both sides of the call via the media channel. e2) Both the originating and terminating parties begin an encrypted session, the terminal begins an encrypted voice call, the voice middleware begins intercepting the voice and encrypts the voice data that meets the conditions. e3) The caller and the caller hang up, and the voice middleware sends an encryption end message to complete the encryption key call.

[0085] In addition, the terminal of this embodiment does not require the improvement of the carrier's IMS network and the extension of the signaling control protocol SIP protocol, but only realizes the transmission of encryption key synchronization information via the voice channel, the transfer of encryption key synchronization information based on service data information, and the problem of VoLTE encryption exchange by SIP extended field terminals and non-SIP extended terminals through the configuration of an integrated management platform and the mutual cooperation of three highly customized middleware (service, voice, and encryption key) in the mobile terminal, and has the advantages of high adaptability, simple construction plan, lower cost, and shorter cycle.

[0086] In addition, the terminal's highly customized three-way middleware technology (service, voice, and encryption key) can be used to realize a single encryption key management platform through the QKD quantum key distribution network, and VoLTE exchange issues can be resolved on multiple encryption key management platforms, thereby integrating the security requirements of customers' own encryption system construction with the exchange needs of the entire network and improving the compatibility of VoLTE encryption services.

[0087] It should be noted that other embodiments or implementation methods of the VoLTE voice encryption communication terminal of the present invention may refer to the above method embodiments, and detailed description thereof will be omitted here.

[0088] Also, referring to FIG. 8, a third embodiment of the present invention provides a VoLTE voice encryption communication system, the system comprising: a quantum key distribution network 13, a calling terminal 5, a called terminal 6, a first encryption key management platform 9, a second encryption key management platform 10, a first cipher machine 11, a second cipher machine 12, a cloud encrypted session service management platform 8 and an operator IMS network 7; A security chip 4 is integrated into each of the calling terminal 5 and the called terminal 6, and an authentication encryption key is stored in the security chip 4; the calling terminal 5 connects to the first encryption key management platform 9, the called terminal 6 connects to the second encryption key management platform 10, the first encryption key management platform 9 accesses the quantum key distribution network 13 via the first cryptographic machine 11, the second encryption key management platform 10 accesses the quantum key distribution network 13 via the second cryptographic machine 12, the calling terminal 5 and the called terminal 6 each access the cloud encrypted session service management platform 8 via the operator IMS network 7; An intermediate assembly is provided in each of the calling terminal 5 and the called terminal 6, and the intermediate assembly includes an encryption key middleware 3, a service middleware 1 and a voice middleware 2, the encryption key middleware 3 connects to the first encryption key management platform 9 or the second encryption key management platform 10, the service middleware 1 connects to the cloud encrypted session service management platform 8, and the voice middleware 2 connects to a lower layer data transmission channel; The encryption key middleware 3 is for completing identity authentication to the encryption key management platform to which it belongs by the authentication encryption key stored in its corresponding security chip 4, the service middleware 1 requests to log in to the cloud encrypted session service management platform 8, and the voice middleware 2 is self-launched; After the calling terminal 5 starts a call, the service middleware 1 sends a verification request to the cloud encrypted session service management platform 8 to obtain the encrypted session identifier returned by the cloud encrypted session service management platform 8; After the call is connected, the calling terminal 5 and the called terminal 6 play a prompt, and the service middleware 1 calls the encryption key middleware 3 to apply for a session encryption key for the call from the encryption key management platform to which it belongs based on the encryption session identifier, and the session encryption key is distributed via the quantum key distribution network 13; The encryption key middleware 3 transmits the session encryption key to the voice middleware 2, and after the voice middleware 2 completes synchronization of the encryption key acquisition states of the calling terminal 5 and the called terminal 6 via a media channel, the calling terminal 5 and the called terminal 6 perform an encrypted voice call; After the calling terminal 5 and the called terminal 6 hang up, the voice middleware 2 transmits an encryption end message to end the current encryption key communication.

[0089] In addition, the cloud encrypted session service management platform 8 is for providing addressing management of all network wide area users based on VoLTE voice, registration management of each encryption key system information, generation of encrypted session participation identifiers during the VoLTE call process, and calling function.

[0090] The carrier IMS network 7 is for carrying and transmitting data between the cloud encrypted session service management platform 8 and the mobile terminal, as well as the signaling and media domains where the two mobile phones are previously located.

[0091] The intermediate assembly can realize functions such as addressing the encryption key management platform for both sides of a VoLTE call, processing VoLTE encryption session join messages, applying for and obtaining encryption key negotiation, and real-time encryption and decryption of call data during the call process.

[0092] The security chip 4 conforms to the certificate issued by the China National Cryptography Administration and is a security medium with security protection functions. It can be connected to an encryption key management platform to realize the encryption key loading function in the security chip 4, and can realize identity authentication to the encryption key management platform using the encryption key in the security chip 4 as the authentication encryption key, and can realize primary authentication of the session encryption key and transmission of the primary encryption key.

[0093] The encryption key management platform provides a server-side API interface for the encryption key management middleware, and connects to the middleware of the mobile terminal to realize identity verification when a user logs in with the encryption key loaded in the security chip 4 as the core, negotiation of a session encryption key, and generation and transmission of a session encryption key in the process of establishing an encrypted call. The encryption key management platform may be independently located or may be located in the quantum key distribution network 13, and has the function of connecting to an encryption machine to obtain an encryption key and distribute it to the quantum middleware.

[0094] The first encryption machine 11 and the second encryption machine 12 use a three-stage encryption key management system and realize the secure local storage of encryption keys by encryption cards. They support two encryption methods, namely "primary authentication-primary encryption key" and the international data encryption algorithm, and realize the exchange and output of encryption keys. They are designed to provide encryption calculations based on the international data encryption algorithm, and support quantum secure communication networks, quantum random number generators, and native encryption cards as encryption key sources.

[0095] The quantum key distribution network 13 refers to a QKD network that meets the network construction and application needs in different scenarios of quantum secure communication and extends point-to-point QKD links to multiple users. It mainly includes modules such as QKD modules, encryption key managers (KMs), QKDN controllers and QKDN network management systems in the QKD network, as well as QKD links between QKD modules, KM links between KMs, and encryption applications (KMSs) in user networks.

[0096] In addition, in some scenarios, there is a solution in which a customized terminal that delivers an encryption session participation identifier in response to a SIP extension field request and a customized terminal that does not rely on the SIP extension field coexist. The main difference between the two customized terminals is that the SIP-based terminal improves the module side to achieve the processing ability of the SIP extension field, but they are the same in that they have similar encryption key middleware and voice middleware structures to realize encryption key negotiation and voice encryption / decryption. Therefore, once the cloud management platform and the IMS complete the connection with the service AS (service authorization platform) that is responsible for the delivery of the encryption key identifier, the VoLTE exchange function can be realized without modifying the terminal.

[0097] This system does not require any changes to the two existing types of terminals and has the characteristics of being easy to implement. The specific process is as follows: (1) The service AS (service authorization platform) responsible for the delivery of the encryption key identifier by the IMS assembly only needs to complete the user synchronization interface and the encryption session identifier push interface with the cloud encryption session service management platform. (2-1) The first type of scenario is when the caller is a SIP terminal. After the call originates, the call request is sent to a service AS (Service Authorization Platform) where the IMS network is responsible for delivering the encryption key identifier, the AS queries a local synchronization database to determine the type of the account terminal, and if the encrypted session participation conditions are met, it generates a corresponding encrypted session identifier and sends the identifier to a cloud encrypted session service management platform, which then pushes the encrypted session identifier to the counterpart terminal, and if it is a SIP terminal, the AS continues to send the encrypted session identifier to complete the encrypted session participation.

[0098] (2-2) The second type of scenario is when the SIP terminal is the receiving party. When the calling party normally initiates a call, the cloud encrypted session service management platform queries the cloud encrypted session service management platform to find that the remote party is a SIP terminal. The cloud encrypted session service management platform generates an encrypted session identifier and pushes the corresponding encrypted session identifier to a service AS (service authorization platform) in which the IMS network is responsible for delivering encryption key identifiers. The AS then sends the corresponding encrypted session participation identifier to the corresponding SIP terminal to complete the encrypted session participation.

[0099] (3) After sending the encrypted session identifier, the SIP terminal transmits the encrypted session participation identifier after being processed by the baseband chip to the voice middleware, and the voice middleware calls the encryption key middleware to obtain the encryption key from the encryption key management platform based on the encrypted session participation identifier. In the case of a non-SIP-based extended field, the service middleware realizes the acquisition of the encryption key by pushing the encryption session participation identifier to the encryption key middleware.

[0100] (4) Both calls may complete encryption key acquisition through the encryption key middleware, and achieve synchronization of both encryption key acquisition states through the media channel described in process e1).

[0101] (5) Both sides of the call complete the acquisition of the encryption key through the encryption key middleware, and based on the description of the process e1), achieve synchronization of both the acquisition of the session encryption key and the acquisition status of the encryption key, and encrypt and transmit the session encryption key to the voice middleware.

[0102] (6) Both realize voice encryption functions based on e2) and e3) through voice middleware.

[0103] It should be noted that other embodiments or implementation methods of the VoLTE voice encryption communication system of the present invention may refer to the above method embodiments, and detailed description thereof will be omitted here.

[0104] It should be noted that the logic and / or steps depicted in the flow charts or otherwise described herein may be considered, for example, as a sequential listing of executable instructions for implementing logical functions, and may be embodied in any computer readable medium for use by or in combination with an instruction execution system, device, or apparatus (e.g., a computer-based system, a system with a processor, or other system capable of obtaining and executing instructions from an instruction execution system, device, or apparatus). As used herein, a "computer readable medium" may be any device that can contain, store, communicate, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or apparatus. Further examples (non-exhaustive list) of computer readable media include an electrical connection having one or more wires (electronic devices), a disk case for a portable computer (magnetic devices), a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), a fiber optic device, and a read only compact disc (CDROM). The computer readable medium may also be paper or other suitable medium on which the program can be printed, for example, so that the paper or other medium can be optically scanned and then edited, interpreted or processed in other suitable manner, if necessary, to obtain the program in electronic form, which can then be stored in computer memory.

[0105] As will be understood, each part of the present invention may be realized by hardware, software, firmware, or a combination thereof. In the above embodiment, a number of steps or methods may be realized by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, when realized by hardware, as in the other embodiments, the present invention may be realized by any one or combination of techniques known in the art, such as a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application specific integrated circuit having suitable mixed logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0106] In the present description, the reference to "one embodiment," "several embodiments," "examples," "specific examples," or "several examples" means that the specific features, structures, materials, or characteristics described with reference to the embodiment or examples are included in at least one embodiment or example of the present invention. In the present description, schematic descriptions of the above terms do not necessarily refer to the same embodiment or example. In addition, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0107] Moreover, the terms "first" and "second" are merely for descriptive purposes and should not be understood as indicating or implying the relative importance or the number of technical features being indicated. Thus, a feature qualified by "first" or "second" may explicitly or implicitly include at least one of the feature. In the present description, unless otherwise expressly and specifically limited, the meaning of "plurality" is at least two, e.g., two, three, etc.

[0108] Although the above has shown and described embodiments of the present invention, it should be understood that the above embodiments are illustrative and should not be construed as limiting the present invention, and that those skilled in the art may make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A VoLTE voice encryption communication method, comprising: A security chip is integrated in the calling terminal and the called terminal, respectively, and the method includes: Each of the calling terminal and the called terminal completes identity authentication to the encryption key management platform to which it belongs by using the authentication encryption key stored in the corresponding security chip; A calling terminal initiates a call, and the calling terminal and the called terminal send a verification request to a cloud encrypted session service management platform, thereby obtaining an encrypted session identifier returned by the cloud encrypted session service management platform; After the call is connected, the calling terminal and the called terminal play a prompt, and apply for a session encryption key of the call to the encryption key management platform to which they belong based on the encryption session identifier, and the session encryption key is distributed via a quantum key distribution network; the calling terminal and the called terminal synchronize the encryption key acquisition states of the calling terminal and the called terminal through a media channel based on the session encryption key, and then perform an encrypted voice call; The calling terminal and the called terminal send an encryption end message to end the current encryption key call.

2. The calling terminal and the called terminal complete identity authentication to the encryption key management platform by the authentication encryption key stored in the corresponding security chip, respectively; Each of the security chips obtains an identifier of an encryption key management platform to which it belongs; The calling terminal and the called terminal respectively call up the authentication encryption key stored in the corresponding security chip to complete identity authentication to the encryption key management platform to which they belong; and uploading identifiers of encryption key management platforms to which the calling terminal and the called terminal belong and their terminal identifiers to the cloud encrypted session service management platform, so that the cloud encrypted session service management platform generates and stores a correspondence table between terminal identifiers and encryption key management platform identifiers.

3. A calling terminal initiates a call, and the calling terminal and the called terminal send a verification request to a cloud encrypted session service management platform to obtain an encrypted session identifier returned by the cloud encrypted session service management platform; The calling terminal and the called terminal report the calling number and the called number of the current call to the cloud encrypted session service management platform, so that the cloud encrypted session service management platform generates the encrypted session identifier of the current call according to the calling number and the called number; and when the cloud encrypted session service management platform determines based on the comparison table that the encryption key management platform identifiers to which the calling terminal and the called terminal belong do not match, the calling terminal and the called terminal obtain the encrypted session identifier and the identifier of the encryption key management platform to which the other terminal belongs returned by the cloud encrypted session service management platform.

4. After the call is connected, the calling terminal and the called terminal play a prompt, and apply for a session encryption key for the call to the encryption key management platform to which they belong based on the encryption session identifier, and the session encryption key is distributed by a quantum key distribution system; the receiving terminal sends a first encryption key request to the encryption key management platform to which it belongs, so that the encryption key management platform obtains an encryption key identifier from an encryption machine and returns it to the receiving terminal, and the first encryption key request includes the encryption session identifier and an identifier of the encryption key management platform to which the other end belongs; The receiving terminal pushes the encryption key identifier and the encrypted session identifier to the cloud encrypted session service management platform, whereby the cloud encrypted session service management platform pushes the encryption key identifier and the encrypted session identifier to the calling terminal; the calling terminal sends a second encryption key request to an encryption key management platform to which the calling terminal belongs, so that the encryption key management platform returns the session encryption key to the calling terminal, and the second encryption key request includes the encryption key identifier and the encrypted session identifier.

5. The encryption key management platform obtains an encryption key identifier from the encryption machine and returns it to the receiving terminal. The encryption key management platform sends a first encryption key request to the encryption machine, and the encryption machine initiates a second encryption key request to the QKD network to which it is connected based on the first encryption key request; information included in the first encryption key request includes the encryption session identifier, the calling number, the called number, and an identifier of the encryption key management platform to which the other end belongs; and information included in the second encryption key request includes an identifier of the encryption key management platform to which the other end belongs; The QKD network obtains a symmetric encryption key of one of the QKD nodes to which the calling terminal and the called terminal belong based on the second encryption key request, and returns the symmetric encryption key to the encryption machine; and the encryptor returning the symmetric encryption key and the encryption key identifier to the called terminal via the encryption key management platform.

6. The transmitting terminal and the receiving terminal synchronize the encryption key acquisition state of the transmitting terminal and the receiving terminal through the media channel based on the session encryption key, and then perform the encrypted voice call. the calling terminal and the called terminal obtaining the session encryption key; and the calling terminal and the called terminal synchronize notification information obtained by an encryption key to the cloud encrypted session service management platform, so that the cloud encrypted session service management platform passes through the notification information to the calling terminal and the called terminal to complete synchronization of an encryption key acquisition state.

7. When at least one of the calling terminal and the called terminal is a SIP terminal that delivers a cipher session participation identifier in response to a SIP extension field request, the method further comprises: The cloud cryptographic session service management platform and the IMS network complete a user synchronization interface and a cryptographic session identifier push interface; The cryptographic session identifier is generated by the cloud cryptographic session service management platform or the IMS network, and the corresponding cryptographic session identifier is sent to the SIP terminal by the IMS network, and the SIP terminal includes a cryptographic key middleware and a voice middleware; The VoLTE voice encryption communication method according to claim 1, further comprising: the voice middleware obtaining an encryption session identifier processed by a baseband chip, and calling the encryption key middleware to apply to the encryption key management platform to obtain the session encryption key.

8. A VoLTE voice encryption communication terminal, A security chip and an intermediate assembly are provided in the terminal, the security chip stores an authentication encryption key, and the intermediate assembly includes an encryption key middleware, a service middleware, and a voice middleware; The encryption key middleware is for completing identity authentication to the encryption key management platform to which it belongs by using the authentication encryption key stored in the security chip; the service middleware requests to log in to a cloud encrypted session service management platform; and the voice middleware is self-launched; The service middleware is for obtaining an encrypted session identifier returned by the cloud encrypted session service management platform by sending a verification request to the cloud encrypted session service management platform after both parties start a call, and for calling the encryption key middleware to apply for a session encryption key of the current call to the encryption key management platform to which it belongs based on the encrypted session identifier after the terminal plays a prompt sound after connecting to the call, and the session encryption key is distributed via a quantum key distribution network; the encryption key middleware is for transmitting the session encryption key to the voice middleware, and performing a voice call in which both sides of the call are encrypted after the voice middleware completes synchronization of encryption key acquisition states of both sides of the call via a media channel; The VoLTE voice encryption communication terminal, wherein the voice middleware is for sending an encryption end message after hanging up the call to end the current encryption key call.

9. The service middleware includes a UI display module, an encrypted session notification module, an encrypted session identifier synchronization module, and an encryption key negotiation initiation module; The UI display module is for displaying, in cooperation with the cloud encrypted session service management platform, judgment information for making a user contract, notification and identifier synchronization information of the current encrypted session, and an encryption key negotiation status of the current encrypted session; The encrypted session notification module is for interacting with an interface of the cloud encrypted session service management platform; The encrypted session identifier synchronization module is for obtaining the encrypted session identifier and the acquisition status of the other end returned by the cloud encrypted session service management platform after the cloud encrypted session service management platform determines that both sides of the call have encrypted session call qualifications and conditions, and completing the transmission and synchronization of the encrypted session identifier; The VoLTE voice encryption communication terminal of claim 8, wherein the encryption key negotiation initiation module is for initiating an encryption key request to the encryption key middleware based on the encryption key identifier after completing synchronization of the encryption key identifier, and obtaining a corresponding encryption key negotiation status.

10. the encryption key middleware comprises an external service interface, a general-purpose cryptographic service module, and a cryptographic device service module; The external service interface is for connecting to an external application in the manner of inter-process communication; The general-purpose cryptographic service module is for providing cryptographic key management, identity authentication and cryptographic key calculation interface; The VoLTE voice encryption communication terminal according to claim 8, wherein the encryption device service module is for obtaining an authentication encryption key stored in the security chip.

11. The voice middleware comprises a voice intercept module, a voice speed selection module, a voice encryption module and a voice backhaul module; The voice interception module is for intercepting a voice digital channel in a current terminal system, and intercepting and backhauling voice call data; The voice speed selection module is for receiving and detecting the voice call data transmitted by the voice interception module to obtain AMR payload data; the voice encryption module is for processing encryption keys, negotiating session encryption key status, and encrypting and decrypting voice data, and transmitting and receiving voice data; The VoLTE voice encryption communication terminal according to claim 8, wherein the voice backhaul module is for transmitting the AMR payload data to the voice encryption module in a single-frame manner, and for backhauling the voice encryption data processed by the voice encryption module to the voice speed selection module.

12. A VoLTE voice encryption communication system, comprising: The present invention relates to a quantum key distribution system, and more particularly to a quantum key distribution system that includes a quantum key distribution network, a transmitting terminal, a receiving terminal, a first encryption key management platform, a second encryption key management platform, a first encryption machine, a second encryption machine, a cloud encrypted session service management platform, and an operator network; A security chip is integrated into each of the calling terminal and the called terminal, and an authentication encryption key is stored in the security chip; the calling terminal connects to the first encryption key management platform, the called terminal connects to the second encryption key management platform, the first encryption key management platform accesses the quantum key distribution network through the first cryptographic machine, the second encryption key management platform accesses the quantum key distribution network through the second cryptographic machine, and the calling terminal and the called terminal respectively access the cloud encrypted session service management platform via the carrier network; An intermediate assembly is provided in each of the calling terminal and the called terminal, the intermediate assembly includes an encryption key middleware, a service middleware and a voice middleware, the encryption key middleware connects to the first encryption key management platform or the second encryption key management platform, the service middleware connects to the cloud encrypted session service management platform, and the voice middleware connects to a lower layer data transmission channel; The encryption key middleware is for completing identity authentication to the encryption key management platform to which it belongs by the authentication encryption key stored in the corresponding security chip, the service middleware requests to log in to the cloud encrypted session service management platform, and the voice middleware is self-launched; After a calling terminal initiates a call, the service middleware sends a verification request to a cloud encrypted session service management platform to obtain an encrypted session identifier returned by the cloud encrypted session service management platform; After the call is connected, the calling terminal and the called terminal play a prompt, and the service middleware calls the encryption key middleware to apply for a session encryption key for the current call from the encryption key management platform to which it belongs based on the encryption session identifier, and the session encryption key is distributed via a quantum key distribution network; the encryption key middleware transmits the session encryption key to the voice middleware, and after the voice middleware completes synchronization of the encryption key acquisition states of the calling terminal and the called terminal via a media channel, the calling terminal and the called terminal perform an encrypted voice call; After the call is ended, the voice middleware sends an encryption end message to end the current encryption key call.

Images