CN104683304B - A kind of processing method of secure traffic, equipment and system - Google Patents

Abstract

The invention discloses a method, device and system for processing confidential communication services. The content includes: introducing an encryption application server and a key management center into an IMS network, and receiving a confidential communication service sent by a first terminal device through the encryption application server. establishing a request message, sending a session key request message to the key management center, and when receiving the encrypted session key returned by the key management center, sending the encrypted session key to the first terminal device; Encrypting the application server makes confidential communication a service provided by the operator to the user, and the encryption application server obtains the encrypted session key from the key management center and issues it to the terminal device, which not only increases the operator's control over the confidential communication , which improves the processing efficiency of the system, and the introduced key management center realizes the management of the entire life cycle of the keys by users, and increases the security of the execution of confidential communication services between users.

Description

A method, device and system for processing confidential communication services

technical field

The present invention relates to the technical field of wireless communication and the technical field of security, and in particular, to a method, device and system for processing a confidential communication service in an IMS service system based on an interactive multimedia service.

Background technique

In order to perform end-to-end encryption protection for user service information carried and transmitted on the media plane of IMS (Interactive Multimedia Service), 3GPP (3rd Generation Partnership Project, 3rd Generation Mobile Communication Standardization Organization) proposed in TS33.328 Two relatively independent media plane key management schemes, realize the negotiation of the media plane session key, and use the negotiated session key to establish a security association between the calling and called terminals or between the terminal and the IMS network, The user media plane information is protected through the SRTP (Secure Real-time Transport Protocol, Secure Real-time Transport Protocol) or IP Sec (Internet Protocol Security, IP Security) protocol.

Among them, 3GPP proposed two relatively independent media plane key management schemes in TS33.328, namely SDES (Session Description Protocol Security Descriptions for Media Streams) and KMS (Key Management Service, encryption). key management service).

First, the key management scheme based on SDES.

Specifically, SDES is a simple key management protocol designed to protect media streams. It is a new cipher attribute added to the existing SDP (Session Initiation Protocol, Session Description Protocol), which is used to carry the session generated by the terminal. Key and parameter information to complete the security parameter configuration of unicast streaming media data.

When SDES is applied in the IMS system, during the establishment of a SIP (Session Initiation Protocol, session initiation protocol), session keys generated by terminal device A and terminal device B for media stream encryption are exchanged.

As shown in Figure 1, it is a schematic diagram of the workflow of SDES key management. On the one hand, when the SIP session is established, the terminal device A writes the session key K1 used for encrypting the media stream sent from the terminal device A to the terminal device B into the SDP cipher attribute, and sends it through the SIP message on the signaling plane. to terminal device B.

On the other hand, after receiving the SIP message sent by the terminal device A, the terminal device B stores the key K1, and sends the session key K2 used to encrypt the media stream sent by the terminal device B to the terminal device A through the SIP response message sent to terminal device A.

After the terminal device A receives and stores the key K2, both the terminal device A and the terminal device B obtain the session key K1 and the session key K2.

After that, the terminal device A and the terminal device B respectively use the session key K1 and the session key K2 to perform encryption and decryption operations on the media stream carried by the SRTP protocol, thereby realizing the confidentiality of user data.

However, in the SDES scheme, the session key is transmitted through SIP messages on the signaling plane, and its security completely depends on the security of SIP signaling.

There are two common security mechanisms for SIP signaling transmission:

One is based on the security mechanism of the IMS network domain, that is, the security of the IMS network domain is completely relied on to ensure the security of SIP signaling transmission. Encryption methods are used to encrypt and protect the SIP signaling on the access link of the terminal equipment, while the SIP signaling in the core network of the IMS network is transmitted in plaintext, so that attackers can use plaintext to transmit SIP signaling. The vulnerability obtains that the session key is included in the SIP signaling, which can monitor the media plane information between terminal devices and reduce the security of calls between users.

The other is based on S/MIME (Secure Multipurpose Internet Mail Extensions, Secure Multipurpose Internet Mail Extensions) encryption protection, that is, using S/MIME protocol to carry SDP (Session Description Protocol, Session Description Protocol) message content carried in SIP signaling End-to-end encryption. In the case where the terminal device does not have a preset shared key, using the public key certificate system, the terminal device needs to obtain the public key of the opposite end from the public key certificate system before sending the session key, and then uses the obtained public key to verify the SIP signaling The content is encrypted and transmitted. This method completely separates key management and session management, and operators cannot control key management, which is bypassed in terms of security, cannot meet the needs of operators to carry out confidential communication services, and is limited in practical applications.

2. KMS-based key management scheme.

Specifically, the KMS entity authenticates the calling and called terminals based on the GBA (Generic Bootstrapping Architecture, general bootstrapping architecture) mechanism, and transmits the generated session key to the calling and called terminals through the secure channel established after successful authentication. As shown in FIG. 2 , it is a schematic flowchart of KMS key management.

Based on GBA, KMS can use the unified authentication capability provided by the operator for upper-layer application services to establish a security association with the calling and called terminals, and encrypt and transmit information such as session keys.

However, since the GBA-certified core entity BSF (Bean Scripting Framework) is managed and maintained by the operator, it is responsible for generating and maintaining the session key between the KMS and the terminal device. Therefore, the operator is actually responsible for the establishment of a secure key transmission channel, and the terminal device The security of the required session key transmission is operator-dependent. In this way, the KMS key management scheme cannot meet the high security level requirements for key management of terminal devices, and is even less suitable for operators to carry out confidential communication services.

It can be seen that the current method for end-to-end encryption and protection of user service information carried and transmitted on the media plane in the IMS network cannot meet the respective needs of users and operators, and has the problem of low security.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a method, device and system for processing confidential communication services, which are used to solve the problem that the current method of performing end-to-end encryption and protection of user service information carried and transmitted on the media plane in the IMS network cannot meet the needs of users and operations. According to the respective needs of the merchants, the security of data transmission on the media plane is relatively low.

A method for processing confidential communication services, comprising:

The encryption application server EAS receives a secure communication service establishment request message sent by the first terminal device, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, The confidential communication service establishment request message includes parameter information for obtaining the session key;

The EAS carries the parameter information for acquiring the session key in the session key request message and sends it to the key management center KMC to which the first terminal device and the second terminal device belong, wherein the The session key request message is used to represent a request to the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device;

The EAS receives the encrypted session key returned by the KMC, and sends the encrypted session key to the first terminal device, so that the first terminal device can use the session key to achieve Confidential communication with the second terminal device, wherein the encrypted session key is the session key generated by the KMC according to the parameter information for obtaining the session key. obtained after.

The parameter information for obtaining the session key includes the identification information of the first terminal device and the identification information of the second terminal device;

Before the EAS carries the parameter information for acquiring the session key in the session key request message and sends it to the key management center KMC to which the first terminal device and the second terminal device belong, the Methods also include:

The EAS determines, according to the identification information of the first terminal device and the identification information of the second terminal device, the key management center KMC to which the first terminal device and the second terminal device belong.

The method also includes:

The EAS sends the encrypted session key to the second terminal device, so that the second terminal device can use the session key to implement secure communication with the first terminal device.

The EAS sends the encrypted session key to the first terminal device and/or the second terminal device, including:

The EAS sends the encrypted session key to the first terminal device and/or the second terminal device through IMS network signaling.

The encrypted session key includes a session key encrypted with the first protection key and a session key encrypted with the second protection key;

The encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key, including:

The KMC determines, according to the identification information of the first terminal device included in the parameter information for obtaining the session key, that the first terminal device corresponding to the identification information of the first terminal device is logged into the KMC. generating the first protection key, and using the first protection key to perform an encryption operation on the generated session key to obtain a session key encrypted with the first protection key; and

According to the identification information of the second terminal device included in the parameter information for obtaining the session key, determine the first terminal device generated when the second terminal device corresponding to the identification information of the second terminal device logs in to the KMC. two protection keys, and the generated session key is encrypted by using the second protection key to obtain a session key encrypted by the second protection key.

A method for processing confidential communication services, comprising:

The first terminal device sends a secure communication service establishment request message to the encryption application server EAS, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, so The secure communication service establishment request message includes parameter information for obtaining the session key;

The first terminal device receives the encrypted session key sent by the EAS, wherein the encrypted session key is that the EAS carries the parameter information for obtaining the session key in the session key. The request message is sent to the key management center KMC to which the first terminal device and the second terminal device belong, and the KMC encrypts the generated session key according to the parameter information used to obtain the session key Obtained after processing, the session key request message is used to represent a request for the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device.

The method also includes:

When receiving the encrypted session key sent by the EAS, the first terminal device sends the encrypted session key to the second terminal device.

The first terminal device sends the encrypted session key to the second terminal device, including:

sending, by the first terminal device, the encrypted session key to the second terminal device through IMS network signaling;

or,

The first terminal device sends the encrypted session key to the second terminal device through the established media plane data transmission channel with the second terminal device.

The method also includes:

When receiving the encrypted session key sent by the EAS, the first terminal device decrypts the encrypted session key by using the first protection key generated when logging in to the KMC to obtain the KMC. A session key generated for a secure communication service between the first terminal device and the second terminal device.

A method for processing confidential communication services, comprising:

The key management center KMC receives the session key request message sent by the encryption application server EAS, wherein the session key request message is used to represent the request for the KMC to be a secret that needs to be established between the first terminal device and the second terminal device. The communication service generates a session key, the session key request message includes parameter information for obtaining the session key, and the parameter information for obtaining the session key is the first terminal received by the EAS. carried in a secure communication service establishment request message that is sent by the device and is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device; and

Return the encrypted session key to the EAS, so that the EAS sends the encrypted session key to the first terminal device, so that the first terminal device can use the session key to realize Confidential communication with the second terminal device, wherein the encrypted session key is the session key generated by the KMC according to the parameter information for obtaining the session key. obtained after.

The identification information of the first terminal device and the identification information of the second terminal device included in the parameter information for obtaining the session key;

The KMC returns the encrypted session key to the EAS, including:

The KMC generates a session key required for performing a secure communication service between the first terminal device and the second terminal device;

According to the identification information of the first terminal device included in the parameter information for obtaining the session key, the KMC determines that the first terminal device corresponding to the identification information of the first terminal device is generated when logging in to the KMC. a first protection key, and perform an encryption operation on the generated session key by using the first protection key to obtain a session key encrypted by using the first protection key; and

According to the identification information of the second terminal device included in the parameter information for acquiring the session key, determine the second protection generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC and use the second protection key to encrypt the generated session key to obtain a session key encrypted by the second protection key;

The KMC uses the session key encrypted with the first protection key and the session key encrypted with the second protection key as the encrypted session key, and sends it to the KMC through a key response message. EAS.

An encrypted application server for confidential communication services, comprising:

A receiving module, configured to receive a secure communication service establishment request message sent by a first terminal device, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device , the confidential communication service establishment request message includes parameter information for obtaining the session key;

A sending module, configured to carry the parameter information for obtaining the session key in a session key request message and send it to the key management center KMC to which the first terminal device and the second terminal device belong, wherein, The session key request message is used to represent a request to the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device;

A processing module, configured to receive the encrypted session key returned by the KMC, and send the encrypted session key to the first terminal device, so that the first terminal device can use the session key secret communication with the second terminal device, wherein the encrypted session key is the session key generated by the KMC according to the parameter information for obtaining the session key. obtained after encryption.

The parameter information for obtaining the session key includes the identification information of the first terminal device and the identification information of the second terminal device;

The encrypted application server also includes:

A determining module, configured to carry the parameter information for obtaining the session key in the session key request message and send it to the key management center KMC to which the first terminal device and the second terminal device belong, The key management center KMC to which the first terminal device and the second terminal device belong is determined according to the identification information of the first terminal device and the identification information of the second terminal device.

The processing module is further configured to send the encrypted session key to the second terminal device, so that the second terminal device can use the session key to achieve confidentiality with the first terminal device communication.

The processing module is specifically configured to send the encrypted session key to the first terminal device and/or the second terminal device through IMS network signaling.

The encrypted session key includes a session key encrypted with the first protection key and a session key encrypted with the second protection key;

The encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key, including:

The KMC determines, according to the identification information of the first terminal device included in the parameter information for obtaining the session key, that the first terminal device corresponding to the identification information of the first terminal device is logged into the KMC. generating the first protection key, and using the first protection key to perform an encryption operation on the generated session key to obtain a session key encrypted with the first protection key; and

According to the identification information of the second terminal device included in the parameter information for obtaining the session key, determine the first terminal device generated when the second terminal device corresponding to the identification information of the second terminal device logs in to the KMC. two protection keys, and the generated session key is encrypted by using the second protection key to obtain a session key encrypted by the second protection key.

A terminal device for performing confidential communication services, comprising:

A request message sending module, configured to send a secure communication service establishment request message to the encryption application server EAS, wherein the secure communication service establishment request message is used to indicate that secure communication needs to be established between the first terminal device and the second terminal device service, the confidential communication service establishment request message includes parameter information for obtaining the session key;

The session key receiving module is configured to receive the encrypted session key sent by the EAS, wherein the encrypted session key is the parameter information that the EAS carries in the session key for obtaining the session key. The key request message is sent to the key management center KMC to which the first terminal device and the second terminal device belong, and the KMC pairs the generated session key according to the parameter information used to obtain the session key. Obtained after performing encryption processing, the session key request message is used to represent a request for the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device.

The terminal equipment also includes:

The processing module is configured to send the encrypted session key to the second terminal device when receiving the encrypted session key sent by the EAS.

The processing module is specifically configured to send the encrypted session key to the second terminal device through IMS network signaling;

or,

The encrypted session key is sent to the second terminal device through the established media plane data transmission channel with the second terminal device.

The terminal equipment also includes:

The decryption module is configured to decrypt the encrypted session key using the first protection key generated when logging in to the KMC when receiving the encrypted session key sent by the EAS, and obtain the KMC as: The session key generated by the secure communication service between the first terminal device and the second terminal device.

A key management center for confidential communication services, comprising:

The key request receiving module is configured to receive the session key request message sent by the encryption application server EAS, wherein the session key request message is used to represent that the KMC is requested to be required between the first terminal device and the second terminal device The established confidential communication service generates a session key, and the session key request message includes parameter information for obtaining the session key, and the parameter information for obtaining the session key is the parameter information received by the EAS. carried in a secure communication service establishment request message sent by the first terminal device and used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device; and

A key sending module, configured to return the encrypted session key to the EAS, so that the EAS sends the encrypted session key to the first terminal device, so that the first terminal device can Use the session key to implement secure communication with the second terminal device, wherein the encrypted session key is generated by the KMC according to the pair of parameter information used to obtain the session key obtained after encrypting the session key.

The identification information of the first terminal device and the identification information of the second terminal device included in the parameter information for obtaining the session key;

The key sending module is specifically configured to generate a session key required for performing a confidential communication service between the first terminal device and the second terminal device, according to the parameter information used to obtain the session key. Include the identification information of the first terminal device, determine the first protection key generated by the first terminal device corresponding to the identification information of the first terminal device when logging in the KMC, and use the first protection key. encrypting the generated session key with the key to obtain a session key encrypted with the first protection key; and

According to the identification information of the second terminal device included in the parameter information for acquiring the session key, determine the second protection generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC and use the second protection key to encrypt the generated session key to obtain a session key encrypted by the second protection key;

The session key encrypted with the first protection key and the session key encrypted with the second protection key are used as the encrypted session key, and sent to the EAS through a key response message.

A processing system for confidential communication services, the system includes: the above-mentioned encryption application server, the above-mentioned terminal equipment, and the above-mentioned key management center.

The beneficial effects of the present invention are as follows:

In this embodiment of the present invention, an encryption application server and a key management center are introduced into the IMS network, and the encryption application server receives a message sent by the first terminal device to indicate that a confidential communication service needs to be established between the first terminal device and the second terminal device. The secure communication service establishment request message, the parameter information for obtaining the session key contained in the secure communication service establishment request message is carried in the session key request message and sent to the keys belonging to the first terminal device and the second terminal device. The management center, requesting the key management center to generate a session key for the confidential communication service that needs to be established between the first terminal device and the second terminal device, and when receiving the encrypted session key returned by the key management center, The encrypted session key is sent to the first terminal device, so that the first terminal device can use the session key to implement secure communication with the second terminal device. In this way, the encrypted application server enables secure communication as a service provided by the operator to the user, and the encrypted application server obtains the encrypted session key from the key management center and issues it to the terminal device, which not only increases the operator's confidence in The control power of confidential communication also improves the processing efficiency of the system. At the same time, the introduced key management center realizes the management of the whole life cycle of keys by users, and increases the security of the execution of confidential communication services between users.

Description of drawings

Fig. 1 is the workflow schematic diagram of SDES key management;

Fig. 2 is the schematic flow chart of KMS key management;

3 is a schematic flowchart of a method for processing a confidential communication service according to Embodiment 1 of the present invention;

4 is a schematic flowchart of a method for processing a confidential communication service according to Embodiment 2 of the present invention;

5 is a schematic flowchart of a method for processing a confidential communication service according to Embodiment 3 of the present invention;

6 is a schematic flowchart of a method for processing a confidential communication service according to Embodiment 4 of the present invention;

FIG. 7 is a schematic structural diagram of an encryption application server used for a secure communication service according to Embodiment 5 of the present invention;

FIG. 8 is a schematic structural diagram of a terminal device for executing a confidential communication service according to Embodiment 6 of the present invention;

9 is a schematic structural diagram of a key management center for a secure communication service according to Embodiment 7 of the present invention;

FIG. 10 is a schematic structural diagram of a system for processing a secure communication service according to Embodiment 8 of the present invention.

Detailed ways

In order to achieve the purpose of the present invention, the embodiments of the present invention provide a method, device and system for processing a confidential communication service. An encryption application server and a key management center are introduced into the IMS network. A secure communication service establishment request message sent by the device to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, and the confidential communication service establishment request message to carry the parameter information for obtaining the session key that is included in the secure communication service establishment request message. The session key request message is sent to the key management center to which the first terminal device and the second terminal device belong, and requests the key management center to generate a session for the secure communication service that needs to be established between the first terminal device and the second terminal device key, and when receiving the encrypted session key returned by the key management center, send the encrypted session key to the first terminal device, so that the first terminal device can use the session key to communicate with the first terminal device. Secure communication between two terminal devices.

In this way, the encrypted application server enables secure communication as a service provided by the operator to the user, and the encrypted application server obtains the encrypted session key from the key management center and issues it to the terminal device, which not only increases the operator's confidence in The control power of confidential communication also improves the processing efficiency of the system. At the same time, the introduced key management center realizes the management of the whole life cycle of keys by users, and increases the security of the execution of confidential communication services between users.

It should be noted that the system architecture applied in the embodiment of the present invention includes but is not limited to the IMS core network (for example, including SBC (Session Border Controller, session border controller), P-CSCF (Proxy Call Session Control Function, proxy call session control function) Function), S-CSCF (Serving Call Session Control Function, Serving Call Session Control Function), HSS (Home Subscriber Server, Home Subscriber Server), MGCF (Media Gateway Control Function, Media Gateway Control Function), MGW (Media Gateway, Media Gateway) ) and other network element equipment; in addition, when a SIP (Session Initiation Protocol, session initiation protocol) server is included in the system architecture, the technical solutions provided by the embodiments of the present invention can also be used to realize that the SIP system provides users with confidential communication services, There is no specific limitation here.

The encryption application server (EAS, Encryption Application Server) involved in various embodiments of the present invention is used to provide a confidential communication service for terminal devices (wherein the confidential communication service includes but is not limited to encrypted voice call service, encrypted video call service, encrypted conference call business, encrypted SMS business, encrypted file transfer business, encrypted mail business, etc.). The functions of EAS include: On the one hand, EAS is compatible with the function of starting the session business logic of AS (Application Server, application server) in the IMS network system, and can receive service request messages initiated by terminal equipment from the core entity S-CSCF of the IMS network, triggering Secrecy communication services and responsible for various control plane call processing and connection control, and charging for the executed services; on the other hand, EAS communicates with the Key Management Center (KMC, Key Management Center) through the set security interface, which can According to the business processing logic, the registration of the terminal equipment on the KMC, identity authentication, key management and other aspects of information transmission are completed, and the signaling interaction between the terminal equipment and the KMC is supported.

The key management center (KMC) involved in the various embodiments of the present invention is used to manage the keys required by the confidential communication service, including but not limited to: generating keys, injecting keys, distributing keys, storing keys , archiving keys, exporting keys, updating keys, and destroying keys, including full-life-cycle key management. The KMC communicates with the EAS through the secure interface, and can receive the password request message from the terminal device through the EAS, complete the registration, identity authentication, key distribution and other operations of the terminal device, and can also issue the password module in the terminal device through the EAS The control command realizes the remote control of the cryptographic module in the terminal device, for example: KMC realizes the management of the cryptographic module included in the terminal device, and can remotely destroy the cryptographic module in the terminal device.

In addition, in order to improve the user's trust in the operator's confidential business service, the user's self-deployment of KMC is realized.

In the terminal device involved in each embodiment of the present invention, the terminal device includes an IP communication module and a cryptographic communication module. Among them, the IP communication module supports the SIP communication protocol, has IMS communication capabilities, and supports functions such as terminal login/logout, identity authentication, call control and processing in the IMS system; the cryptographic module is responsible for terminal key management and executes encryption and decryption algorithms. On the side, it implements signaling interaction with the KMC to obtain the session key. On the media side, the acquired session key is used to establish a security association with the peer device, so as to realize the secure transmission of communication services.

The various embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

Example 1:

As shown in FIG. 3 , it is a schematic flowchart of a method for processing a secure communication service according to Embodiment 1 of the present invention, and the method may be as follows.

Step 101: The EAS receives a secure communication service establishment request message sent by the first terminal device.

The secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, and the secure communication service establishment request message includes a session key for obtaining a session key. Parameter information.

In step 101, when calling the second terminal device, the first terminal device sends a secure communication service establishment request message to the IMS network, and the IMS network core network forwards the secure communication service request message to the EAS to inform the EAS first terminal The device will establish a secure communication service with the second terminal device.

It should be noted that, at this time, the confidential communication service establishment request message sent by the first terminal device may be implemented through a call establishment request message initiated by the first terminal device, that is, when the first terminal device initiates a call to the second terminal device. , and send a call setup message to the IMS network. At this time, the call setup message has two functions: 1. Request to establish a call connection with the second terminal device; 2. Trigger a secure communication service while establishing the call connection.

Or, at this time, the secure communication service establishment request message sent by the first terminal is randomly triggered after the first terminal device initiates the call establishment request message.

For example, after the first terminal device successfully establishes a call link with the second terminal device, and during the process of call service processing, it sends a request message for establishing a confidential communication service to the IMS network, and the IMS network core network sends the confidential communication service establishment request message to the IMS network. The request message is forwarded to the EAS to inform the EAS that the first terminal device needs to perform a secure communication service with the second terminal device.

That is to say, the establishment of the call connection between the terminal devices and the triggering of the secure communication service may be executed at the same time, or may not be executed at the same time, the secure communication service is triggered first, and then the call connection is established, or the call connection is established first, and then the Confidential communication services are available.

When receiving the secure communication service establishment request message sent by the first terminal device, the encryption application server starts the subsequent secure communication service processing flow.

Step 102: The EAS carries the parameter information for acquiring the session key in a session key request message and sends it to the key management center KMC to which the first terminal device and the second terminal device belong.

The session key request message is used to represent a request for the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device.

The parameter information for acquiring the session key includes the identification information of the first terminal device and the identification information of the second terminal device.

It should be noted that the parameter information used to obtain the session key at least includes the identification information of the first terminal device, the identification information of the second terminal device, a random number, and the like.

In step 102, the EAS determines the key management center KMC to which the first terminal device and the second terminal device belong according to the identification information of the first terminal device and the identification information of the second terminal device.

It should be noted that the key management center to which the calling and called terminal devices of this call are established belong to the same key management center, that is, the first terminal device and the second terminal device register and log in to the same key management center.

Here, the calling and called terminal devices of the same group user group are combined into one user domain, and the same user domain includes at least one key management center.

That is to say, the EAS determines the user domain to which the first terminal device and the second terminal device belong according to the identification information of the first terminal device and the identification information of the second terminal device, and obtains information from at least one key management center included in the user domain. Select a key management center in .

The EAS carries the parameter information for acquiring the session key in the session key request message and sends it to the determined key management center KMC.

Specifically, the EAS sends a session key request message to the determined KMC through the security interface, requesting the determined key management center to generate a session key for the secure communication service that needs to be established between the first terminal device and the second terminal device.

Step 103: The EAS receives the encrypted session key returned by the KMC, and sends the encrypted session key to the first terminal device.

The first terminal device is enabled to implement secure communication with the second terminal device by using the session key.

The encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key.

In step 103, the manner in which the EAS sends the encrypted session key to the first terminal device includes:

The EAS sends the encrypted session key to the first terminal device through IMS network signaling.

Specifically, the EAS sends the encrypted session key to the first terminal device through SIP signaling in the IMS network.

For example: SIP signaling includes but is not limited to: MESSAGE message, OPTIONS, INFO, etc.

Alternatively, the EAS sends the encrypted session key to the first terminal device through a call processing message in the IMS network.

For example: call establishment response message, session processing message, etc.

Specifically, when the call establishment between the first terminal device and the second terminal device and the establishment of the confidential communication service are implemented synchronously, after the EAS sends the session key request message to the KMC, the call initiated by the first terminal device can be sent to the second terminal device to the second terminal device. The call establishment request message of the terminal device is forwarded to the second terminal device to attempt to establish a call connection with the second terminal device.

At the same time, when receiving the encrypted session key sent by the KMC, the EAS determines whether to receive a call setup response message from the second terminal device, and uses the received call setup response message when receiving the call setup response message from the second terminal device. The establishment response message sends the encrypted session key to the first terminal device.

It should be noted that the encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information used to obtain the session key. Limited to:

First, after receiving the session key request message sent by the EAS, the KMC generates a session key for establishing a secure communication service between the first terminal device and the second terminal device.

It should be noted that, after the KMC receives the session key request message sent by the EAS, the generated session key may be randomly generated, or it may be based on the information carried in the session key request message and used to obtain the session key. The parameter information is determined, for example, the session key is generated by using the random number information in the parameter information for obtaining the session key, etc., which is not limited here.

Secondly, in order to ensure the security of the session key transmission in the communication link, KMC encrypts the generated session key.

Since the KMC is deployed by the user, the terminal device used by the user can first register and log in to the KMC when communicating, and when logging in, the KMC generates a protection key for the terminal device, and the KMC stores the identification information of the terminal device locally. The corresponding relationship with the protection key, then when the subsequent terminal device initiates a confidential communication service, the KMC can use the protection key to encrypt the generated session key, which can ensure that the session key is in the communication link transmission process. It also enables the terminal to accurately decrypt the encrypted session key to obtain the real session key when receiving the encrypted session key, which improves the efficiency of confidential communication services and ensures the security of communication.

At this time, the KMC determines, according to the identification information of the first terminal device included in the parameter information for acquiring the session key, that the first terminal device corresponding to the identification information of the first terminal device is logging in to the The first protection key generated during the KMC, and the generated session key is encrypted with the first protection key to obtain a session key encrypted by the first protection key; and according to the The identification information of the second terminal device included in the parameter information for obtaining the session key is determined, and the second protection key generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC is determined. and encrypting the generated session key by using the second protection key to obtain a session key encrypted by using the second protection key.

Finally, the encrypted session key including the session key encrypted with the first protection key and the session key encrypted with the second protection key is sent to the EAS.

Specifically, the KMC sends the encrypted session key to the EAS through a session key response message.

The session key response message may include the encrypted session key (that is, the encrypted session key is a data packet, but the session key is divided into two parts, and a part of the content uses the first protection key The session key generated by encryption is obtained, and the other part is obtained by encrypting the session key generated by using the second protection key), or the session key encrypted by using the first protection key and the session key encrypted by using the second protection key The session key is not limited here.

Specifically, when the KMC sends the session key encrypted with the first protection key and the session key encrypted with the second protection key to the EAS through the session key response message, it means that the KMC sends the EAS two There are different data packets, one data packet is the session key encrypted with the first protection key, and the other data packet is the session key encrypted with the second protection key.

Optionally, when the KMC obtains the session key encrypted with the first protection key and the session key encrypted with the second protection key, establishes the first terminal device identifier corresponding to the first protection key and uses the A corresponding relationship between the session key encrypted by the protection key, and the corresponding relationship between the second terminal device identifier corresponding to the second protection key and the session key encrypted with the second protection key, and the corresponding relationship between the session key encrypted by the second protection key and the second protection key. The session key encrypted with the first protection key and the session key encrypted with the second protection key are sent to the EAS, and the established corresponding relationship is also sent to the EAS, so that the EAS forwards the encrypted session key to the EAS. After the first terminal device, the corresponding relationship is used to quickly determine the encrypted session key corresponding to its own identification information, which speeds up system service processing and improves system operation efficiency.

In another embodiment of the present invention, the EAS sends the encrypted session key to the second terminal device, so that the second terminal device can use the session key to communicate with the first terminal Confidential communication between devices.

That is, after receiving the encrypted session key sent by the KMC, the EAS simultaneously sends the encrypted session key to the first terminal device and the second terminal device.

For example, when the call establishment between the first terminal device and the second terminal device and the establishment of the secure communication service are implemented synchronously, after the EAS sends a session key request message to the KMC, the call initiated by the first terminal device can be called to the second terminal. The call establishment request message of the device is forwarded to the second terminal device to attempt to establish a call connection with the second terminal device.

At the same time, when receiving the encrypted session key sent by the KMC, the EAS determines whether it has received the call setup response message from the second terminal device, and when receiving the call setup response message from the second The terminal device and the second terminal device send the encrypted session key.

After the first terminal device and the second terminal device receive the encrypted session key sent by the EAS, they respectively use the protection key generated by logging in to the KMC to decrypt the encrypted session key, and obtain the session key generated by the KMC. , and after the media plane transmission channel between the first terminal device and the second terminal device is established, use the session key to transmit the communication service in the established media plane transmission channel.

It should be noted that, after the EAS obtains the encrypted session key for the KMC to perform the confidential communication service between the first terminal device and the second terminal device, the number of times that the encrypted session key is sent to the first terminal device is not equal. It is limited to one time and can be repeated many times to ensure the correctness of transmission.

It should be noted that, assuming that the encrypted session key returned by the KMC received by the EAS belongs to a data packet, the EAS sends the encrypted session key containing a data packet to the first terminal device and the second terminal device respectively. ; Assume that the encrypted session key returned by the KMC that EAS receives belongs to two data packets, that is, one data packet is the session key encrypted by the first protection key, and the other data packet is the use of the second protection key. When performing the encrypted session key, the EAS can send the encrypted session key containing the two data packets to the first terminal device and the second terminal device respectively; the EAS can also determine the terminal devices corresponding to different data packets respectively, sending the data packet containing the session key encrypted by using the first protection key to the first terminal device, and sending the data packet containing the session key encrypted by using the second protection key to the second terminal device, There is no specific limitation here.

Through the solution of Embodiment 1 of the present invention, an encryption application server and a key management center are introduced into the IMS network, and the encryption application server receives a message sent by the first terminal device to characterize the relationship between the first terminal device and the second terminal device through the encryption application server. A secure communication service establishment request message that needs to establish a secure communication service, the parameter information for obtaining the session key contained in the secure communication service establishment request message is carried in the session key request message and sent to the first terminal device and the second terminal The key management center to which the device belongs, requests the key management center to generate a session key for the confidential communication service that needs to be established between the first terminal device and the second terminal device, and receives the encrypted session returned by the key management center When the encrypted session key is obtained, the encrypted session key is sent to the first terminal device, so that the first terminal device can use the session key to implement secure communication with the second terminal device.

In this way, the encrypted application server enables secure communication as a service provided by the operator to the user, and the encrypted application server obtains the encrypted session key from the key management center and issues it to the terminal device, which not only increases the operator's confidence in The control power of confidential communication also improves the processing efficiency of the system. At the same time, the introduced key management center realizes the management of the whole life cycle of keys by users, and increases the security of the execution of confidential communication services between users.

Embodiment 2:

As shown in FIG. 4 , it is a schematic flowchart of a method for processing a confidential communication service provided by Embodiment 2 of the present invention. Embodiment 2 of the present invention is an invention under the same inventive concept as Embodiment 1 of the present invention. The second is a detailed description of the processing method of the confidential communication service involved in the present invention from the perspective of the terminal device. The method can be as follows.

Step 201: The first terminal device sends an encrypted communication service establishment request message to the encrypted application server EAS.

The secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, and the secure communication service establishment request message includes a session key for obtaining a session key. Parameter information.

In step 201, when calling the second terminal device, the first terminal device sends a secure communication service establishment request message to the IMS network, and the IMS network core network forwards the secure communication service request message to the EAS to inform the EAS first terminal The device will establish a secure communication service with the second terminal device.

It should be noted that, at this time, the confidential communication service establishment request message sent by the first terminal device may be implemented through a call establishment request message initiated by the first terminal device, that is, when the first terminal device initiates a call to the second terminal device. , and send a call setup message to the IMS network. At this time, the call setup message has two functions: 1. Request to establish a call connection with the second terminal device; 2. Trigger a secure communication service while establishing the call connection.

Or, at this time, the secure communication service establishment request message sent by the first terminal is randomly triggered after the first terminal device initiates the call establishment request message.

For example, after the first terminal device successfully establishes a call link with the second terminal device, and during the process of call service processing, it sends a secure communication service establishment request message to the EAS on the network side, informing the EAS that the first terminal device needs to communicate with the second terminal device. Secure communication between the two terminal devices.

That is to say, the connection establishment of the call and the triggering of the secure communication service between the terminal devices may be executed simultaneously or not simultaneously, the secure communication service is triggered first, and then the call connection is established, or the call connection is established first, and then the Confidential communication services are acceptable, and no specific limitation is made here.

This enables the encryption application server to start the subsequent confidential communication service processing flow when receiving the confidential communication service establishment request message sent by the first terminal device.

Step 202: The first terminal device receives the encrypted session key sent by the EAS.

The encrypted session key is that the EAS carries the parameter information for acquiring the session key in a session key request message and sends it to the first terminal device and the second terminal device to which the second terminal device belongs. The key management center KMC, obtained by the KMC encrypting the generated session key according to the parameter information for obtaining the session key, and the session key request message is used to represent the request for the KMC A session key is generated for the secure communication service that needs to be established between the first terminal device and the second terminal device.

In step 202, how the encryption application server obtains the encrypted session key is described in detail in Embodiment 1 of the present invention, and will not be repeated here.

Step 203: When receiving the encrypted session key sent by the EAS, the first terminal device decrypts the encrypted session key using the first protection key generated when logging in to the KMC, and obtains: The KMC is a session key generated for a secure communication service between the first terminal device and the second terminal device.

The encrypted session key includes a session key encrypted with the first protection key and a session key encrypted with the second protection key.

In step 203, since the encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information used to obtain the session key, the specific implementation method includes: not limited to:

First, after receiving the session key request message sent by the EAS, the KMC generates a session key for establishing a secure communication service between the first terminal device and the second terminal device.

It should be noted that, after the KMC receives the session key request message sent by the EAS, the generated session key may be randomly generated, or it may be based on the information carried in the session key request message and used to obtain the session key. The parameter information is determined, for example, the session key is generated by using the random number information in the parameter information for obtaining the session key, etc., which is not limited here.

Secondly, in order to ensure the security of the session key transmission in the communication link, KMC encrypts the generated session key.

Since the KMC is deployed by the user, the terminal device used by the user can first register and log in to the KMC when communicating, and when logging in, the KMC generates a protection key for the terminal device, and the KMC stores the identification information of the terminal device locally. The corresponding relationship with the protection key, then when the subsequent terminal device initiates a confidential communication service, the KMC can use the protection key to encrypt the generated session key, which can ensure that the session key is in the communication link transmission process. It also enables the terminal to accurately decrypt the encrypted session key to obtain the real session key when receiving the encrypted session key, which improves the efficiency of confidential communication services and ensures the security of communication.

At this time, the KMC determines, according to the identification information of the first terminal device included in the parameter information for acquiring the session key, that the first terminal device corresponding to the identification information of the first terminal device is logging in to the The first protection key generated during the KMC, and the generated session key is encrypted with the first protection key to obtain a session key encrypted by the first protection key; and according to the The identification information of the second terminal device included in the parameter information for obtaining the session key is determined, and the second protection key generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC is determined. and encrypting the generated session key by using the second protection key to obtain a session key encrypted by using the second protection key.

Finally, the encrypted session key including the session key encrypted with the first protection key and the session key encrypted with the second protection key is sent to the EAS.

The session key response message may include the encrypted session key (that is, the encrypted session key is a data packet, but the session key is divided into two parts, and a part of the content uses the first protection key The session key generated by encryption is obtained, and the other part is obtained by encrypting the session key generated by using the second protection key), or the session key encrypted by using the first protection key and the session key encrypted by using the second protection key The session key is not limited here.

Specifically, when the KMC sends the session key encrypted with the first protection key and the session key encrypted with the second protection key to the EAS through the session key response message, it means that the KMC sends the EAS two There are different data packets, one data packet is the session key encrypted with the first protection key, and the other data packet is the session key encrypted with the second protection key.

Optionally, when the KMC obtains the session key encrypted with the first protection key and the session key encrypted with the second protection key, establishes the first terminal device identifier corresponding to the first protection key and uses the A corresponding relationship between the session key encrypted by the protection key, and the corresponding relationship between the second terminal device identifier corresponding to the second protection key and the session key encrypted with the second protection key, and the corresponding relationship between the session key encrypted by the second protection key and the second protection key. The session key encrypted with the first protection key and the session key encrypted with the second protection key are sent to the EAS, and the established corresponding relationship is also sent to the EAS, so that the EAS forwards the encrypted session key to the EAS. After the first terminal device, the corresponding relationship is used to quickly determine the encrypted session key corresponding to its own identification information, which speeds up system service processing and improves system operation efficiency.

Therefore, when the encrypted session key received by the first terminal device belongs to a data packet, the first terminal device uses the first protection key generated when logging in to the KMC to decrypt the encrypted session key to obtain the session key generated by the KMC for the secure communication service between the first terminal device and the second terminal device.

When the encrypted session key received by the first terminal device includes two data packets, that is, the received encrypted session key includes the session key encrypted by the first protection key and the session key encrypted by the second protection key. The session key encrypted by the protection key, at this time, the first terminal device can only decrypt the session key encrypted by the first protection key through the first protection key, and obtains that the KMC is the first protection key. The session key generated by the secure communication service between the terminal device and the second terminal device is used to prepare for the subsequent secure communication with the second terminal device.

Optionally, when the encrypted session key received by the first terminal device includes the session key encrypted with the first protection key and the session key encrypted with the second protection key, it can also be The corresponding relationship between the identification information of the terminal device and the encrypted session key established by the KMC, determine the session key encrypted with the first protection key corresponding to the first terminal device identification, and use the first protection key to pair Decrypt the session key encrypted by the first protection key to obtain the session key generated by the KMC for the secure communication service between the first terminal device and the second terminal device.

Step 204: When receiving the encrypted session key sent by the EAS, the first terminal device sends the encrypted session key to the second terminal device.

In step 204, the manner in which the first terminal device sends the encrypted session key to the second terminal device includes but is not limited to:

The first way:

The first terminal device sends the encrypted session key to the second terminal device through IMS network signaling.

Specifically, regardless of whether the media plane data transmission channel between the first terminal device and the second terminal device is established, when the first terminal receives the session key sent by the EAS, it uses IMS network signaling to encrypt the encrypted The session key is sent to the second terminal device.

It should be noted that the IMS network signaling includes, but is not limited to, SIP signaling, call processing messages, and the like.

The first terminal device sends the encrypted session key to the second terminal device through SIP signaling.

For example: SIP signaling includes but is not limited to: MESSAGE message, OPTIONS, INFO, etc.

The first terminal device sends the encrypted session key to the second terminal device through a temporary response confirmation message PRACK.

Specifically, in order to save the system signaling overhead, a signaling piggyback transmission method can be adopted, that is, when the first terminal device receives the encrypted session key transmitted by the call setup response message sent by the EAS through the second terminal device , after the call setup response message is correctly processed, and the temporary confirmation message PRACK is returned to the second terminal device, the encrypted session key is carried in the temporary confirmation message PRACK and sent to the second terminal device.

The second way:

The first terminal device sends the encrypted session key to the second terminal device through the established media plane data transmission channel with the second terminal device.

Specifically, when the first terminal device receives the session key sent by the EAS and determines that the establishment of the media plane transmission channel with the second terminal device is completed, the encrypted The session key is sent to the second terminal device.

Specifically, when the encrypted session key received by the first terminal device belongs to a data packet, the first terminal device sends the encrypted session key containing one data packet to the second terminal device; when the first terminal device sends the encrypted session key containing one data packet to the second terminal device; When the encrypted session key received by the device belongs to two data packets, that is, one data packet is the session key encrypted by the first protection key, and the other data packet is the session key encrypted by the second protection key. When the key is used, the first terminal device can send the encrypted session key containing two data packets to the second terminal device at the same time; the first terminal device EAS can respectively determine the terminal devices corresponding to different data packets, and send the encrypted session key containing the two data packets to the second terminal device; The data packet of the session key encrypted by using the second protection key is sent to the second terminal device, which is not specifically limited here.

It should be noted that, in the second embodiment of the present invention, step 203 and step 204 are not distinguished in the order of execution. Step 203 and step 204 are implemented simultaneously.

Embodiment three:

As shown in FIG. 5 , a schematic flowchart of a method for processing a confidential communication service provided by Embodiment 3 of the present invention. Embodiment 3 of the present invention is an invention under the same inventive concept as Embodiments 1 to 2 of the present invention. Embodiment 3 of the present invention is a detailed description of each step in Embodiment 1 of the present invention from the side of the key management center. The method can be as follows.

Step 301: The key management center KMC receives the session key request message sent by the encryption application server EAS.

The session key request message is used to represent a request for the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device.

The session key request message includes parameter information for acquiring the session key.

The parameter information for obtaining the session key is the parameter information received by the EAS and sent by the first terminal device to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device. It is carried in the secure communication service establishment request message.

Step 302: The KMC returns the encrypted session key to the EAS.

So that the EAS sends the encrypted session key to the first terminal device, so that the first terminal device can use the session key to implement secure communication with the second terminal device .

The encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key.

The identification information of the first terminal device and the identification information of the second terminal device included in the parameter information for obtaining the session key.

In step 302, the manner in which the KMC returns the encrypted session key to the EAS includes but is not limited to:

First, the KMC generates a session key required for performing a secure communication service between the first terminal device and the second terminal device.

It should be noted that, after the KMC receives the session key request message sent by the EAS, the generated session key may be randomly generated, or it may be based on the information carried in the session key request message and used to obtain the session key. The parameter information is determined, for example, the session key is generated by using the random number information in the parameter information for obtaining the session key, etc., which is not limited here.

Secondly, in order to ensure the security of the session key transmission in the communication link, KMC encrypts the generated session key.

Since the KMC is deployed by the user, the terminal device used by the user can first register and log in to the KMC when communicating, and when logging in, the KMC generates a protection key for the terminal device, and the KMC stores the identification information of the terminal device locally. The corresponding relationship with the protection key, then when the subsequent terminal device initiates a confidential communication service, the KMC can use the protection key to encrypt the generated session key, which can ensure that the session key is in the communication link transmission process. It also enables the terminal to accurately decrypt the encrypted session key to obtain the real session key when receiving the encrypted session key, which improves the efficiency of confidential communication services and ensures the security of communication.

At this time, the KMC determines, according to the identification information of the first terminal device included in the parameter information for acquiring the session key, that the first terminal device corresponding to the identification information of the first terminal device is logging into the KMC The first protection key generated when the first protection key is generated, and the generated session key is encrypted by using the first protection key to obtain a session key encrypted by the first protection key; The identification information of the second terminal device included in the parameter information of the key, to determine the second protection key generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC; and using The second protection key performs an encryption operation on the generated session key to obtain a session key encrypted with the second protection key.

Finally, the KMC uses the session key encrypted with the first protection key and the session key encrypted with the second protection key as the encrypted session key, and sends the key response message to the encrypted session key. the EAS.

Embodiment 4:

As shown in FIG. 6 , a schematic flowchart of a method for processing a secure communication service provided by Embodiment 4 of the present invention. Embodiment 4 of the present invention is an invention under the same inventive concept as Embodiment 1 to Embodiment 3 of the present invention. Embodiment 4 of the present invention takes the example that terminal device A and terminal device B need to perform secure communication services to describe the present invention. The technical solution is described in detail. The method can be as follows.

It should be noted that the time when the terminal device A and the terminal device B need to perform the confidential communication service may be when the call between the terminal device A and the terminal device B is established, or after the call between the terminal device A and the terminal device B is established. Do limit.

Step 1: When the user initiates a secure communication call to the terminal device B through the terminal device A, a call establishment request message is initiated to the IMS network.

The call establishment request message may be an INVITE message, which is used to inform the IMS core network that an encrypted session connection needs to be established with the terminal device B.

The call establishment request message includes identification information (or phone number information) of terminal device A and identification information (or phone number information) of terminal device B.

At this time, the call establishment request message also carries a session key request message.

In another embodiment of the present invention, the call establishment request message sent by terminal device A with terminal device B can also be only used to inform the IMS core network that a session connection needs to be established with terminal device B; at the same time, terminal device A A session key request message is sent through IMS signaling (eg, a MESSAGE message), and the session key request message is used to inform the IMS network that an encrypted session connection needs to be established between terminal device A and terminal device B.

Step 2: When the EAS receives the call establishment request message, it determines the user domain to which the terminal device A and the terminal device B belong according to the identification information of the terminal device A and the identification information of the terminal device B, and sends a key in the user domain to a key in the user domain. The management center sends a session key request message.

Step 3: KMC generates a session key for terminal device A and terminal device B, and sends a key response message to EAS.

Wherein, the key response message includes the encrypted session key.

In order to ensure that the session key is not leaked during the transmission process, the KMC encrypts and protects the session key using the protection keys generated when terminal device A and terminal device B log in to the KMC respectively.

Step 4: After the EAS sends the session key request message to the KMC, it immediately forwards the call establishment request message to the terminal device B.

In this way, when the session key is requested, the call connection is performed in parallel, so as to improve the processing efficiency.

In another embodiment of the present invention, after the EAS sends the session key request message to the KMC, it waits for the KMC to return a response message.

After receiving the session key response message sent by the KMC, the call setup request message is forwarded to the terminal device B to continue the call connection.

Step 5: The EAS receives the session processing message returned by the terminal device B.

The session processing message is returned by the terminal device B after processing the received call establishment request message.

In another embodiment of the present invention, if the EAS has not received the session key response message sent by the KMC when receiving the session processing message, the EAS needs to wait for the feedback from the KMC.

Step 6: The EAS carries the encrypted session key in the key response message fed back by the KMC in the session processing message and sends it to the terminal device A.

At this time, in another embodiment of the present invention, the EAS sends the secret communication key in the session key response message fed back by the KMC to the terminal device A and the terminal device B by using IMS signaling.

Step 7: After receiving the encrypted session key, the terminal device A uses the first protection key generated when logging in to the KMC to decrypt to obtain the session key generated by the KMC for this call.

In another embodiment of the present invention, terminal device A sends the received encrypted session key to terminal device B in the following ways:

The first way:

The first terminal device sends the encrypted session key to the second terminal device through IMS network signaling.

Specifically, regardless of whether the media plane data transmission channel between the first terminal device and the second terminal device is established, when the first terminal receives the session key sent by the EAS, it uses IMS network signaling to encrypt the encrypted The session key is sent to the second terminal device.

Alternatively, the first terminal device sends the encrypted session key to the second terminal device through a temporary response confirmation message PRACK183.

For example, in order to save system signaling overhead, a signaling piggyback transmission method may be adopted, that is, when the first terminal device receives the encrypted session key transmitted by the call setup response message sent by the EAS through the second terminal device, After correct processing of the call setup response message, when a temporary confirmation message PRACK is returned to the second terminal device, the encrypted session key is carried in the temporary confirmation message PRACK and sent to the second terminal device.

The second way:

The first terminal device sends the encrypted session key to the second terminal device through the established media plane data transmission channel with the second terminal device.

Specifically, when the first terminal device receives the session key sent by the EAS and determines that the establishment of the media plane transmission channel with the second terminal device is completed, the encrypted The session key is sent to the second terminal device.

Step 8: After receiving the encrypted session key, the terminal device B uses the second protection key generated when logging in to the KMC to decrypt to obtain the session key generated by the KMC for this call.

Step 9: When the call link is established, the terminal equipment A and the terminal equipment B encrypt the call data by using the obtained session key, so as to realize the encrypted call between the terminal equipment A and the terminal equipment B.

It should be noted that the fourth embodiment of the present invention is a rough description of the processing flow of the confidential communication service, and the technical details involved may adopt the technical solutions described in the first to third embodiments of the present invention, which will not be described in detail here. .

Embodiment 5:

As shown in FIG. 7 , it is a schematic structural diagram of an encryption application server used for a secure communication service according to Embodiment 5 of the present invention. The fifth embodiment of the present invention is an invention under the same inventive concept as the first to fourth embodiments of the present invention. The encryption application server includes: a receiving module 11, a sending module 12, and a processing module 13, wherein:

A receiving module 11, configured to receive a secure communication service establishment request message sent by a first terminal device, wherein the secure communication service establishment request message is used to indicate that secure communication needs to be established between the first terminal device and the second terminal device service, the confidential communication service establishment request message includes parameter information for obtaining the session key;

The sending module 12 is configured to carry the parameter information for obtaining the session key in the session key request message and send it to the key management center KMC to which the first terminal device and the second terminal device belong, wherein , the session key request message is used to represent a request for the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device;

A processing module 13, configured to receive the encrypted session key returned by the KMC, and send the encrypted session key to the first terminal device, so that the first terminal device can use the session key secret communication between the key implementation and the second terminal device, wherein the encrypted session key is the session key generated by the KMC according to the pair of parameter information used to obtain the session key obtained after encryption.

Specifically, the parameter information for acquiring the session key includes the identification information of the first terminal device and the identification information of the second terminal device.

The encrypted application server further includes: a determination module 14, wherein:

The determining module 14 is used to carry the parameter information for obtaining the session key in the session key request message and send it to the key management center KMC to which the first terminal device and the second terminal device belong. , according to the identification information of the first terminal device and the identification information of the second terminal device, determine the key management center KMC to which the first terminal device and the second terminal device belong.

Specifically, the processing module 13 is further configured to send the encrypted session key to the second terminal device, so that the second terminal device can use the session key to communicate with the first terminal device confidential communications between them.

The processing module 13 is specifically configured to send the encrypted session key to the first terminal device and/or the second terminal device through IMS network signaling.

Specifically, the encrypted session key includes a session key encrypted with the first protection key and a session key encrypted with the second protection key;

The encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key, including:

The KMC determines, according to the identification information of the first terminal device included in the parameter information for obtaining the session key, that the first terminal device corresponding to the identification information of the first terminal device is logged into the KMC. generating the first protection key, and using the first protection key to perform an encryption operation on the generated session key to obtain a session key encrypted with the first protection key; and

According to the identification information of the second terminal device included in the parameter information for obtaining the session key, determine the first terminal device generated when the second terminal device corresponding to the identification information of the second terminal device logs in to the KMC. two protection keys, and the generated session key is encrypted by using the second protection key to obtain a session key encrypted by the second protection key.

It should be noted that, the encryption application server described in Embodiment 5 of the present invention may be a physical entity unit implemented by hardware, or may be a logical component implemented by software, which is not specifically limited here.

Embodiment 6:

As shown in FIG. 8 , it is a schematic structural diagram of a terminal device for executing a secure communication service according to Embodiment 6 of the present invention. Embodiment 6 of the present invention is an invention under the same inventive concept as Embodiment 1 to Embodiment 4 of the present invention. The terminal device includes: a request message sending module 21 and a session key receiving module 22, wherein:

The request message sending module 21 is configured to send a secure communication service establishment request message to the encryption application server EAS, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device A communication service, wherein the confidential communication service establishment request message includes parameter information for obtaining a session key;

The session key receiving module 22 is configured to receive the encrypted session key sent by the EAS, wherein the encrypted session key is the parameter information that the EAS carries in the parameter information for obtaining the session key. The session key request message is sent to the key management center KMC to which the first terminal device and the second terminal device belong, and the KMC encrypts the generated session key according to the parameter information for obtaining the session key. The session key request message is obtained by encrypting the key, and the session key request message is used to represent a request for the KMC to generate a session key for the secure communication service that needs to be established between the first terminal device and the second terminal device.

Optionally, the terminal device further includes: a processing module 23, wherein:

The processing module 23 is configured to send the encrypted session key to the second terminal device when receiving the encrypted session key sent by the EAS.

The processing module 23 is specifically configured to send the encrypted session key to the second terminal device through IMS network signaling;

or,

The encrypted session key is sent to the second terminal device through the established media plane data transmission channel with the second terminal device.

The terminal device also includes: a decryption module 24, wherein:

The decryption module 24 is used to decrypt the encrypted session key using the first protection key generated when logging in to the KMC when receiving the encrypted session key sent by the EAS to obtain the KMC A session key generated for a secure communication service between the first terminal device and the second terminal device.

It should be noted that the terminal device described in Embodiment 6 of the present invention may be a physical entity unit implemented by hardware, or may be a logical component implemented by software, which is not specifically limited here.

In addition, the sixth embodiment of the present invention further includes an IP communication module and a cryptographic communication module.

Among them, the IP communication module supports the SIP communication protocol, has IMS communication capabilities, and supports functions such as terminal login/logout, identity authentication, call control and processing in the IMS system; the cryptographic module is responsible for terminal key management and executes encryption and decryption algorithms. On the side, it implements signaling interaction with the KMC to obtain the session key. On the media side, the acquired session key is used to establish a security association with the peer device, so as to realize the secure transmission of communication services.

Embodiment 7:

As shown in FIG. 9 , it is a schematic structural diagram of a key management center for a secure communication service according to Embodiment 7 of the present invention. Embodiment 7 of the present invention is an invention under the same inventive concept as Embodiment 1 to Embodiment 4 of the present invention. The key management center includes: a key request receiving module 31 and a key sending module 32, wherein:

The key request receiving module 31 is configured to receive a session key request message sent by the encryption application server EAS, wherein the session key request message is used to represent the request for the KMC to be between the first terminal device and the second terminal device. The confidential communication service that needs to be established generates a session key, and the session key request message includes parameter information for obtaining the session key, and the parameter information for obtaining the session key is all received by the EAS. carried in a secure communication service establishment request message sent by the first terminal device and used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device; and

A key sending module 32, configured to return the encrypted session key to the EAS, so that the EAS sends the encrypted session key to the first terminal device, so that the first terminal device The confidential communication with the second terminal device can be realized by using the session key, wherein the encrypted session key is a pair of the KMC according to the parameter information used to obtain the session key. The generated session key is obtained after encryption processing.

Specifically, the identification information of the first terminal device and the identification information of the second terminal device included in the parameter information for obtaining the session key;

The key sending module 32 is specifically configured to generate a session key required for performing a secure communication service between the first terminal device and the second terminal device, according to the parameter information used to obtain the session key. The identification information of the first terminal device contained in the identification information of the first terminal device, determine the first protection key generated by the first terminal device corresponding to the identification information of the first terminal device when logging in the KMC, and use the first protection key encrypting the generated session key with the key to obtain a session key encrypted with the first protection key; and

According to the identification information of the second terminal device included in the parameter information for acquiring the session key, determine the second protection generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC and use the second protection key to encrypt the generated session key to obtain a session key encrypted by the second protection key;

The session key encrypted with the first protection key and the session key encrypted with the second protection key are used as the encrypted session key, and sent to the EAS through a key response message.

It should be noted that the key management center described in Embodiment 7 of the present invention may be a physical entity unit implemented by hardware or a logical component implemented by software, which is not specifically limited here.

Embodiment 8:

As shown in FIG. 10 , it is a schematic structural diagram of a system for processing a confidential communication service according to Embodiment 8 of the present invention. The system includes: an encryption application server 41 , a key management center 42 , a first terminal device 43 and a second Terminal equipment 44, wherein:

The first terminal device 43 is configured to send a secure communication service establishment request message to the encrypted application server EAS, and receive the encrypted session key sent by the EAS, wherein the secure communication service establishment request message is used to represent the A secure communication service needs to be established between the first terminal device and the second terminal device, and the secure communication service establishment request message includes parameter information for acquiring a session key.

The encryption application server 41 is configured to receive a secure communication service establishment request message sent by the first terminal device, and carry the parameter information used to obtain the session key in the session key request message and send it to the first terminal device and the user. The key management center KMC to which the second terminal device belongs, receives the encrypted session key returned by the KMC, and sends the encrypted session key to the first terminal device, wherein the encrypted session key is sent to the first terminal device. The session key request message is used to represent a request for the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device.

The key management center 42 is configured to receive the session key request message sent by the encrypted application server EAS, and return the encrypted session key to the EAS, wherein the encrypted session key is the The KMC is obtained by encrypting the generated session key according to the parameter information used to obtain the session key.

Specifically, the parameter information for obtaining the session key includes the identification information of the first terminal device and the identification information of the second terminal device;

The encryption application server 41 is configured to carry the parameter information for obtaining the session key in the session key request message and send it to the key management system to which the first terminal device and the second terminal device belong. Before the center KMC, according to the identification information of the first terminal device and the identification information of the second terminal device, determine the key management center KMC to which the first terminal device and the second terminal device belong.

The encryption application server 41 is further configured to send the encrypted session key to the second terminal device, so that the second terminal device can use the session key to implement communication with the first terminal device. confidential communications.

The encryption application server 41 is specifically configured to send the encrypted session key to the first terminal device and/or the second terminal device through IMS network signaling.

The first terminal device 43 is configured to send the encrypted session key to the second terminal device when receiving the encrypted session key sent by the EAS.

The first terminal device 43 is specifically configured to send the encrypted session key to the second terminal device through IMS network signaling;

or,

The encrypted session key is sent to the second terminal device through the established media plane data transmission channel with the second terminal device.

The encrypted session key includes a session key encrypted with the first protection key and a session key encrypted with the second protection key;

The first terminal device 43 is configured to decrypt the encrypted session key using the first protection key generated when logging in to the KMC when receiving the encrypted session key sent by the EAS, The session key generated by the KMC for the secure communication service between the first terminal device and the second terminal device is obtained.

The key management center 42 is specifically configured to generate a session key required for performing a secure communication service between the first terminal device and the second terminal device, according to the parameter information used to obtain the session key. The identification information of the first terminal device contained in the identification information of the first terminal device, determine the first protection key generated by the first terminal device corresponding to the identification information of the first terminal device when logging in the KMC, and use the first protection key encrypting the generated session key with the key to obtain a session key encrypted with the first protection key; and

According to the identification information of the second terminal device included in the parameter information for acquiring the session key, determine the second protection generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC and use the second protection key to encrypt the generated session key to obtain a session key encrypted by the second protection key;

The session key encrypted with the first protection key and the session key encrypted with the second protection key are used as the encrypted session key, and sent to the EAS through a key response message.

As will be appreciated by those skilled in the art, embodiments of the present invention may be provided as a method, an apparatus (apparatus), or a computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (apparatus) and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Although preferred embodiments of the present invention have been described, additional changes and modifications to these embodiments may occur to those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be construed to include the preferred embodiment and all changes and modifications that fall within the scope of the present invention.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention. Thus, provided that these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims (19)

1. a processing method of confidential communication service, is characterized in that, comprises: The encryption application server EAS receives a secure communication service establishment request message sent by the first terminal device, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, The confidential communication service establishment request message includes parameter information for obtaining the session key; The EAS carries the parameter information for acquiring the session key in the session key request message and sends it to the key management center KMC to which the first terminal device and the second terminal device belong, wherein the The session key request message is used to represent a request to the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device; The EAS receives the encrypted session key returned by the KMC, and sends the encrypted session key to the first terminal device, so that the first terminal device can use the session key to achieve In the confidential communication with the second terminal device, the encrypted session key is sent to the second terminal device, so that the second terminal device can use the session key to communicate with the first terminal Secure communication between devices, wherein the encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key. 2. The method according to claim 1, wherein the parameter information for acquiring the session key includes the identification information of the first terminal device and the identification information of the second terminal device; Before the EAS carries the parameter information for acquiring the session key in the session key request message and sends it to the key management center KMC to which the first terminal device and the second terminal device belong, the Methods also include: The EAS determines, according to the identification information of the first terminal device and the identification information of the second terminal device, the key management center KMC to which the first terminal device and the second terminal device belong. 3. The method according to claim 1, wherein the EAS sends the encrypted session key to the first terminal device and/or the second terminal device, comprising: The EAS sends the encrypted session key to the first terminal device and/or the second terminal device through IMS network signaling. 4. The method according to any one of claims 1 to 2, wherein the encrypted session key comprises a session key encrypted with the first protection key and a session key encrypted with the second protection key the session key; The encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key, including: The KMC determines, according to the identification information of the first terminal device included in the parameter information for obtaining the session key, that the first terminal device corresponding to the identification information of the first terminal device is logged into the KMC. generating the first protection key, and using the first protection key to perform an encryption operation on the generated session key to obtain a session key encrypted with the first protection key; and According to the identification information of the second terminal device included in the parameter information for obtaining the session key, determine the first terminal device generated when the second terminal device corresponding to the identification information of the second terminal device logs in to the KMC. two protection keys, and the generated session key is encrypted by using the second protection key to obtain a session key encrypted by the second protection key. 5. A method for processing confidential communication services, comprising: The first terminal device sends a secure communication service establishment request message to the encryption application server EAS, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, so The secure communication service establishment request message includes parameter information for obtaining the session key; The first terminal device receives the encrypted session key sent by the EAS, and sends the encrypted session key to the second terminal device, wherein the encrypted session key is the The EAS carries the parameter information for obtaining the session key in the session key request message and sends it to the key management center KMC to which the first terminal device and the second terminal device belong, and the KMC is based on the key management center KMC. The parameter information for obtaining the session key is obtained by encrypting the generated session key, and the session key request message is used to represent that the KMC is requested to be the first terminal device and the second terminal device. The secret communication service that needs to be established between terminal devices generates a session key. 6. The method according to claim 5, wherein sending the encrypted session key to the second terminal device by the first terminal device comprises: sending, by the first terminal device, the encrypted session key to the second terminal device through IMS network signaling; or, The first terminal device sends the encrypted session key to the second terminal device through the established media plane data transmission channel with the second terminal device. 7. The method of claim 5, wherein the method further comprises: When receiving the encrypted session key sent by the EAS, the first terminal device decrypts the encrypted session key by using the first protection key generated when logging in to the KMC to obtain the KMC. A session key generated for a secure communication service between the first terminal device and the second terminal device. 8. A method for processing confidential communication services, comprising: The key management center KMC receives the session key request message sent by the encryption application server EAS, wherein the session key request message is used to represent the request for the KMC to be a secret that needs to be established between the first terminal device and the second terminal device. The communication service generates a session key, the session key request message includes parameter information for obtaining the session key, and the parameter information for obtaining the session key is the first terminal received by the EAS. carried in a secure communication service establishment request message that is sent by the device and is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device; and Return the encrypted session key to the EAS, so that the EAS sends the encrypted session key to the first terminal device, so that the first terminal device can use the session key to realize secure communication with the second terminal device, and send the encrypted session key to the second terminal device, so that the second terminal device can use the session key to communicate with the first terminal device Secure communication between terminal devices, wherein the encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key. 9. The method according to claim 8, wherein the identification information of the first terminal device and the identification information of the second terminal device included in the parameter information for obtaining the session key; The KMC returns the encrypted session key to the EAS, including: The KMC generates a session key required for performing a secure communication service between the first terminal device and the second terminal device; According to the identification information of the first terminal device included in the parameter information for obtaining the session key, the KMC determines that the first terminal device corresponding to the identification information of the first terminal device is generated when logging in to the KMC. a first protection key, and perform an encryption operation on the generated session key by using the first protection key to obtain a session key encrypted by using the first protection key; and According to the identification information of the second terminal device included in the parameter information for acquiring the session key, determine the second protection generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC and use the second protection key to encrypt the generated session key to obtain a session key encrypted by the second protection key; The KMC uses the session key encrypted with the first protection key and the session key encrypted with the second protection key as the encrypted session key, and sends it to the KMC through a key response message. EAS. 10. An encrypted application server for secure communication service, characterized in that, comprising: A receiving module, configured to receive a secure communication service establishment request message sent by a first terminal device, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device , the confidential communication service establishment request message includes parameter information for obtaining the session key; A sending module, configured to carry the parameter information for obtaining the session key in a session key request message and send it to the key management center KMC to which the first terminal device and the second terminal device belong, wherein, The session key request message is used to represent a request to the KMC to generate a session key for a secure communication service that needs to be established between the first terminal device and the second terminal device; A processing module, configured to receive the encrypted session key returned by the KMC, and send the encrypted session key to the first terminal device, so that the first terminal device can use the session key The encrypted session key is used to implement secure communication with the second terminal device, and the encrypted session key is sent to the second terminal device, so that the second terminal device can use the session key to communicate with the second terminal device. A confidential communication between terminal devices, wherein the encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key. 11. The encrypted application server according to claim 10, wherein the parameter information for acquiring the session key includes the identification information of the first terminal device and the identification information of the second terminal device ; The encrypted application server also includes: A determining module, configured to carry the parameter information for obtaining the session key in the session key request message and send it to the key management center KMC to which the first terminal device and the second terminal device belong, The key management center KMC to which the first terminal device and the second terminal device belong is determined according to the identification information of the first terminal device and the identification information of the second terminal device. 12. The encrypted application server of claim 10, wherein: The processing module is specifically configured to send the encrypted session key to the first terminal device and/or the second terminal device through IMS network signaling. 13. The encrypted application server according to any one of claims 10 to 11, wherein the encrypted communication service key comprises a communication service key encrypted with the first protection key and a communication service key encrypted with the second protection key The communication service key encrypted by the key; The encrypted session key is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key, including: The KMC determines, according to the identification information of the first terminal device included in the parameter information for obtaining the session key, that the first terminal device corresponding to the identification information of the first terminal device is logged into the KMC. generating the first protection key, and using the first protection key to perform an encryption operation on the generated session key to obtain a session key encrypted with the first protection key; and According to the identification information of the second terminal device included in the parameter information for obtaining the session key, determine the first terminal device generated when the second terminal device corresponding to the identification information of the second terminal device logs in to the KMC. two protection keys, and the generated session key is encrypted by using the second protection key to obtain a session key encrypted by the second protection key. 14. A terminal device for performing confidential communication services, comprising: a request message sending module, configured to send a secure communication service establishment request message to the encryption application server EAS, wherein the secure communication service establishment request message is used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device, The confidential communication service establishment request message includes parameter information for obtaining the session key; A session key receiving module, configured to receive the encrypted session key sent by the EAS, and send the encrypted session key to the second terminal device, wherein the encrypted session key It is the EAS that carries the parameter information for obtaining the session key in the session key request message and sends it to the key management center KMC to which the first terminal device and the second terminal device belong, and the The session key request message is obtained after the KMC encrypts the generated session key according to the parameter information for obtaining the session key, and the session key request message is used to indicate that the KMC is requested to be the first terminal device and the session key. The secret communication service that needs to be established between the second terminal devices generates a session key. 15. The terminal device of claim 14, further comprising: a processing module, specifically configured to send the encrypted session key to the second terminal device through IMS network signaling; or, The encrypted session key is sent to the second terminal device through the established media plane data transmission channel with the second terminal device. 16. The terminal device according to claim 14, wherein the terminal device further comprises: The decryption module is configured to decrypt the encrypted session key using the first protection key generated when logging in to the KMC when receiving the encrypted session key sent by the EAS, and obtain the KMC as: The session key generated by the secure communication service between the first terminal device and the second terminal device. 17. A key management center for confidential communication services, characterized in that, comprising: The key request receiving module is configured to receive a session key request message sent by the encryption application server EAS, wherein the session key request message is used to represent that the request KMC is a request that needs to be established between the first terminal device and the second terminal device. The confidential communication service generates a session key, and the session key request message includes parameter information for obtaining the session key, and the parameter information for obtaining the session key is the first received by the EAS. carried in a secure communication service establishment request message sent by a terminal device and used to indicate that a secure communication service needs to be established between the first terminal device and the second terminal device; and A key sending module, configured to return the encrypted session key to the EAS, so that the EAS sends the encrypted session key to the first terminal device, so that the first terminal device can Use the session key to implement secure communication with the second terminal device, and send the encrypted session key to the second terminal device, so that the second terminal device can use the session key secret communication with the first terminal device, wherein the encrypted session key is the session key generated by the KMC according to the parameter information for obtaining the session key. obtained after encryption. 18. The key management center according to claim 17, wherein the identification information of the first terminal device and the identification information of the second terminal device included in the parameter information for obtaining the session key; The key sending module is specifically configured to generate a session key required for performing a confidential communication service between the first terminal device and the second terminal device, according to the parameter information used to obtain the session key. Include the identification information of the first terminal device, determine the first protection key generated by the first terminal device corresponding to the identification information of the first terminal device when logging in the KMC, and use the first protection key. encrypting the generated session key with the key to obtain a session key encrypted with the first protection key; and According to the identification information of the second terminal device included in the parameter information for acquiring the session key, determine the second protection generated by the second terminal device corresponding to the identification information of the second terminal device when logging in to the KMC and use the second protection key to encrypt the generated session key to obtain a session key encrypted by the second protection key; The session key encrypted with the first protection key and the session key encrypted with the second protection key are used as the encrypted session key, and sent to the EAS through a key response message. 19. A system for processing confidential communication services, wherein the system comprises: the encrypted application server according to any one of claims 10 to 13, the terminal device according to any one of claims 14 to 16, and the The key management center according to any one of claims 17 to 18.