[go: up one dir, main page]

WO2023051679A1 - 一种呼叫处理的方法、相关设备以及存储介质 - Google Patents

一种呼叫处理的方法、相关设备以及存储介质 Download PDF

Info

Publication number
WO2023051679A1
WO2023051679A1 PCT/CN2022/122530 CN2022122530W WO2023051679A1 WO 2023051679 A1 WO2023051679 A1 WO 2023051679A1 CN 2022122530 W CN2022122530 W CN 2022122530W WO 2023051679 A1 WO2023051679 A1 WO 2023051679A1
Authority
WO
WIPO (PCT)
Prior art keywords
calling device
user
data
displayed
calling
Prior art date
Application number
PCT/CN2022/122530
Other languages
English (en)
French (fr)
Inventor
左俊
郭晓龙
林宏达
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023051679A1 publication Critical patent/WO2023051679A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1016—IP multimedia subsystem [IMS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data

Definitions

  • the present application relates to the communication field, and in particular to a call processing method, related equipment and a communication system.
  • IP multimedia subsystem IP multimedia subsystem
  • IMS IP multimedia subsystem
  • the first user may be counterfeit or tampered.
  • Signature-based handling of asserted information using toKENs (SHAKEN) technology to sign the relevant information of the first user's call request message to generate signature information, which can be called number, called number, time stamp, reputation rating and call source address, etc.
  • the called side verifies the signature information according to the public key.
  • the STIR or SHAKEN technology can only authenticate the number of the first user, but cannot authenticate various identity information of the first user.
  • the certification process does not involve the certification of corporate information.
  • the STIR/SHAKEN technology only involves the encryption and authentication process of information at the signaling level.
  • the invention provides a call processing method, related equipment and storage medium, which are used for sending safe data to be displayed to the second user during the process of the first user calling the second user, and can effectively improve the data to be displayed.
  • the amount of information contained in the data is not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, but not limited to, and storage medium, which are used for sending safe data to be displayed to the second user during the process of the first user calling the second user, and can effectively improve the data to be displayed. The amount of information contained in the data.
  • the first aspect of the embodiment of the present invention provides a call processing method, the method includes: the first calling device acquires a signature key; the first calling device acquires the data to be displayed of the first user, and the first A user calls a second calling device through the first calling device, and the data to be displayed includes information corresponding to the first user and/or information corresponding to an enterprise to which the first user belongs; the first The calling device signs the data to be displayed by using the signature key to obtain first verification signature information; the first calling device passes through the media channel between the first calling device and the second calling device, Sending the data to be displayed and the first verification signature information to the second calling device, where the first verification signature information is used to verify the security of the data to be displayed.
  • the first calling device shown in this aspect may be the first terminal used by the first user, or the first calling device may be at least one device included in the calling operator's network, for example, the first calling device may be The calling media server, calling application server AS, calling service-call session control function S-CSCF, calling proxy-call session control function P-CSCF or calling interworking session border controller included in the calling operator network I-SBC.
  • the first verification signature information sent by the first calling device to the second calling device is obtained by signing the data to be displayed, and the second calling device receives the data to be displayed and the first verification signature information, the security of the data to be displayed can be verified according to the first verification signature information, and the second terminal used by the second user can display the data to be displayed during the calling process, so that The second user determines whether the displayed data to be displayed has been tampered with or leaked.
  • the data to be displayed is transmitted via the media channel between the first calling device and the second calling device, the amount of data transmitted by the data to be displayed is effectively increased.
  • the method further includes: The first calling device sends a first indication message to the second calling device, the first indicating message is used to indicate that the first calling device supports the capability of signing the data to be displayed; the first calling device receiving a second indication message from the second calling device, where the second indication message is used to indicate that the second calling device supports a capability of verifying the security of the data to be displayed.
  • the negotiation between the first calling device and the second calling device can be carried out through the first indication message and the second indicating message, and when the second calling device receives the first indication message, it is determined that the first If the calling device supports the ability to sign the data to be displayed, the second calling device can return a second indication message to the first calling device, and the second calling device determines according to the second indication message that the second calling device supports verification of the data to be displayed.
  • the first calling device can send the data to be displayed and the first verification signature information to the second calling device, so as to ensure that the second calling device can verify the data to be displayed according to the first verification signature information security.
  • the acquisition by the first calling device of the data to be displayed of the first user includes: the first calling device receiving a call request message, the call request message carrying the data to be displayed Display Data.
  • the first calling device is a device included in the calling operator's network
  • the first calling device can receive a call request message from the first terminal
  • the call request message carries the data to be displayed
  • the first calling device receives the call request message After calling the request message, the data to be displayed can be obtained.
  • the obtaining, by the first calling device, the data to be displayed of the first user includes: receiving, by the first calling device, a call request message; The data to be displayed corresponding to the call request message.
  • the first calling device is a device included in the calling operator's network, and the first calling device can pre-store the data to be displayed, and after receiving the call request message from the first terminal, the first calling device can obtain the The data to be displayed corresponding to the call request message.
  • the acquiring the signature key by the first calling device includes: the first calling device sending a call request message to the second calling device, and the calling request message is Obtaining the signature key upon request; the first calling device receives a master key and a master salt key from the second calling device, and the master key and the master salt key are used for secure real-time transmission Protocol SRTP: the first calling device generates the signature key according to the master key and the master salt key.
  • the first calling device requests the second calling device to obtain the master key and the master salt key through the call request message, and the first calling device can derive the master key and the master salt key based on the secure real-time transport protocol SRTP
  • the first calling device shown in this aspect can obtain the signature key based on the secure real-time transport protocol SRTP, so as to implement the signature of the data to be displayed.
  • the first calling device receiving the master key and the master salt key from the second calling device includes: the first calling device receiving the master key and the master salt key from the second calling device
  • the signature information of the second calling device, the signature information includes the master key and the master salt key signed by the public key; the first calling device verifies the signature information through the private key to obtain the master key key and the master salt key.
  • the signature information received by the first calling device includes the master key and the master salt key signed by the public key, effectively avoiding the master key and the master salt key. If the master salt key is leaked or tampered with, the security of the data to be displayed is improved.
  • the information corresponding to the first user includes at least one of the following items: the name of the first user, the job number of the first user, the The avatar of the first user, the position information of the first user, the audio and video files related to the first user, or the information of the association to which the first user belongs;
  • the information corresponding to the enterprise to which the first user belongs includes at least one of the following: the name of the enterprise, the trademark of the enterprise, audio and video files related to the enterprise, or the name of the association to which the enterprise belongs. information.
  • the second aspect of the embodiment of the present invention provides a call processing method, the method includes: the second calling device receives the data to be displayed and the first verification signature information from the first calling device, and the first verification signature information is Sign the data to be displayed by using a signature key, and transmit the data to be displayed and the first verification signature information through a media channel between the first calling device and the second calling device, so
  • the data to be displayed includes information corresponding to the first user and/or information corresponding to the enterprise to which the first user belongs;
  • the second calling device signs the data to be displayed by using the signature key to obtain second verification signature information; if the second calling device determines that the first verification signature information is the same as the second verification signature information, determine that the data to be displayed has passed the security verification, and make the data to be displayed show.
  • the second calling device shown in this aspect may be the second terminal used by the second user, or the second calling device may be at least one device included in the network of the called operator, for example, the second calling device may be The called media server, called application server AS, called service-call session control function S-CSCF, called proxy-call session control function P-CSCF or called interworking session border controller included in the called operator network I-SBC.
  • the called media server called application server AS, called service-call session control function S-CSCF, called proxy-call session control function P-CSCF or called interworking session border controller included in the called operator network I-SBC.
  • the method further includes: the second calling device receiving a first indication message from the first calling device, where the first indication message is used to indicate that the first calling device supports the capability of signing the data to be displayed; A calling device sends a second indication message, where the second indication message is used to indicate that the second calling device supports a capability of verifying the security of the data to be displayed.
  • the method further includes: the second calling device sending the data to be displayed to a second terminal, the second terminal is a terminal used by a second user, and the second terminal is used to display the Data to be displayed.
  • the second calling device is a second terminal, and the second terminal is a terminal used by a second user, and if the second calling device determines that the The first verification signature information is the same as the second verification signature information, and after it is determined that the data to be displayed passes the security verification, the method further includes: displaying the data to be displayed by the second calling device.
  • the method further includes: the second calling device sending a notification message to the second terminal, where the notification message is used to indicate that the data to be displayed has passed the security verification.
  • the second calling device determines that the data to be displayed has passed the security verification, it sends notification information indicating that the data to be displayed has passed the security verification to the second terminal, and the second terminal can display the data after receiving the notification information.
  • the notification information is used to indicate that the data to be displayed has passed the security verification, so as to ensure that the second user determines that the displayed data to be displayed is safe according to the notification information displayed by the second terminal.
  • the method further includes: the second calling device receiving a call request message from the first call device, where the call request message is used to request to acquire the signature key; the second call device sends a master key to the first call device according to the call request message key and a master salt key, the master key and the master salt key are used for secure real-time transport protocol SRTP, and the master key and the master salt key are used to generate the verification signature.
  • the sending, by the second calling device, the master key and the master salt key to the first calling device according to the call request message includes: the second calling device signing the master key and the master salt key with a public key to obtain signature information; the second calling device sends the signature information to the first calling device.
  • the method further includes: the second calling device receiving a call request message from the first call device; sending the signature key to the first call device by the second call device according to the call request message.
  • the information corresponding to the first user includes at least one of the following items: the name of the first user, the job number of the first user, the The avatar of the first user, the position information of the first user, the audio and video files related to the first user, or the information of the association to which the first user belongs;
  • the information corresponding to the enterprise to which the first user belongs includes at least one of the following: the name of the enterprise, the trademark of the enterprise, audio and video files related to the enterprise, or information about the association to which the enterprise belongs .
  • the third aspect of the embodiment of the present invention provides a calling device, including: a first acquisition module, configured to acquire a signature key; a second acquisition module, configured to acquire data to be displayed of a first user, the first user being The user corresponding to the calling device, the data to be displayed includes information corresponding to the first user and/or information corresponding to the enterprise to which the first user belongs; a signature module, configured to The key signs the data to be displayed to obtain the first verification signature information; the sending module is configured to send the to-be-displayed data to the other calling device through the media channel between the calling device and another calling device data and the first verification signature information, where the first verification signature information is used to verify the security of the data to be displayed.
  • the sending module is further configured to send a first indication message to the other calling device, where the first indication message is used to indicate that the calling device supports The ability of the data signature to be displayed;
  • the calling device further includes a receiving module, the receiving module is used to receive a second indication message from the other calling device, and the second indication message is used to indicate that the other A calling device supports the ability to verify the security of said data to be displayed.
  • the second acquiring module is specifically configured to receive a call request message, where the call request message carries the data to be displayed.
  • the second acquiring module is specifically configured to receive a call request message; and acquire the data to be displayed corresponding to the call request message.
  • the first obtaining module is specifically configured to send a call request message to the other calling device, where the call request message is used to request to obtain the signature key ; Receive a master key and a master salt key from the other calling device, the master key and the master salt key are used for the secure real-time transport protocol SRTP; according to the master key and the master salt key to generate the signing key.
  • the first obtaining module is specifically configured to receive signature information from the other calling device, where the signature information includes the master secret signed by a public key key and the master salt key; verifying the signature information with a private key to obtain the master key and the master salt key.
  • the information corresponding to the first user includes at least one of the following items:
  • the name of the first user The name of the first user, the job number of the first user, the avatar of the first user, the position information of the first user, the audio and video files related to the first user, or the first user Information about the associations to which the user belongs;
  • the information corresponding to the enterprise to which the first user belongs includes at least one of the following items:
  • the name of the enterprise the trademark of the enterprise, the audio and video files related to the enterprise, or the information of the association to which the enterprise belongs.
  • the fourth aspect of the embodiment of the present invention provides a calling device, including: a receiving module, configured to receive data to be displayed and first verification signature information from another calling device, and the first verification signature information is a signature key Signing the data to be displayed to obtain, the data to be displayed and the first verified signature information are transmitted through the media channel between the other calling device and the calling device, the data to be displayed includes the information related to the first Information corresponding to the user and/or information corresponding to the enterprise to which the first user belongs, the first user is a user corresponding to the other calling device; a signature module, configured to use the signature key to pair the The data to be displayed is signed to obtain the second verification signature information; the verification module is used to determine that the data to be displayed has passed the security verification if it is determined that the first verification signature information is the same as the second verification signature information, so that The data to be displayed is displayed.
  • a receiving module configured to receive data to be displayed and first verification signature information from another calling device, and the first verification signature information is a signature key Signing the data to
  • the receiving module is further configured to receive a first indication message from the other calling device, where the first indication message is used to indicate that the other calling device The device supports the ability to sign the data to be displayed; and sends a second indication message to the other calling device, where the second indication message is used to indicate that the calling device supports the ability to verify the security of the data to be displayed.
  • the calling device further includes a sending module, configured to send the data to be displayed to a second terminal, where the second terminal is a terminal used by a second user, The second terminal is used to display the data to be displayed.
  • the calling device is a second terminal, the second terminal is a terminal used by a second user, and the calling device further includes a display module, and the display module Used to display the data to be displayed.
  • the sending module is further configured to send a notification message to the second terminal, where the notification message is used to indicate that the data to be displayed passes security verification.
  • the receiving module is further configured to receive a call request message from the other calling device, where the call request message is used to request to obtain the signature key;
  • the sending module is further configured to send a master key and a master salt key to the other calling device according to the call request message, the master key and the master salt key are used for secure real-time transport protocol SRTP , the master key and the master salt key are used to generate the verification signature.
  • the sending module is specifically configured to: use a public key to sign the master key and the master salt key to obtain signature information; The device sends the signature information.
  • the receiving module is further configured to receive a call request message from the other calling device; the sending module is further configured to send the call request message to the The other calling device sends the signing key.
  • the fifth aspect of the embodiment of the present invention provides a calling device, including a processor and a memory coupled to each other, where computer program codes are stored in the memory, and the processor invokes and executes the computer program codes in the memory, so that The calling device executes the method described in any one of the above first aspects.
  • the sixth aspect of the embodiment of the present invention provides a calling device, including a processor and a memory coupled to each other, where computer program codes are stored in the memory, and the processor invokes and executes the computer program codes in the memory, so that The calling device executes the method described in any one of the above second aspects.
  • the seventh aspect of the embodiments of the present invention provides a computer-readable storage medium, the storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method as described in any one of the first aspect to the second aspect above.
  • the eighth aspect of the embodiment of the present invention provides a communication system, including a first terminal, the calling device shown in the fifth aspect above, the calling device shown in the sixth aspect above, and a second terminal, the first terminal It is a terminal used by the first user, the calling device shown in the fifth aspect is a device included in the calling operator's network, and the calling device shown in the sixth aspect is a device included in the called operator's network, so The second terminal is a terminal used by a second user, and the first user calls the second user.
  • the ninth aspect of the embodiment of the present invention provides a communication system, including the calling device shown in the fifth aspect above, the calling operator network, the called operator network, and the calling device shown in the sixth aspect above, such as
  • the calling device shown in the fifth aspect above is the device used by the first user
  • the calling device shown in the sixth aspect above is the device used by the second user.
  • Fig. 1 is a structural example diagram of an embodiment of the calling communication system provided by the present application.
  • Fig. 2 is a flow chart of steps of an embodiment of the process of performing registration by the calling communication system provided by the present application;
  • Fig. 3 is a flow chart of the steps of an embodiment in which the calling communication system provided by the present application executes a call
  • FIG. 4 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call
  • FIG. 5 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call
  • FIG. 6 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call
  • FIG. 7 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call
  • FIG. 8 is a structural example diagram of an embodiment of the first calling device provided by the present application.
  • FIG. 9 is a structural example diagram of an embodiment of a second calling device provided by the present application.
  • Fig. 10 is a structural example diagram of an embodiment of a calling device provided in the present application.
  • the present application provides a method for call processing.
  • the structure of the calling communication system to which the method shown in the present application is applied is firstly described below in conjunction with FIG. 1 :
  • the first user can implement a call to the second user based on the calling communication system.
  • FIG. 1 is a structural example diagram of an embodiment of a calling communication system provided by the present application.
  • the calling communication system shown in this embodiment includes an operator management device 111, a calling operator network 120, and an enterprise network 130 connected in sequence.
  • This embodiment does not limit the specific network type of the calling operator network 120, for example , the network type of the calling operator network 120 is IMS, third generation partnership project (3rd generation partnership project, 3GPP) or China Communications Standards Association (china communications standards association, CCSA), and any network architecture that will appear in the future.
  • the calling operator network 120 is an IMS as an example.
  • Each device included in the calling operator network 120 will be described below. It should be clear that the description of each device type in this embodiment is optional and exemplary, and is not limited. The devices shown in this embodiment are also It can be called a network element.
  • the calling operator network 120 shown in this embodiment includes a network authentication server 121, and the network authentication server shown in this embodiment can also be called a third party account management (thirdparty account management, TAM) device.
  • TAM third party account management
  • the calling operator network 120 includes a calling media server 122, and the calling media server 122 can integrate a multimedia resource function processor (multimedia resource function processor, MRFP) and a multimedia resource function controller (multimedia resource function controller, MRFC).
  • the calling operator network 120 also includes a calling application server (application server, AS) 123 and a calling service-call session control function (serving-call session control function, S-CSCF) 124, and the calling S-CSCF 124 also integrates Interrogating-call session control function (interrogating-call session control function, I-CSCF).
  • the network authentication server 121 is respectively connected with the calling media server 122, the calling AS 123 and the calling S-CSCF 124, the calling media server 122 is connected with the calling AS 123, and the calling AS 123 is connected with the calling S-CSCF 124.
  • the calling S-CSCF 124 is respectively connected to the calling proxy-call session control function (proxy-call session control function, P-CSCF) and the calling interworking session border controller (interconnect-session border controller, I-SBC) 125, wherein, The calling P-CSCF126 also integrates an access-session border controller (A-SBC).
  • proxy-call session control function proxy-call session control function
  • I-SBC interworking session border controller
  • the structure of the enterprise network 130 shown in this embodiment will be described below. It should be noted that the description of the enterprise network 130 in this embodiment is an optional example and is not limited.
  • the enterprise network 130 specifically includes an enterprise authentication server 131 , an enterprise access proxy device 132 and a first terminal 133 .
  • the enterprise authentication server 131 is connected to the network authentication server 121 , the enterprise access proxy device 132 and the first terminal 133 respectively.
  • the enterprise access proxy device 132 is connected to the calling I-SBC 125 or the calling P-CSCF, and the first terminal 133 is connected to the calling P-CSCF 126 .
  • the enterprise access proxy device 132 may also be an enterprise voice relay device.
  • the first terminal 133 used by the first user may be any device in a smart terminal or a computer.
  • the first terminal has a built-in IMS software development kit (software development kit, SDK), so as to realize the call processing flow shown in this application.
  • the terminal when the first user calls the second user, he can send the calling card to the second user, and the second user (also called the called user) uses the second card.
  • the terminal When the terminal is ringing, it can display the calling card.
  • the calling card includes data to be displayed after being typesetting according to a preset typesetting method, and the data to be displayed includes at least one of the following items:
  • the information corresponding to the first user or the information corresponding to the enterprise to which the first user belongs.
  • the information corresponding to the first user may include one or more of the following items:
  • the name of the first user The name of the first user, the job number of the first user, the avatar of the first user, the position information of the first user, the audio and video files related to the first user or the information of the association to which the first user belongs, etc., wherein the first user
  • the name of a user may be the name of the first user, or may be a nickname of the first user, etc., which are not specifically limited in this embodiment.
  • the information corresponding to the enterprise to which the first user belongs may include one or more of the following:
  • Company name company trademark (LOGO)
  • pictures related to the company pictures related to the company, audio and video files related to the company, or information about the association to which the company belongs.
  • the information of the association may be the name of the association, the LOGO of the association, related pictures of the association, audio and video files related to the association, and the like.
  • This application does not limit the specific content of the data to be displayed included in the calling card and the specific typesetting method of the data to be displayed. This application can ensure that the calling card sent to the second user is safe during the process of the first user calling the second user, and can also effectively avoid the possibility that the calling card is tampered with or counterfeited, and prevent the second user from receiving Insecure data.
  • the registration processing flow is executed first, and based on the registration processing flow, the data to be displayed is sent to the calling operator network, and the calling operator The merchant network generates a calling card based on the data to be displayed from the first user.
  • the calling operator network has successfully obtained the calling card, and when the subsequent calling operator network calls the second user, the calling operator network does not need to obtain the calling card during the call process, but directly The calling card obtained in the registration phase is sent to the second user, which saves the amount of information exchanged between the calling operator network and the enterprise authentication server during the call process, shortens the call connection delay, and improves call efficiency. See Figure 2 for details.
  • Fig. 2 is a flow chart of an embodiment of the registration process of the calling communication system provided by the present application.
  • Step 201 the first terminal sends a login request to the enterprise authentication server.
  • the first terminal sends a login request to the enterprise authentication server as an example for illustration.
  • the enterprise access proxy device may also send the login request to the enterprise authentication server, which is not limited.
  • the first terminal can run an enterprise application program (APP), and the first terminal can implement the process performed by the first terminal in the call processing method shown in this application through the enterprise APP.
  • APP enterprise application program
  • the first terminal may send the login request to the enterprise authentication server, where the login request includes the first user identifier of the first user.
  • the first user identifier (also referred to as UserID) shown in this embodiment may be the email address of the first user, for example, zhangsan@xxx.com.
  • the first user ID shown in this embodiment is different from the existing E.164 number. It can be seen that the first user ID is a heterogeneous ID for the calling operator network.
  • the first user ID shown in this application is When the second user makes a call, what is used is not the E.164 number, but the first user identifier (that is, the email address of the first user) provided by this embodiment as a heterogeneous identifier.
  • Step 202 the first terminal receives the registration authentication identifier from the enterprise authentication server.
  • the enterprise authentication server shown in this embodiment can assign a registration authentication ID to the first user ID, and the registration authentication ID is used to register to the calling operator network.
  • This embodiment does not limit the registration authentication identifier, and this embodiment takes the registration authentication identifier as a token (token) as an example for illustration.
  • Step 203 the first terminal sends a registration request to the calling S-CSCF.
  • the registration request includes the first user identifier of the first user and the registration authentication identifier.
  • the registration request shown in this embodiment is a session initiation protocol (session initiation protocol, SIP) registration (REGISTER) message, and the registration request needs to carry the first user identifier of the first user and the registration authentication identifier.
  • SIP session initiation protocol
  • REGISTER session initiation protocol
  • the token shown in this embodiment can use an encoding format based on 64 printable characters to represent binary data (Base64).
  • the token can be carried through the Authorization header field and extended authentication methods (such as Bearer), such as message
  • the format can be: Authorization:Bearer ⁇ Base64( ⁇ token>)>.
  • the SIP REGISTER message may specifically be as follows:
  • the first terminal 133 sends the registration request to the calling P-CSCF 126, and the calling P-CSCF forwards the registration request to the calling S-CSCF 124, wherein the calling P-CSCF follows the SIP user registration
  • the standard procedure (see 3GPP TS 24.229) processes the SIP REGISTER message and forwards it to the calling S-CSCF.
  • Step 204 the calling S-CSCF sends the first user ID and the registration authentication ID to the network authentication server.
  • the calling S-CSCF judges that the registration request uses the Bearer authentication mode, it sends the first user ID and the registration authentication ID to the network authentication server to request the network authentication server to use the registration authentication ID to authenticate the first user .
  • Step 205 the network authentication server sends an authentication request to the enterprise authentication server.
  • the network authentication server shown in this embodiment receives the first user identifier, it can determine the corresponding enterprise authentication server according to the first user identifier.
  • the first user ID shown in this embodiment is the user's email address (for example, zhangsan@xxx.com), and then the network authentication server can obtain the enterprise domain name (for example, xxx.com) from the first user ID. com). The network authentication server can query the address of the enterprise authentication server according to the enterprise domain name.
  • the network authentication server shown in this step determines the corresponding
  • the enterprise authentication server restores the escaped first user ID (zhangsan%40xxx.com) to obtain the restored first user ID (zhangsan@xxx.com) .
  • the network authentication server can query the address of the corresponding enterprise authentication server according to the restored and escaped first user ID.
  • the authentication request sent by the network authentication server to the enterprise authentication server shown in this embodiment includes a registration authentication identifier.
  • the authentication request may be sent through a hypertext transfer protocol over securesocket layer (HTTPS).
  • HTTPS securesocket layer
  • Step 206 the enterprise authentication server judges whether the registration authentication identifier is valid, if not, execute step 207, and if yes, execute step 208.
  • the registration authentication identification shown in this embodiment is token, and then the enterprise authentication server can judge whether the token is within the validity period.
  • the validity period can be an absolute validity period.
  • the moment is A2, and the moment A1 and the moment A2 can be any two different moments. If the enterprise authentication server determines that the token is within the validity period, the enterprise authentication server determines that the token is valid; if the enterprise authentication server determines that the token is outside the validity period, the enterprise authentication server determines that the token is invalid.
  • the validity period can be the remaining valid time. It can be seen that if the remaining valid time corresponding to the registration authentication identifier has remaining time, the enterprise authentication server judges that the token is valid. If the remaining valid duration corresponding to the registration authentication identifier is no longer In the remaining time, the enterprise authentication server judges that the token is invalid.
  • Step 207 the enterprise authentication server sends an invalidation notification of the authentication identifier to the network authentication server.
  • the enterprise authentication server shown in this embodiment sends the authentication token invalidation notification to the network authentication server, and the authentication token invalidation notification is used to indicate that the registered authentication token (token) is invalid.
  • the network authentication server receives the notification that the authentication identifier is invalid, it will no longer execute the procedures related to the registration of the first user.
  • Step 208 the enterprise authentication server sends an authentication success indication to the network authentication server.
  • the authentication success indication shown in this embodiment includes a valid authentication token notification, and the valid authentication token notification is used to indicate that the registered authentication token (token) is valid.
  • the authentication success indication shown in this embodiment also includes a second user identifier.
  • the enterprise authentication server pre-creates the corresponding relationship between different user identifiers and different authentication identifiers, and the enterprise authentication server determines the registration authentication If the identifier is valid, the enterprise authentication server can send the second user identifier corresponding to the valid registration authentication identifier to the network authentication server.
  • the authentication success indication shown in this embodiment may include at least one of the following:
  • Step 209 the network authentication server sends the data to be displayed to the calling application server.
  • the network authentication server when the network authentication server determines that the first user has passed the authentication, the network authentication server can send the acquired data to be displayed to the calling application server.
  • the data to be displayed includes information corresponding to the first user and/or information corresponding to the enterprise to which the first user belongs.
  • information corresponding to the first user includes information corresponding to the enterprise to which the first user belongs.
  • FIG. 1 For specific description, please refer to the relevant description in FIG. 1 , and details are not repeated here.
  • the way for the network authentication server to obtain the data to be displayed may be that, when the enterprise authentication server determines that the registered authentication identifier is valid, the enterprise authentication server sends the data to be displayed to the network authentication server.
  • the network authentication server acquires the data to be displayed during the account opening stage of the enterprise.
  • the network authentication server obtains a part of the data to be displayed (such as information related to the first user) from the enterprise authentication server, and the network authentication server obtains another part of the data to be displayed (such as information related to the first user) during the account opening stage of the enterprise. information related to the enterprise), etc., which are not limited in this embodiment.
  • the network authentication server is responsible for authenticating the first user. Specifically, there are two conditions for the network authentication server to determine that the authentication is passed. One condition is that a valid notification of the authentication identifier has been received. Another condition is that the network authentication server determines that the first user ID and the second user ID are the same.
  • the enterprise authentication server is responsible for authenticating the first user, and the enterprise authentication server notifies the network authentication server of the authentication result.
  • the authentication request sent by the network authentication server to the enterprise authentication server includes all The first user ID
  • the enterprise authentication server sends a registration authentication success indication to the network authentication server after judging that the registration authentication ID is valid and the first user ID is the same as the second user ID
  • the network authentication server determines that the first user passes the authentication according to the registration authentication success indication.
  • Step 210 the calling application server obtains the calling card.
  • the calling application server is used to obtain the calling card as an example for illustration.
  • the device used to obtain the calling card may be any device included in the network of the calling operator.
  • the calling application server shown in this embodiment can receive the data to be displayed from the network authentication server, and the calling application server can format the data to be displayed according to the typesetting method of the calling card to obtain the calling card.
  • the typesetting method of the calling card can be sent to the network authentication server during the account opening stage of the enterprise, and for another example, the typesetting method of the calling card can be sent to the calling application server by the network authentication server in the process of step 209, That is, when the network authentication server determines that the first user has passed the authentication, the network authentication server can send the layout of the calling card to the calling application server.
  • the typesetting method of the call card refers to the display method and display position of the information corresponding to the first user and/or the information corresponding to the enterprise to which the first user belongs in the generated call card.
  • the name of the first user For example, the name of the first user, the job number of the first user, the avatar of the first user, the position information of the first user, the audio and video files related to the first user, the information of the association to which the first user belongs, the name of the company, The display method and display position of the enterprise logo, enterprise-related pictures, enterprise-related audio and video files, and association information to which the enterprise belongs, etc., in the calling card.
  • This method takes the calling card stored in the calling application server as an example for illustration.
  • the calling application server After the calling application server obtains the calling card, the calling application server sends the generated calling card to the file server for storage. , and record the storage address of the calling card locally.
  • the network authentication server forwards the data to be displayed and the layout of the calling card to the calling media server 122 .
  • the calling media server 122 typesets the data to be displayed according to the typesetting method of the calling card to obtain the calling card.
  • the calling media server 122 sends the generated calling card to the file server for storage, and sends the storage address of the calling card to the calling application server.
  • the network authentication server acquires the data to be displayed and the typesetting method of the calling card
  • the network authentication server typesets the data to be displayed according to the typesetting method of the calling card to generate the calling card. Then, the network authentication server sends the calling card to the calling application server.
  • the way for the network authentication server to send the calling card to the calling application server may be that the network authenticating server stores the calling card in a file server, and the network authentication server sends the storage address of the calling card to the calling application server, The calling application server can download the calling card from the file server according to the address.
  • the registration processing flow is executed first. Based on the registration processing flow, the calling application server can successfully obtain the calling card, so that When the first user subsequently calls the second user, the calling application server can send the calling card to the second user without performing the step of generating the calling card during the calling process, which shortens the call processing delay and improves the call efficiency. Efficiency, so that when the first user calls the second user, the calling card can be displayed on the second terminal.
  • the process of authenticating the first user by the enterprise represented by the trust security alliance is realized.
  • a trust security alliance can be created as shown in this application.
  • the trust security alliance refers to the calling operator network authentication enterprise, enterprise authentication
  • the first user (it can be understood that the first user is an employee of the enterprise), it can be seen that if the enterprise is authenticated by the calling operator network and the first user is authenticated by the enterprise, then the calling operator network can be trusted Data from the enterprise, the enterprise can trust the data from the first user, and the calling operator network can construct a trusted calling card based on the trusted data from the enterprise, thus ensuring that the calling operator network sends the second user The credibility of the calling card.
  • the enterprise authenticates the first user, wherein the third-party network may be a network leased by the enterprise for performing call-related services, for example, the third-party network may be a software-as-a-service (software-as-a-service) SaaS) platform.
  • the third-party network is authenticated by the calling operator network, the enterprise is authenticated by the third-party network, and the first user is authenticated by the enterprise, then the calling operator network can trust the data from the third-party network.
  • the third-party network can trust the data from the enterprise, the enterprise can trust the data from the first user, and the calling operator network can construct a trusted calling card based on the trusted data from the third-party network, thus ensuring that the calling operator Authenticity of the calling card sent by the network to the second user.
  • the network authentication server trusts the data (such as part or all of the data to be displayed) from the enterprise authentication server, so, it is not necessary for the first user to When the calling operator network opens an account, you can use the service provided by the calling operator network to call the second user. It can be seen that the method shown in this embodiment enables the first user to call the second user without opening an account.
  • the call of two users solves the problem of enterprise employees (that is, the first user) opening an account existing in the enterprise renting the network of the calling operator, thereby avoiding the slow login of the first user caused by the first user opening an account in the network of the calling operator.
  • This embodiment describes how the first user uses the first terminal to implement a call to the second terminal when the first user has registered with the calling operator's network based on the method shown in FIG. 2 . See Figure 3 for details.
  • FIG. 3 is a flow chart of an embodiment of the calling communication system provided by the present application for executing a call.
  • Step 301 the first terminal sends a first call request message to the first calling device.
  • the first calling device shown in this embodiment is used to verify the calling side of the first call request message, and the first calling device can trigger the first user to verify the second User's call.
  • the first calling device shown in this embodiment is the calling S-CSCF included in the calling operator's network as an example for illustration. In other examples, the first calling device may be the calling S-CSCF included in the calling operator's network. Any one of the devices, or the function performed by the first calling device may be performed by at least two devices included in the calling operator's network, which is not specifically limited in this embodiment.
  • the first call request message is a SIP INVITE message, and the first call request message is transmitted based on the control plane, wherein the first call request message is transmitted based on the control plane, and the first call request message is a signal transmitted through the SIP protocol order flow.
  • the SIP INVITE message includes the first user ID and call authentication ID of the first user.
  • the first user ID and call authentication ID please refer to the user ID and call authentication ID of the first user shown in Embodiment 1. Instructions for registering the authentication logo, details are not repeated here.
  • the first terminal sends the SIP INVITE message to the calling P-CSCF, and the calling P-CSCF forwards the SIP INVITE message to the calling S -CSCF.
  • the first user ID UserID shown in this embodiment takes zhangsan@xxx.com as an example.
  • the SIP user ID carries the first user ID.
  • the SIP user ID can be zhangsan@xxx.com@2b.ims. ⁇ operator >.com, wherein 2b.ims. ⁇ operator>.com is a uniformly defined fixed domain name for the calling operator network to access the calling operator network based on the heterogeneous identifier (ie, the first user identifier).
  • the first terminal can escape the "@" in the UserID (such as zhangsan@xxx.com).
  • the specific rules for escape in this embodiment The description in is an optional example without limitation. For example, the first terminal escapes the "@" in the UserID to "%40".
  • the token shown in this embodiment can use an encoding format based on 64 printable characters to represent binary data (Base64).
  • the token can be carried through the Authorization header field and extended authentication methods (such as Bearer), such as message
  • the format can be: Authorization:Bearer ⁇ Base64( ⁇ token>)>.
  • Step 302 the first calling device judges whether the call authentication identifier satisfies a preset condition, if not, execute step 303, and if yes, execute step 304.
  • the first calling device is the calling S-CSCF included in the calling operator network as an example for illustration. In other examples, other S-CSCF included in the calling operator network may also be used. Any device executes step 302 shown in this embodiment. For the description of the execution subject, please refer to the above step 301, and details are not repeated here.
  • the preset condition shown in this embodiment is that the call authentication identifier is the same as the target authentication identifier, and the target authentication identifier is valid. It can be seen that the call authentication identifier meets the preset condition when the calling S-CSCF judges In the case of , the calling S-CSCF can determine that the first call request message has passed the verification of the calling side.
  • the target authentication identifier is the registration authentication identifier cached by the calling S-CSCF in the registration phase shown in the first embodiment.
  • the calling S-CSCF judges that the call authentication identifier is the same as the target authentication identifier, and the target authentication identifier is valid, it is determined that the call authentication identifier satisfies the preset condition.
  • Step 303 the first calling device rejects the call requested by the first call request message.
  • step 302 For the description of the first calling device performing step 303, please refer to step 302, and details are not repeated here.
  • the calling S-CSCF rejects the call requested by the first call request message, the first user cannot call the second user based on the first call request message.
  • Step 304 the first calling device sends a first call request message to the second calling device.
  • the first calling device shown in this embodiment can process the first call request message after determining that the first call request message has been verified by the calling side, and send the processed first call request message to the second call request message.
  • the calling device, the second calling device is any device included in the called operator network or the second calling device may be implemented by at least two devices included in the called operator network, which is not specifically limited.
  • the first calling device that executes step 304 shown in this embodiment may be any device such as the calling S-CSCF included in the calling operator's network. For the description of the execution subject, please refer to the above steps. repeat.
  • step 303 the calling S-CSCF as the first calling device has determined that the first call request message has been verified by the calling side, and the calling S-CSCF processes the first call request message, and the calling S-CSCF - The CSCF may send the processed first call request message to the second calling device.
  • the calling S-CSCF processes the first call request message and the specific process is as follows:
  • the calling S-CSCF can obtain the private key from a secure key store (secure key store, SKS).
  • SKS secure key store
  • the calling S-CSCF obtains the call data of the first call request message, and signs the call data based on the private key to obtain the first signature information, wherein the call data may include the identifier of the first user, the identifier of the second user, Internet protocol (internet protocol, IP) address, port number, etc. of the first terminal, the call data is used to create a media channel between the first calling device and the second calling device.
  • the calling S-CSCF shown in this embodiment may set the first signature information in the header message of the first call request message.
  • creating a media channel between the first calling device and the second calling device refers to that the first calling device sends the first terminal's Internet interaction information for creating the media channel to the second calling device through the first call request message. Even the protocol (internet protocol, IP) address and port number.
  • IP Internet protocol
  • the second calling device returns to the first calling device the IP address and port number of the second terminal used to create the media channel, based on the IP address and port number of the first terminal, and the second terminal's
  • the IP address and port number can create a media channel between the first calling device and the second calling device, that is, one end of the media channel is the IP address and port number of the first calling device, and the other end of the media channel is the second calling device.
  • the IP address and port number of the device are used to implement the transmission of media plane information between the first calling device and the second calling device based on the media channel.
  • the media plane information refers to a message encapsulated by a media plane protocol
  • the media plane protocol may be a secure real-time transport protocol (secure real-time transport protocol, SRTP) or a real-time transport protocol (real-time transport protocol, RTP), etc. .
  • the calling S-CSCF shown in this embodiment can also set a first indication message in the first call request message, the first indication message is used to request a signature key, and the signature key is used to sign the calling card key.
  • the first indication message in this embodiment may also be used to indicate that the first calling device supports the ability to sign a calling card.
  • the first indication message shown in this embodiment may be "Supported: early-media-authentication-with-shaken".
  • the second calling device receives the first indication message, it can be determined according to the first indication message that the first calling device requests a signature key from the second calling device, and that the first calling device supports signing of the calling card. ability.
  • the first call request message shown in this embodiment also includes authentication level information
  • the calling S-CSCF shown in this embodiment pre-creates the correspondence between the identity of the first user and the authentication level information.
  • the S-CSCF receives the identity of the first user, it can determine the corresponding authentication level information.
  • the authentication level information may include level A level information, level B level information and level C level information, wherein level A level information, level B level information and level C level information indicate that the credibility of the first user decreases in turn.
  • the calling S-CSCF sets the destination IP address of the first call request message as the IP address of the second calling device, sets the destination port number of the first call request message as the port number of the second calling device, The calling S-CSCF sends the first call request message to the second calling device according to the destination IP address and destination port number carried in the first call request message, so that the first calling device sends the first call request message to the second calling device the goal of.
  • Step 305 the second calling device sends the first call request message to the second terminal.
  • the second calling device After the second calling device determines that the first call request message has been verified by the called side, it sends the first call request message verified by the called side to the second terminal.
  • the second calling device shown in this embodiment may be any device included in the called operator's network, for example, the second calling device may be the called S-CSCF or the called application included in the called operator's network.
  • the second calling device may be the called S-CSCF or the called application included in the called operator's network.
  • the server or the called P-CSCF for the description of the structure of the called operator's network, refer to the description of the structure of the calling operator's network shown in FIG. 1 , and details will not be repeated.
  • the second calling device is the called S-CSCF as an example for illustration, and the process of the called S-CSCF implementing the verification of the called side of the first call request message is described below:
  • the called S-CSCF After the called S-CSCF receives the first call request message, the called S-CSCF performs signature verification on the first signature information included in the first call request message according to the obtained public key, the public key is passed through the certificate center ( certificate authority, CA) certified public key.
  • certificate center certificate authority, CA
  • the called S-CSCF determines that the first signature information has passed the signature verification. If the called S-CSCF determines that the first signature information has passed the signature verification, the called S-CSCF determines that the first call request message has passed the verification of the called side. After the called S-CSCF determines that the first signature information passes the signature verification, it indicates that the call data is untampered and complete data.
  • the called S-CSCF After the called S-CSCF determines that the first call request message has been verified by the called side, the called S-CSCF sends the first call request message to the second terminal through the called P-CSCF.
  • the called S-CSCF sets the IP address of the first call request message as the IP address of the called P-CSCF, and then sets the destination port number as the port number of the called P-CSCF, and the called S-CSCF according to The destination IP address and destination port number carried in the first call request message send the first call request message to the called P-CSCF.
  • the first call request message carries the identity of the second terminal, and the called P-CSCF acquires the IP address and port number of the corresponding second terminal according to the identity of the second terminal, and the called P-CSCF sends the destination of the first call request message
  • the IP address is set as the IP address of the second terminal, and then the destination port number of the first call request message is changed to the port number of the second terminal, and the called P-CSCF according to the destination IP address and destination port number carried in the first call request message port number, and send the first call request message to the second terminal.
  • Step 306 the second terminal sends a 180 ringing message to the second calling device.
  • the second terminal When the second terminal has successfully received the first call request message, the second terminal can ring according to the first call request message, and if the second terminal rings successfully, it can send 180 to the second calling device A ringing message is used to notify the second terminal that the ringing has occurred.
  • the second terminal may display the authentication level information. For example, if the first call request message carries Class A rating information, then the second terminal may display the Class A rating information while ringing.
  • the 180 ringing message shown in this embodiment also carries the IP address and port number of the second terminal, so as to realize the establishment of a media channel between the first calling device and the second calling device.
  • Step 307 the second calling device sends 180 a ringing message to the first calling device.
  • the second calling device shown in this embodiment may process the 180 ringing message after receiving the 180 ringing message, and forward the processed 180 ringing message to the first calling device.
  • the second calling device sets the master key (S-key) and the master salt key (S-salt) in the 180 ringing message.
  • the master key and the master salt key shown in this embodiment are keys required for SRTP.
  • the second calling device may acquire the master key and the master salt key when the second calling device receives the 180 ringing message as shown in step 307, or the second calling device may In the case of receiving the first call request message from the first calling device, the master key and the master salt key are obtained, which are not specifically limited in this embodiment.
  • the second calling device receives the Obtaining the master key and the master salt key in the case of the first call request message is taken as an example, and the process for the second calling device to obtain the master key and the master salt key is described below:
  • the second calling device determines that the first call request message carries the first indication message, and it can be known from step 304 that the first indication message is used to request a signature key.
  • the second calling device determines according to the first call request message that it needs to acquire the master key and the master salt key for SRTP.
  • the second calling device obtains the corresponding master key and master salt key based on the SRTP key management algorithm.
  • the second call device shown in this embodiment can encrypt the master key and master salt key based on the stored public key. Key to sign to obtain the second signature information.
  • the second calling device sets the second signature information in 180 ringing message.
  • the second calling device shown in this embodiment may also set a second indication message in the 180 ringing message, wherein the second indication message is used to indicate that the second calling device supports the ability to verify the security of the data to be displayed . It can be known that, after receiving the second indication message, the first calling device can send the signed calling card to the second calling device. Based on the negotiation between the first calling device and the second calling device, the purpose of the second terminal displaying the signature via the first calling device and verifying the signature on the calling card via the second calling device can be realized.
  • the second calling device shown in this embodiment may also set the address of the second calling device in the 180 ringing message, wherein the address of the second calling device includes the IP address and port number of the second calling device.
  • the second call device when the second call device receives the first call request message from the first call device, the second call device can obtain the IP address and port number of the first terminal carried in the first call request message .
  • the first calling device receives the 180 ringing message, the first calling device can obtain the IP address and port number of the second terminal, based on the IP address and port number of the first terminal, and the IP address of the second terminal and port number, a media channel between the first calling device and the second calling device can be created.
  • Step 308 the first calling device sends a 180 ringing message to the first terminal.
  • the first calling device After the first calling device receives the 180 ringing message, it can send the 180 ringing message to the first terminal.
  • the 180 ringing message shown in this embodiment can carry the identity of the first user, so as to ensure that the first calling device can obtain the IP address and port number of the first terminal based on the identity of the first user, so as to send the first terminal to the first terminal. 180 ringing message.
  • the first terminal determines that the second terminal has successfully received the first call request message according to the 180 ringing message, and the second terminal has ringing.
  • Step 309 the first calling device obtains the signature key.
  • the first calling device after receiving the 180 ringing message, extracts the second signature information from the 180 ringing message.
  • the first calling device performs signature verification on the second signature information based on the private key to obtain the master key and the master salt key carried in the second signature information.
  • the first calling device calculates the master key and the master salt key through a key derivation function to obtain a signature key.
  • Step 310 the first calling device sends an SRTP protocol message to the second calling device.
  • the first calling device shown in this embodiment is capable of obtaining a calling card.
  • a calling card for specific description, please refer to Embodiment 1, and details are not repeated here.
  • V represents the version number
  • P represents padding bits
  • X represents extension bits
  • CC represents the number of CSRC identifiers
  • M represents the flag used to indicate different payload meanings
  • PT represents the payload type.
  • the payload of the SRTP protocol message shown in this embodiment carries a calling card, and the first calling device signs the payload based on the signature key to obtain the first verification signature information, which is used as the identity verification shown in Table 1 Label (authentication tag).
  • the 180 ringing message shown above already carries the address of the second calling device, and the first calling device sends the SRTP protocol message to the second calling device according to the address of the second calling device. It can be seen that since the SRTP protocol message shown in this embodiment is a message transmitted based on the SRTP protocol, the SRTP protocol message is transmitted between the first calling device and the second calling device based on a media channel.
  • Step 311 the second calling device sends a calling card to the second terminal.
  • the second call device forwards the SRTP protocol message from the first call device to the second call device, and the second call device can obtain the IP address and port number of the second terminal from the SRTP protocol message, and the second call is based on the SRTP protocol
  • the IP address and port number of the second terminal carried in the message send the calling card to the second terminal.
  • Step 312 the second terminal displays the calling card.
  • the second terminal shown in this embodiment can display the calling card during the ringing process and if the second terminal supports the video call function.
  • Step 313 the second calling device judges whether the calling card has passed the security verification, if yes, execute step 314 , if not, execute step 315 .
  • the second calling device After the second calling device obtains the calling card from the SRTP protocol message, the second calling device judges whether the calling card passes the security verification, and how the second calling device judges whether the calling card passes the security verification is as follows. The process of sex verification is explained:
  • the second calling device uses the signature key to sign the calling card to obtain the second verification signature information, if the second calling device judges that the first verification signature information and the second verification signature information carried in the SRTP protocol message If they are the same, it is determined that the calling card has passed the security verification, and step 314 is executed. If the second calling device determines that the first verification signature information carried in the SRTP protocol message is different from the second verification signature information, it determines that the calling card has not passed the security verification, and then executes step 315 .
  • Step 314 the second calling device sends the first notification information to the second terminal.
  • the second calling device determines that the calling card has passed the security verification, it sends to the second terminal the first notification information indicating that the calling card has passed the security verification, and after the second terminal receives the first notification information, it can The first notification information is displayed to ensure that the second user determines that the displayed calling card is safe according to the first notification information displayed by the second terminal.
  • the type of the first notification information is not limited, and the type of the first notification information may be text information, voice information, or video information, etc., and is not specifically limited.
  • Step 315 the second calling device sends second notification information to the second terminal.
  • the second calling device determines that the calling card has not passed the security verification, it sends second notification information indicating that the calling card has not passed the security verification to the second terminal, and after the second terminal receives the second notification information, That is, the second notification information is displayed, so as to ensure that the second user determines that the displayed calling card is unsafe according to the second notification information displayed by the second terminal.
  • step 311 is executed first
  • step 313 is executed as an example for illustration, that is, the second calling device first sends the calling card to the second terminal, and then determines whether the calling card passes the security verification. It can be seen that the second terminal first displays the calling card, and then receives the first notification information or the second notification information from the second calling device, so as to determine whether the displayed calling card is safe.
  • step 313 can also be executed first, and then step 311 is executed, that is, the second calling device first judges whether the calling card has passed the security verification, and if the second calling device determines that the calling card has passed the security verification, then The calling card is sent to the second terminal. It can be seen that the calling card received by the second terminal in this example is safe.
  • the personal private information of the first user is prevented from being exposed at the calling operator network.
  • All the information included in the calling card displayed by the second terminal in this embodiment comes from the enterprise authentication server and/or the network authentication server instead of the first user, which avoids the fraud of the calling card.
  • the calling card displayed by the second terminal is signed by the first calling device and verified by the signature of the second calling device, which improves the security of the calling card, avoids the situation of tampering and leakage of the calling card, and improves the security of the calling card. Safe and trusted.
  • the calling card shown in this embodiment is transmitted based on the media channel, the data volume of the data to be displayed transmitted by the calling card is effectively increased, and the purpose of calling the second user by the first user and the operator can be realized based on the media channel transmission .
  • the first user needs to pre-register with the calling operator's network, and the registration process is as shown in the first embodiment.
  • the process of directly implementing the first user to call the second user under the condition that the first user does not need to pre-register with the calling operator's network will be described below with reference to FIG. 4 .
  • Fig. 4 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call.
  • Step 401 the first terminal sends a second call request message to the first calling device.
  • the first user can send a second call request message to the first calling device through the first terminal, so as to trigger the first user to call the second user.
  • the second call request message may be a SIP INVITE message, and the SIP INVITE message includes the first user ID and the call authentication ID of the first user.
  • the description of the first user ID and the call authentication ID please refer to the implementation
  • the description of the first user ID and the call authentication ID of the first user shown in Example 2 will not be described in detail.
  • a specific description of the first calling device please refer to Embodiment 2, and details are not repeated here.
  • Step 402 the first calling device sends a call authentication request to the enterprise authentication server.
  • the first calling device is the calling S-CSCF as an example, and the calling S-CSCF sends the second call request message to the calling application server.
  • the calling S-CSCF determines that the call authentication identifier included in the second call request message is the same as the target authentication identifier, and the calling S-CSCF judges that the second call request message uses the Bearer authentication method
  • the The calling S-CSCF sends a second call request message including the first user ID and the call authentication ID to the network authentication server, so as to request the network authentication server to use the call authentication ID to authenticate the first user.
  • the call authentication identifier and the Bearer authentication method please refer to Embodiment 2 for details, and details are not repeated here.
  • the network authentication server receives the first user ID and the call authentication request from the calling S-CSCF, and then sends the authentication request to the enterprise authentication server, please refer to Embodiment 1. As shown in step 205, details are not repeated here.
  • Step 403 the enterprise authentication server judges whether the call authentication identifier is valid, if not, execute step 404 , and if yes, execute step 405 .
  • step 504 For the specific execution process of step 504 shown in this embodiment, please refer to step 206 in the second embodiment, and details are not repeated here.
  • Step 404 the enterprise authentication server sends a call authentication identification invalid notification to the first calling device.
  • the enterprise authentication server shown in this embodiment can send the notification that the call authentication identifier is invalid to the first calling device.
  • the notification that the call authentication identifier is invalid can be sent to the first calling device.
  • Step 405 the enterprise authentication server sends a call authentication success indication to the first calling device.
  • the enterprise authentication server shown in this embodiment can send the call authentication success indication to the first calling device.
  • the call authentication success indication can be sent to the first calling device.
  • Step 406 the first calling device obtains the data to be displayed.
  • the process of obtaining the data to be displayed by the first calling device shown in this embodiment may be performed in Step 209 to Step 210 shown in Embodiment 1, and details are not repeated here.
  • Step 407 the first calling device sends a second call request message to the second calling device.
  • Step 408 the second calling device sends a second call request message to the second terminal.
  • Step 409 the second terminal sends a 180 ringing message to the second calling device.
  • Step 410 the second calling device sends 180 a ringing message to the first calling device.
  • Step 411 the first calling device sends a 180 ringing message to the first terminal.
  • Step 412 the first calling device obtains the signature key.
  • Step 413 the first calling device sends an SRTP protocol message to the second calling device.
  • Step 414 the second calling device sends the calling card to the second terminal.
  • Step 415 the second terminal displays the calling card.
  • Step 416 the second calling device judges whether the calling card passes the security verification, if yes, execute step 417 , if not, execute step 418 .
  • Step 417 the second calling device sends the first notification information to the second terminal.
  • Step 418 the second calling device sends the second notification information to the second terminal.
  • step 407 to step 418 shown in this embodiment please refer to step 304 to step 315 shown in the second embodiment, and details will not be repeated.
  • the first user when the first user makes a call to the second user, the first user does not need to pre-register to the operator's network, avoiding the need for pre-registration steps when the first user calls the second user, The efficiency of calling the second user by the first user is improved, and the consumption of resources related to registration is reduced at the same time.
  • a trusted security alliance is established between the calling operator network, enterprise, and enterprise employees (first users), which can ensure that when the second terminal rings, the displayed calling card information is safe, and the calling card meets the requirements of the calling card.
  • enterprise enterprise employees
  • the style of the call card is uniform.
  • the personal privacy information of the first user is prevented from being exposed at the calling operator, and in the process of calling the second user, the calling card
  • the displayed information may not involve the personal privacy information of the first user, which effectively ensures the security of the first user's personal privacy information.
  • the various information included in the calling card displayed by the second terminal shown in this embodiment all comes from the enterprise authentication server and/or the network authentication server, rather than the first user. Trust the chain of trust formed by the security alliance for traceability and accountability.
  • the first calling device sends an SRTP protocol packet to the second calling device, so that the second terminal displays the calling card.
  • the first call shown in this embodiment may not be based on the SRTP protocol to realize the transmission of the calling card.
  • the method shown in this embodiment is based on the method shown in FIG. 2, and when the first user has registered to the calling operator network Next, how the first user uses the first terminal to make a call to the second terminal. See Figure 5 for details.
  • Fig. 5 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call.
  • Step 501 the first terminal sends a first call request message to the first calling device.
  • Step 502 the first calling device judges whether the call authentication identifier satisfies a preset condition, if not, execute step 503, and if yes, execute step 504.
  • Step 503 the first calling device rejects the call requested by the first call request message.
  • Step 504 the first calling device sends a first call request message to the second calling device.
  • Step 505 the second calling device sends the first call request message to the second terminal.
  • Step 506 the second terminal sends a 180 ringing message to the second calling device.
  • Step 507 the second calling device sends a 180 ringing message to the first calling device.
  • Step 508 the first calling device sends a 180 ringing message to the first terminal.
  • step 501 to step 508 shown in this embodiment please refer to step 301 to step 308 shown in the second embodiment, and the specific execution process will not be repeated.
  • Step 509 the first calling device obtains the signature key.
  • the verification signature shown in this embodiment can be referred to step 309 shown in Embodiment 2.
  • the signature key shown in this embodiment can also be a pre-selected secure hash Any algorithm included in the secure hash algorithm (SHA) is derived.
  • the signature key shown in this embodiment is derived by the calling operator network according to the pre-selected algorithm SHA1.
  • Step 510 the first calling device sends a media message to the second calling device.
  • the media message shown in this embodiment may use a real-time transport protocol (real-time transport protocol, RTP).
  • RTP real-time transport protocol
  • the RTP protocol provides end-to-end real-time transmission services for various multimedia data such as voice, image, and fax.
  • the media message shown in this embodiment may include a calling card, and the calling operator network (such as the calling media server included in the calling operator network) signs the calling card based on the signature key to obtain the first verification signature information , and set the first verification signature information in the media packet.
  • the RTP protocol is taken as an example for illustration without limitation. In other examples, any media plane protocol may be used to transmit the calling card and signature.
  • Step 511 the second calling device sends a calling card to the second terminal.
  • Step 512 the second terminal displays the calling card.
  • Step 513 the second calling device judges whether the calling card has passed the security verification, if yes, execute step 514 , if not, execute step 515 .
  • Step 514 the second calling device sends the first notification information to the second terminal.
  • Step 515 the second calling device sends the second notification information to the second terminal.
  • step 311 to step 315 For the description of the execution process of step 511 to step 515 shown in this embodiment, please refer to step 311 to step 315, and details are not repeated here.
  • the first user shown in this application can also directly implement the process of the first user calling the second user without pre-registering with the calling operator's network.
  • the specific execution process can be referred to in the third embodiment.
  • the signature key shown can be any algorithm included in the SHA shown in this embodiment, and the specific process will not be repeated.
  • FIG. 6 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call.
  • Step 601 the first terminal sends a third call request message to the calling operator's network.
  • the specific description of the third call request message shown in this embodiment can refer to the step 301 in the second embodiment, and details will not be repeated.
  • the third call request message shown in this embodiment also includes the first signature information.
  • a specific description of the first signature message may be as follows:
  • the first terminal can obtain the private key.
  • the first terminal obtains the call data, and signs the call data based on the private key to obtain the first signature information, wherein the call data may include the identity of the first user, the identity of the second user, etc., and the call data is used to create the first signature information.
  • the first terminal shown in this embodiment may set the first signature information in the header message of the third call request message. For a specific description of obtaining the first signature message, refer to step 304 in the first embodiment, and details are not repeated here.
  • the third call request message shown in this embodiment also includes a first indication message, and the first indication message is used to request a signature key, and the signature key is a key used to sign a calling card.
  • the first indication message is used to request a signature key
  • the signature key is a key used to sign a calling card.
  • Step 602 the calling operator network judges whether the call authentication identifier meets the preset condition, if not, execute step 603, and if yes, execute step 604.
  • Step 603 the calling operator's network rejects the call requested by the third call request message.
  • Step 604 the calling operator network sends a third call request message to the called operator network.
  • step 602 to step 604 For the description of the execution process of step 602 to step 604 shown in this embodiment, please refer to step 302 to step 304 in the second embodiment, and details are not repeated here.
  • Step 605 the called operator network sends a third call request message to the second terminal.
  • step 606 the second terminal sends a 180 ringing message to the called operator's network after determining that the third call request message has passed the verification of the called side.
  • the second terminal described in this embodiment After receiving the third call request message, the second terminal described in this embodiment verifies the third call request message on the called side, and after confirming that the third call request message has passed the verification on the called side, sends a call to the called operator network Send 180 ringing message.
  • the second terminal performs signature verification on the first signature information included in the third call request message according to the obtained public key.
  • the public key refer to Embodiment 2, and details are not repeated. If the first signature information of the second terminal passes the signature verification, the second terminal determines that the call data carried in the third call request message is untampered and complete data.
  • step 306 in Embodiment 2 For a specific description of the 180 ringing message shown in this embodiment, please refer to step 306 in Embodiment 2, and details are not repeated here.
  • Step 607 the called operator network sends a 180 ringing message to the calling operator network.
  • Step 608 the calling operator network sends a 180 ringing message to the first terminal.
  • Step 609 the first terminal obtains the signature key.
  • Step 610 the first terminal sends an SRTP protocol message to the calling operator's network.
  • the first terminal shown in this embodiment obtains the calling card, and the first terminal carries the calling card through the SRTP protocol message.
  • the first terminal shown in this embodiment refer to the process of the calling operator's network obtaining the SRTP protocol packet shown in step 310 of the second embodiment, and details are not repeated here.
  • Step 611 the calling operator's network sends an SRTP protocol message to the called operator's network.
  • Step 612 the called operator network sends the calling card to the second terminal.
  • Step 613 the second terminal displays the calling card.
  • step 613 For the description of the execution process of step 613 shown in this embodiment, please refer to the step 312 shown in the second embodiment, and details are not repeated here.
  • Step 614 the second terminal judges whether the calling card passes the security verification, if yes, execute step 615 , if not, execute step 616 .
  • Step 615 the second terminal displays the first notification information.
  • Step 616 the second terminal displays the second notification information.
  • step 314 and step 315 of the second embodiment please refer to step 314 and step 315 of the second embodiment, respectively, and details are not repeated here.
  • the first terminal shown in this embodiment is responsible for signing the calling card
  • the second terminal is responsible for verifying the signature and displaying the calling card, which can reduce the computing power resources of the calling operator network and the called operator network .
  • the first terminal and the second terminal perform the signature and signature verification process of the calling card in this embodiment, the first terminal and the second terminal can be applied to any type of operator network, reducing the need for operator network types. limits.
  • the first user needs to pre-register with the calling operator's network, and the registration process is as shown in the first embodiment.
  • the process of the first user calling the second user directly by the first user without pre-registering to the calling operator network will be described below in conjunction with FIG. 7 .
  • the first calling device is used as the first
  • the first terminal used by the user and the second calling device are the second terminal used by the second user as an example.
  • FIG. 7 is a flow chart of steps in another embodiment of the calling communication system provided by the present application for performing a call.
  • Step 701 the first terminal sends a fourth call request message to the calling operator's network.
  • the first user may send a fourth call request message to the calling operator's network through the first terminal, so as to trigger a call from the first user to the second user.
  • the fourth call request message may be a SIP INVITE message, and the SIP INVITE message includes the first user ID and the call authentication ID of the first user.
  • the first user ID and the call authentication ID please refer to the implementation The description of the first user ID and the call authentication ID of the first user shown in Example 2 will not be described in detail.
  • the fourth call request message shown in this embodiment also includes the first signature information.
  • the fourth call request message also includes the first indication message.
  • the description of the first signature message and the first indication message please refer to It is shown in step 601 of the fifth embodiment, and details are not repeated here.
  • Step 702 the calling operator network sends a call authentication request to the enterprise authentication server.
  • Step 703 the enterprise authentication server judges whether the call authentication identifier is valid, if not, execute step 704, and if yes, execute step 705.
  • Step 704 the enterprise authentication server sends a call authentication identifier invalid notification to the first terminal.
  • Step 705 the enterprise authentication server sends a call authentication success indication to the first terminal.
  • Step 706 the first terminal obtains the data to be displayed.
  • the process of obtaining the data to be displayed by the first terminal shown in this embodiment may be performed in steps 209 to 210 shown in the first embodiment, and details are not repeated here.
  • Step 707 the calling operator network sends a fourth call request message to the called operator network.
  • Step 708 the called operator network sends a fourth call request message to the second terminal.
  • Step 709 the second terminal sends a 180 ringing message to the called operator's network.
  • Step 710 the called operator network sends a 180 ringing message to the calling operator network.
  • Step 711 the calling operator network sends a 180 ringing message to the first terminal.
  • Step 712 the first terminal obtains the signature key.
  • Step 713 the first terminal sends an SRTP protocol message to the calling operator's network.
  • Step 714 the calling operator network sends an SRTP protocol message to the called operator network.
  • Step 715 the called operator network sends the calling card to the second terminal.
  • Step 716 the second terminal displays the calling card.
  • Step 717 the second terminal judges whether the calling card has passed the security verification, if yes, execute step 718, if not, execute step 719.
  • Step 718 the second terminal displays the first notification information.
  • Step 719 the second terminal displays the second notification information.
  • Step 707 to Step 719 shown in this embodiment please refer to Step 604 to Step 616 shown in Embodiment 5, and details will not be repeated.
  • the first terminal shown in this embodiment is responsible for signing the calling card
  • the second terminal is responsible for signature verification and display of the signed calling card, which can reduce the calculation of the calling operator network and the called operator network. manpower resources.
  • the first terminal and the second terminal perform the signature and signature verification process of the calling card, so that the first terminal and the second terminal can be applied to any type of operator network, reducing the restrictions on the type of operator network .
  • the calling card shown in Embodiment 5 and Embodiment 6 may not be based on the SRTP protocol to realize the transmission of the calling card.
  • the calling card shown in Embodiment 5 and Embodiment 6 may not be based on the SRTP protocol to realize the transmission of the calling card.
  • the SRTP protocol to realize the transmission of the calling card.
  • the signing process of the calling card can be performed by the first terminal.
  • the process of verifying the signature of the signed calling card can be performed by the second calling device.
  • the signing process of the calling card can be performed by the first calling device.
  • the process of verifying the signature of the signed calling card can be performed by the second terminal Execution, specific description can refer to Embodiment 5 or Embodiment 6, and details will not be repeated.
  • the operator network is an IMS network as an example.
  • This application does not limit the specific network type of the operator network.
  • the operator network shown in this embodiment can be applicable
  • the specific network type is not limited in this embodiment.
  • Fig. 8 is a structural example diagram of an embodiment of the first calling device provided in the present application.
  • the first calling device includes:
  • the second obtaining module 802 is configured to obtain the data to be displayed of the first user, the first user uses the first calling device to call the second calling device, and the data to be displayed includes the data corresponding to the first user information and/or information corresponding to the enterprise to which the first user belongs;
  • a signature module 803, configured to use the signature key to sign the data to be displayed to obtain first verification signature information
  • a sending module 804 configured to send the data to be displayed and the first verification signature information to the second calling device through a media channel between the first calling device and the second calling device, the The first verification signature information is used to verify the security of the data to be displayed.
  • the signature module 803 is connected with the first acquisition module 801 and the second acquisition module 802 respectively, and the signature module 803 is also connected with the sending module 804 .
  • the first calling device shown in this embodiment further includes a judging module 800, and the judging module 800 is used to execute step 302 and step 303.
  • the judging module 800 is connected with the sending module 804 .
  • the sending module 804 is used to execute step 304 and step 308, the first obtaining module 801 is used to execute step 309, and the signature module 803 is used to execute the signature key from the first obtaining module 801 and the signature key from the second
  • the second acquisition module 802 acquires the first verification signature information for the data to be displayed.
  • the sending module 804 is used to execute step 310 .
  • the sending module 804 is also used to perform step 402, and the second obtaining module 802 is used to perform step 406, the sending Module 804 is used to execute step 407 and step 411, the first acquisition module 801 is used to execute step 412, and the signature module 803 is used to perform the signature key from the first acquisition module 801 and the signature key from the second acquisition module
  • the data to be displayed in 802 obtains the first verification signature information.
  • the sending module 804 is configured to execute step 413 .
  • the judging module 800 is used to perform step 502 and step 503, and the sending module 804 is used to perform step 504 and step 508,
  • the first obtaining module 801 is used to execute step 509
  • the signature module 803 is used to obtain the first verification signature information according to the signature key from the first obtaining module 801 and the data to be displayed from the second obtaining module 802 , please refer to step 510 for specific description, and the sending module 804 is configured to execute step 510.
  • the sending module 804 is used to perform step 601
  • the first obtaining module 801 is used to perform step 609
  • the signature module 803 is used to obtain the first verification signature information according to the signature key from the first obtaining module 801 and the data to be displayed from the second obtaining module 802.
  • the sending module 804 is used to Execute step 610.
  • the sending module 804 is used to perform step 701
  • the first obtaining module 801 is used to perform step 712
  • the signature module 803 is used to obtain the first verification signature information according to the signature key from the first obtaining module 801 and the data to be displayed from the second obtaining module 802.
  • the sending module 804 is used to Execute step 713.
  • Fig. 9 is a structural example diagram of an embodiment of the second calling device provided in the present application.
  • the second calling device includes:
  • the receiving module 901 is configured to receive the data to be displayed and the first verification signature information from the first calling device, the first verification signature information is obtained by signing the data to be displayed with a signature key, and the data to be displayed
  • the data and the first verification signature information are transmitted through a media channel between the first calling device and the second calling device, and the data to be displayed includes information corresponding to the first user and/or related to the Information corresponding to the enterprise to which the first user belongs;
  • a signature module 902 configured to use the signature key to sign the data to be displayed to obtain second verification signature information
  • the verification module 903 is configured to, if it is determined that the first verification signature information is the same as the second verification signature information, determine that the data to be displayed passes the security verification, and display the data to be displayed.
  • the receiving module 901 is connected with the signature module 902 and the verification module 903 respectively.
  • the second calling device further includes a sending module 900 that can be connected to a receiving module 901 .
  • the sending module 900 is used to execute step 305 and step 307.
  • the receiving module 901 is used to send the received data to be displayed to the second terminal through the sending module 900.
  • the signature module 902 and the verification module 903 are jointly used to execute step 313 , and the sending module 900 is used to execute steps 314 to 315 .
  • the second calling device shown in this embodiment is applied in Embodiment 3, the second calling device further includes a sending module 900, and the sending module 900 is configured to perform step 408 and step 410, the The receiving module 901 is used to send the received data to be displayed to the second terminal through the sending module 900.
  • the sending module 900 is configured to execute steps 417 to 418.
  • the second calling device shown in this embodiment is applied in Embodiment 4, the second calling device further includes a sending module 900, and the sending module 900 is configured to perform step 505 and step 507, the The receiving module 901 is used to send the received data to be displayed to the second terminal through the sending module 900.
  • the signature module 902 and the verification module 903 are jointly used to execute step 513 , the sending module 900 is configured to execute step 514 to step 515.
  • the second calling device further includes a sending module 900, and the sending module 900 is configured to perform step 606, and the receiving module 901 It is used to receive the data to be displayed from the network of the called operator.
  • the sending module 900 is used to Execute step 615 to step 616.
  • the second calling device shown in this embodiment is applied in Embodiment 6, the second calling device further includes a sending module 900, and the sending module 900 is configured to perform step 709, and the receiving module 901
  • the signature module 902 and the verification module 903 are jointly used to execute step 717
  • the sending module 900 is used to Execute step 718 to step 719.
  • This embodiment describes the structure of the calling device used to execute the above method embodiment from the perspective of physical hardware as shown in FIG. 10: the calling device shown in this embodiment can be the first calling device or the first calling device shown above. Two calling equipment.
  • Fig. 10 is a structural example diagram of an embodiment of a calling device provided in the present application.
  • the calling device 1000 specifically includes: a processor 1001 , a memory 1002 , a bus 1003 , a transceiver 1004 and a network interface 1006 .
  • the memory 1002 may include computer storage media in the form of volatile and/or non-volatile memory, such as read-only memory and/or random access memory.
  • Memory 1002 may store operating systems, application programs, other program modules, executable code, and program data.
  • the transceiver 1004 can be used to input commands and information to the calling device, and the transceiver 1004 can be connected to the processor 1001 through the bus 1003 .
  • the transceiver 1004 may also be used to call out device output information, such as the selected occupancy server and/or occupancy virtual machine.
  • the calling device may be connected to a communication network through the network interface 1006, and in a networked environment, the computer-executed instructions stored in the calling device may be stored in a remote storage device, not limited to local storage.
  • the calling device executes the executable code or application program stored in the memory 1002, the calling device can perform the operations performed by the calling device in any of the above method embodiments.
  • the specific execution process refer to the above method embodiments, here No longer.
  • the present application also provides a communication system, which includes a calling communication system and a called communication system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Databases & Information Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明实施例公开了一种呼叫处理的方法、相关设备以及存储介质，用于在第一用户呼叫第二用户的过程中，向第二用户发送安全的待显示数据，且能够有效地提高待显示数据所包括的信息量。方法包括：第一呼叫设备获取签名密钥；第一呼叫设备获取第一用户的待显示数据；第一呼叫设备通过签名密钥对待显示数据进行签名以获取第一验证签名信息；第一呼叫设备通过第一呼叫设备和第二呼叫设备之间的媒体通道，向第二呼叫设备发送待显示数据以及第一验证签名信息，第一验证签名信息用于验证待显示数据的安全性。

Description

一种呼叫处理的方法、相关设备以及存储介质
本申请要求于2021年09月30日提交中国专利局、申请号为202111166679.8、发明名称为“一种呼叫处理的方法、相关设备以及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种呼叫处理的方法、相关设备以及通信系统。
背景技术
IP多媒体子系统(IP multimedia subsystem，IMS)是一种全新的多媒体业务形式，它能够满足更新颖、更多样化多媒体业务的需求。IMS是解决移动与固网融合，引入语音、数据、视频三重融合等差异化业务的重要方式。
基于IMS，在第一用户向第二用户呼叫的过程中，会出现第一用户为仿冒或篡改的情况，为此，主叫侧可通过安全电话身份重访(secure telephony identity revisited，STIR)或使用令牌对声明信息进行基于签名的处理方案(signature-based handling of asserted information using toKENs，SHAKEN)技术对第一用户的呼叫请求消息的相关信息签名以生成签名信息，该相关信息可为主叫号码、被叫号码、时间戳、信誉度等级和呼叫源地址等。被叫侧根据公钥对签名信息进行验证。
STIR或SHAKEN技术仅能做到对第一用户的号码进行认证，无法对第一用户的多种身份信息进行认证。认证过程不涉及对企业信息的认证。而且STIR/SHAKEN技术仅涉及对信令层面的信息的加密与认证过程。
发明内容
本发明提供了一种呼叫处理的方法、相关设备以及存储介质，其用于在第一用户呼叫第二用户的过程中，向第二用户发送安全的待显示数据，且能够有效地提高待显示数据所包括的信息量。
本发明实施例第一方面提供了一种呼叫处理的方法，所述方法包括：所述第一呼叫设备获取签名密钥；所述第一呼叫设备获取第一用户的待显示数据，所述第一用户通过所述第一呼叫设备呼叫第二呼叫设备，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；所述第一呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息；所述第一呼叫设备通过所述第一呼叫设备和所述第二呼叫设备之间的媒体通道，向所述第二呼叫设备发送所述待显示数据以及所述第一验证签名信息，所述第一验证签名信息用于验证所述待显示数据的安全性。
本方面所示的第一呼叫设备可为第一用户所使用的第一终端，或，该第一呼叫设备可为主叫运营商网络所包括的至少一个设备，例如，第一呼叫设备可为主叫运营商网络所包括的主叫媒体服务器，主叫应用服务器AS，主叫服务-呼叫会话控制功能S-CSCF，主叫代理-呼叫会话控制功能P-CSCF或主叫互通会话边界控制器I-SBC。
可见，在第一用户呼叫第二用户的过程中，第一呼叫设备向第二呼叫设备所发送的第 一验证签名信息是对待显示数据进行签名以获取的，第二呼叫设备接收到待显示数据以及所述第一验证签名信息后，能够根据第一验证签名信息对待显示数据的安全性进行验证，第二用户所使用的第二终端即可在呼叫的过程中，显示该待显示数据，以便于第二用户确定所显示的待显示数据是否经过篡改或泄漏。而且因该待显示数据是经由所述第一呼叫设备和所述第二呼叫设备之间的媒体通道传输，有效地提高了待显示数据所传输的数据量。
基于第一方面，一种可选地实现方式中，所述第一呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息之前，所述方法还包括：所述第一呼叫设备向所述第二呼叫设备发送第一指示消息，所述第一指示消息用于指示所述第一呼叫设备支持对所述待显示数据签名的能力；所述第一呼叫设备接收来自所述第二呼叫设备的第二指示消息，所述第二指示消息用于指示所述第二呼叫设备支持验证所述待显示数据安全性的能力。
可见，第一呼叫设备和第二呼叫设备之间，可通过该第一指示消息和第二指示消息进行协商，在第二呼叫设备接收到该第一指示消息的情况下，确定所述第一呼叫设备支持对所述待显示数据签名的能力，第二呼叫设备即可向第一呼叫设备返回第二指示消息，第二呼叫设备根据该第二指示消息确定第二呼叫设备支持验证所述待显示数据安全性的能力，那么，第一呼叫设备能够向第二呼叫设备发送所述待显示数据以及第一验证签名信息，以确保第二呼叫设备能够根据该第一验证签名信息验证待显示数据的安全性。
基于第一方面，一种可选地实现方式中，所述第一呼叫设备获取第一用户的待显示数据包括：所述第一呼叫设备接收呼叫请求消息，所述呼叫请求消息携带所述待显示数据。
可见，第一呼叫设备为主叫运营商网络所包括的设备，该第一呼叫设备能够接收来自第一终端的呼叫请求消息，该呼叫请求消息携带该待显示数据，第一呼叫设备接收到该呼叫请求消息后，即可获取到该待显示数据。
基于第一方面，一种可选地实现方式中，所述第一呼叫设备获取第一用户的待显示数据包括：所述第一呼叫设备接收呼叫请求消息；所述第一呼叫设备获取与所述呼叫请求消息对应的所述待显示数据。
可见，第一呼叫设备为主叫运营商网络所包括的设备，第一呼叫设备可预先存储该待显示数据，第一呼叫设备接收到来自第一终端的呼叫请求消息后，即可获取与该呼叫请求消息对应的待显示数据。
基于第一方面，一种可选地实现方式中，所述第一呼叫设备获取签名密钥包括：所述第一呼叫设备向所述第二呼叫设备发送呼叫请求消息，所述呼叫请求消息用于请求获取所述签名密钥；所述第一呼叫设备接收来自所述第二呼叫设备的主密钥和主盐密钥，所述主密钥和所述主盐密钥用于安全实时传输协议SRTP；所述第一呼叫设备根据所述主密钥和所述主盐密钥，生成所述签名密钥。
可见，第一呼叫设备通过该呼叫请求消息向第二呼叫设备请求获取主密钥和主盐密钥，第一呼叫设备基于安全实时传输协议SRTP，能够根据该主密钥和主盐密钥推导出签名密钥，本方面所示的第一呼叫设备能够基于安全实时传输协议SRTP获取该签名密钥，以实现对待显示数据的签名。
基于第一方面，一种可选地实现方式中，所述第一呼叫设备接收来自所述第二呼叫设备的主密钥和主盐密钥包括：所述第一呼叫设备接收来自所述第二呼叫设备的签名信息，所述签名信息包括通过公钥签名的所述主密钥和所述主盐密钥；所述第一呼叫设备通过私钥验证所述签名信息以获取所述主密钥和所述主盐密钥。
为提高待显示数据的安全性，需要保证第一呼叫设备所获取到的主密钥和主盐密钥的安全性，若主密钥和主盐密钥出现泄露或篡改，那么，将导致待显示数据会出现泄露或篡改的情况，为此，第一呼叫设备所接收到的签名信息包括通过公钥签名的所述主密钥和所述主盐密钥，有效地避免了主密钥和主盐密钥出现泄露或篡改的情况，提高了待显示数据的安全性。
基于第一方面，一种可选地实现方式中，与所述第一用户对应的信息包括如下所示的至少一项：所述第一用户的名称，所述第一用户的工号，所述第一用户的头像，所述第一用户的职位信息，与所述第一用户相关的音视频文件，或所述第一用户所属的协会的信息；
与所述第一用户所属的企业对应的信息包括如下所示的至少一项：所述企业名称，所述企业的商标，与所述企业相关的音视频文件，或所述企业所属的协会的信息。
本发明实施例第二方面提供了一种呼叫处理的方法，所述方法包括：第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息，所述第一验证签名信息为通过签名密钥对所述待显示数据进行签名以获取，所述待显示数据和所述第一验证签名信息通过所述第一呼叫设备和所述第二呼叫设备之间的媒体通道传输，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；所述第二呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第二验证签名信息；若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证，使所述待显示数据显示。
本方面所示的第二呼叫设备可为第二用户所使用的第二终端，或，该第二呼叫设备可为被叫运营商网络所包括的至少一个设备，例如，第二呼叫设备可为被叫运营商网络所包括的被叫媒体服务器，被叫应用服务器AS，被叫服务-呼叫会话控制功能S-CSCF，被叫代理-呼叫会话控制功能P-CSCF或被叫互通会话边界控制器I-SBC。
本方面所示的有益效果，请参见第一方面所示，具体不做赘述。
基于第二方面，一种可选地实现方式中，所述第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息之前，所述方法还包括：所述第二呼叫设备接收来自所述第一呼叫设备的第一指示消息，所述第一指示消息用于指示所述第一呼叫设备支持对所述待显示数据签名的能力；所述第二呼叫设备向所述第一呼叫设备发送第二指示消息，所述第二指示消息用于指示所述第二呼叫设备支持验证所述待显示数据安全性的能力。
基于第二方面，一种可选地实现方式中，所述若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证之后，所述方法还包括：所述第二呼叫设备向第二终端发送所述待显示数据，所述第二终端为第二用户所使用的终端，所述第二终端用于显示所述待显示数据。
基于第二方面，一种可选地实现方式中，所述第二呼叫设备为第二终端，所述第二终 端为第二用户所使用的终端，所述若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证之后，所述方法还包括：所述第二呼叫设备显示所述待显示数据。
基于第二方面，一种可选地实现方式中，所述若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证之后，所述方法还包括：所述第二呼叫设备向所述第二终端发送通知消息，所述通知消息用于指示所述待显示数据通过安全性验证。
可见，在所述第二呼叫设备确定待显示数据通过安全性验证，向第二终端发送用于指示待显示数据通过安全性验证的通知信息，第二终端接收到该通知信息后，即可显示用于指示待显示数据通过安全性验证的通知信息，以保证第二用户根据第二终端已显示的通知信息，确定所显示的待显示数据是安全的。
基于第二方面，一种可选地实现方式中，所述第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息之前，所述方法还包括：所述第二呼叫设备接收来自所述第一呼叫设备的呼叫请求消息，所述呼叫请求消息用于请求获取所述签名密钥；所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送主密钥和主盐密钥，所述主密钥和所述主盐密钥用于安全实时传输协议SRTP，所述主密钥和所述主盐密钥用于生成所述验证签名。
基于第二方面，一种可选地实现方式中，所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送主密钥和主盐密钥包括：所述第二呼叫设备通过公钥对所述主密钥和所述主盐密钥签名以获取签名信息；所述第二呼叫设备向所述第一呼叫设备发送所述签名信息。
基于第二方面，一种可选地实现方式中，所述第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息之前，所述方法还包括：所述第二呼叫设备接收来自所述第一呼叫设备的呼叫请求消息；所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送所述签名密钥。
基于第二方面，一种可选地实现方式中，与所述第一用户对应的信息包括如下所示的至少一项：所述第一用户的名称，所述第一用户的工号，所述第一用户的头像，所述第一用户的职位信息，与所述第一用户相关的音视频文件，或所述第一用户所属的协会的信息；
所述第一用户所属的企业对应的信息包括如下所示的至少一项：所述企业名称，所述企业的商标，与所述企业相关的音视频文件，或所述企业所属的协会的信息。
本发明实施例第三方面提供了一种呼叫设备，包括：第一获取模块，用于获取签名密钥；第二获取模块，用于获取第一用户的待显示数据，所述第一用户为与所述呼叫设备对应的用户，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；签名模块，用于通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息；发送模块，用于通过所述呼叫设备和另一呼叫设备之间的媒体通道，向所述另一呼叫设备发送所述待显示数据以及所述第一验证签名信息，所述第一验证签名信息用于验证所述待显示数据的安全性。
本方面有益效果的说明，请参见上述第一方面所示，具体不做赘述。
基于第三方面，一种可选地实现方式中，所述发送模块还用于，向所述另一呼叫设备发送第一指示消息，所述第一指示消息用于指示所述呼叫设备支持对所述待显示数据签名的能力；所述呼叫设备还包括接收模块，所述接收模块用于接收来自所述另一呼叫设备的第二指示消息，所述第二指示消息用于指示所述另一呼叫设备支持验证所述待显示数据安全性的能力。
基于第三方面，一种可选地实现方式中，所述第二获取模块具体用于，接收呼叫请求消息，所述呼叫请求消息携带所述待显示数据。
基于第三方面，一种可选地实现方式中，所述第二获取模块具体用于，接收呼叫请求消息；获取与所述呼叫请求消息对应的所述待显示数据。
基于第三方面，一种可选地实现方式中，所述第一获取模块具体用于，向所述另一呼叫设备发送呼叫请求消息，所述呼叫请求消息用于请求获取所述签名密钥；接收来自所述另一呼叫设备的主密钥和主盐密钥，所述主密钥和所述主盐密钥用于安全实时传输协议SRTP；根据所述主密钥和所述主盐密钥，生成所述签名密钥。
基于第三方面，一种可选地实现方式中，所述第一获取模块具体用于，接收来自所述另一呼叫设备的签名信息，所述签名信息包括通过公钥签名的所述主密钥和所述主盐密钥；通过私钥验证所述签名信息以获取所述主密钥和所述主盐密钥。
基于第三方面，一种可选地实现方式中，与所述第一用户对应的信息包括如下所示的至少一项：
所述第一用户的名称，所述第一用户的工号，所述第一用户的头像，所述第一用户的职位信息，与所述第一用户相关的音视频文件，或所述第一用户所属的协会的信息；
与所述第一用户所属的企业对应的信息包括如下所示的至少一项：
所述企业名称，所述企业的商标，与所述企业相关的音视频文件，或所述企业所属的协会的信息。
本发明实施例第四方面提供了一种呼叫设备，包括：接收模块，用于接收来自另一呼叫设备的待显示数据以及第一验证签名信息，所述第一验证签名信息为通过签名密钥对所述待显示数据进行签名以获取，所述待显示数据和所述第一验证签名信息通过所述另一呼叫设备和呼叫设备之间的媒体通道传输，所述待显示数据包括与第一用户对应的信息和/或与所述第一用户所属的企业对应的信息，所述第一用户为与所述另一呼叫设备对应的用户；签名模块，用于通过所述签名密钥对所述待显示数据进行签名以获取第二验证签名信息；验证模块，用于若确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证，使所述待显示数据显示。
本方面有益效果的说明，请参见上述第二方面所示，具体不做赘述。
基于第四方面，一种可选地实现方式中，所述接收模块还用于，接收来自所述另一呼叫设备的第一指示消息，所述第一指示消息用于指示所述另一呼叫设备支持对所述待显示数据签名的能力；向所述另一呼叫设备发送第二指示消息，所述第二指示消息用于指示所述呼叫设备支持验证所述待显示数据安全性的能力。
基于第四方面，一种可选地实现方式中，所述呼叫设备还包括发送模块，用于向第二终端发送所述待显示数据，所述第二终端为第二用户所使用的终端，所述第二终端用于显示所述待显示数据。
基于第四方面，一种可选地实现方式中，所述呼叫设备为第二终端，所述第二终端为第二用户所使用的终端，所述呼叫设备还包括显示模块，所述显示模块用于显示所述待显示数据。
基于第四方面，一种可选地实现方式中，所述发送模块还用于向所述第二终端发送通知消息，所述通知消息用于指示所述待显示数据通过安全性验证。
基于第四方面，一种可选地实现方式中，所述接收模块还用于，接收来自所述另一呼叫设备的呼叫请求消息，所述呼叫请求消息用于请求获取所述签名密钥；所述发送模块还用于，根据所述呼叫请求消息向所述另一呼叫设备发送主密钥和主盐密钥，所述主密钥和所述主盐密钥用于安全实时传输协议SRTP，所述主密钥和所述主盐密钥用于生成所述验证签名。
基于第四方面，一种可选地实现方式中，所述发送模块具体用于：通过公钥对所述主密钥和所述主盐密钥签名以获取签名信息；向所述另一呼叫设备发送所述签名信息。
基于第四方面，一种可选地实现方式中，所述接收模块还用于，接收来自所述另一呼叫设备的呼叫请求消息；所述发送模块还用于，根据所述呼叫请求消息向所述另一呼叫设备发送所述签名密钥。
本发明实施例第五方面提供了一种呼叫设备，包括相互耦合的处理器和存储器，所述存储器中存储了计算机程序代码，所述处理器调用并执行所述存储器中的计算机程序代码，使得所述呼叫设备执行如上述第一方面任一项所述的方法。
本发明实施例第六方面提供了一种呼叫设备，包括相互耦合的处理器和存储器，所述存储器中存储了计算机程序代码，所述处理器调用并执行所述存储器中的计算机程序代码，使得所述呼叫设备执行如上述第二方面任一项所述的方法。
本发明实施例第七方面提供了一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如上述第一方面至第二方面任一项所述的方法。
本发明实施例第八方面提供了一种通信系统，包括第一终端，如上述第五方面所示的呼叫设备，如上述第六方面所示的呼叫设备以及第二终端，所述第一终端为第一用户所使用的终端，上述第五方面所示的呼叫设备为主叫运营商网络所包括的设备，上述第六方面所示的呼叫设备为被叫运营商网络所包括的设备，所述第二终端为第二用户所使用的终端，所述第一用户呼叫第二用户。
本发明实施例第九方面提供了一种通信系统，包括如上述第五方面所示的呼叫设备，主叫运营商网络，被叫运营商网络以及如上述第六方面所示的呼叫设备，如上述第五方面所示的呼叫设备为第一用户所使用的设备，如上述第六方面所示的呼叫设备为第二用户所使用的设备。
附图说明
图1为本申请所提供的主叫通信系统的一种实施例结构示例图；
图2为本申请所提供的主叫通信系统执行注册的过程的一种实施例步骤流程图；
图3为本申请所提供的主叫通信系统执行呼叫的一种实施例步骤流程图；
图4为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图；
图5为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图；
图6为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图；
图7为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图；
图8为本申请所提供的第一呼叫设备的一种实施例结构示例图；
图9为本申请所提供的第二呼叫设备的一种实施例结构示例图；
图10为本申请所提供的呼叫设备的一种实施例结构示例图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本申请提供了一种呼叫处理的方法，为更好的理解本申请所提供的呼叫处理的方法，以下首先结合图1所示对本申请所示的方法所应用的主叫通信系统的结构进行说明：第一用户基于该主叫通信系统能够实现向第二用户的呼叫。
图1为本申请所提供的主叫通信系统的一种实施例结构示例图。
本实施例所示的主叫通信系统包括依次连接的运营商管理设备111、主叫运营商网络120以及企业网络130，本实施例对主叫运营商网络120的具体网络类型不做限定，例如，该主叫运营商网络120的网络类型为IMS、第三代合作伙伴计划(3rd generation partnership project，3GPP)或中国通信标准化协会(china communications standards association，CCSA)，以及未来出现的任意网络架构。以下本申请各实施例以主叫运营商网络120为IMS为例。
以下对该主叫运营商网络120所包括的各个设备进行说明，需明确的是，本实施例对各个设备类型的说明为可选地示例性，不做限定，本实施例所示的设备还可称为网元。
本实施例所示的主叫运营商网络120包括网络鉴权服务器121，本实施例所示的网络鉴权服务器还可称之为第三方账号管理(thirdparty account management，TAM)设备。
主叫运营商网络120包括主叫媒体服务器122，所述主叫媒体服务器122可集成多媒体资源功能处理器(multimedia resource function processor，MRFP)以及多媒体资源功能控制器(multimedia resource function controller，MRFC)。主叫运营商网络120还包括主叫应用服务器(application server，AS)123以及主叫服务-呼叫会话控制功能(serving-call session control function，S-CSCF)124，该主叫S-CSCF124还集成查询-呼叫会话控制功能(interrogating-call session control function，I-CSCF)。其中， 网络鉴权服务器121分别与主叫媒体服务器122、主叫AS123以及主叫S-CSCF124连接，主叫媒体服务器122与主叫AS123连接，主叫AS123与主叫S-CSCF124连接。
主叫S-CSCF124分别连接主叫代理-呼叫会话控制功能(proxy-call session control function，P-CSCF)以及主叫互通会话边界控制器(interconnect-session border controller，I-SBC)125，其中，主叫P-CSCF126还集成接入会话边界控制器(access-session border controller，A-SBC)。
以下对本实施例所示的企业网络130的结构进行说明，需明确的是，本实施例对该企业网络130的说明为可选地示例，不做限定。
该企业网络130具体包括企业鉴权服务器131、企业接入代理设备132以及第一终端133。其中，企业鉴权服务器131分别与网络鉴权服务器121、企业接入代理设备132以及第一终端133连接。该企业接入代理设备132与主叫I-SBC125或主叫P-CSCF连接，该第一终端133与主叫P-CSCF126连接。其中，企业接入代理设备132也可能是企业话音中继设备。
其中，第一用户(也可称之为主叫用户)所使用的第一终端133可为智能终端、计算机中的任一设备。该第一终端内置IMS软件开发工具包(software development kit，SDK)，以实现本申请所示的呼叫处理流程。
以下对本申请所提供的呼叫处理的方法的各个实施例进行说明，为更好的理解本申请所示的各个实施例，首先对本申请所示的呼叫处理的方法所要实现的目的进行概述性说明：
本申请所示的呼叫处理的方法，第一用户在对第二用户进行呼叫的时候，可向第二用户发送呼叫名片，第二用户(也可称之为被叫用户)所使用的第二终端在振铃的时候，即可显示该呼叫名片。该呼叫名片包括按照预设排版方式排版后的待显示数据，该待显示数据包括如下所示的至少一项：
与第一用户对应的信息，或与第一用户所属的企业对应的信息。
其中，第一用户对应的信息可包括如下所示的一项或多项：
第一用户的名称，第一用户的工号，第一用户的头像、第一用户的职位信息，与第一用户相关的音视频文件或第一用户所属的协会的信息等，其中，该第一用户的名称可为第一用户的姓名，也可为第一用户的昵称等，具体在本实施例中不做限定。
第一用户所属的企业对应的信息可包括如下所示的一项或多项：
企业名称，企业商标(LOGO)，与企业相关的图片，与企业相关的音视频文件，或企业所属的协会的信息。
其中，协会的信息可为协会的名称、协会的LOGO、协会的相关图片、与协会相关的音视频文件等。
本申请对呼叫名片所包括的待显示数据的具体内容以及待显示数据的具体排版方式不做限定。本申请能够保证在第一用户呼叫第二用户的过程中，向第二用户发送的该呼叫名片是安全的，还能够有效地避免呼叫名片被篡改或被仿冒的可能，避免第二用户接收到不安全的数据。
以下结合各个实施例对本实施例所示的呼叫处理的方法的执行过程进行说明：
实施例一
本实施例所示企业内部的第一用户为向企业外部的第二用户呼叫时，先执行注册处理流程，基于该注册处理流程，将待显示数据发送至主叫运营商网络，由主叫运营商网络根据来自第一用户的待显示数据生成呼叫名片。
可知，在注册阶段，主叫运营商网络已成功获取到呼叫名片，在后续的主叫运营商网络呼叫第二用户时，主叫运营商网络无需在呼叫过程中获取呼叫名片，而是直接将已在注册阶段获取到的呼叫名片发送至第二用户，节省了呼叫过程中主叫运营商网络与企业鉴权服务器之间所交互的信息量，缩短了呼叫接续时延，提高了呼叫效率，具体参见图2所示，
图2为本申请所提供的主叫通信系统执行注册的过程的一种实施例步骤流程图。
步骤201、第一终端向企业鉴权服务器发送登录请求。
本实施例以第一终端向企业鉴权服务器发送登录请求为例进行示例性说明，在其他示例中，也可由企业接入代理设备向企业鉴权服务器发送登录请求，不做限定。该第一终端可运行企业应用程序(APP)，该第一终端通过该企业APP能够实现本申请所示的呼叫处理的方法中，由第一终端执行的流程。
第一用户对企业外部的第二用户进行呼叫时，可通过第一终端向企业鉴权服务器发送该登录请求，该登录请求包括该第一用户的第一用户标识。
本实施例所示的第一用户标识(也可称之为UserID)可为该第一用户的邮箱地址，例如，zhangsan@xxx.com。本实施例所示的第一用户标识有别于现有的E.164号码，可见，该第一用户标识对主叫运营商网络而言属于异构标识，本申请所示的第一用户向第二用户进行呼叫的过程，所使用的不是E.164号码，而是本实施例所提供的作为异构标识的第一用户标识(即第一用户的邮箱地址)。
步骤202、第一终端接收来自企业鉴权服务器的注册鉴权标识。
本实施例所示的企业鉴权服务器接收到该第一用户标识，即可为该第一用户标识分配注册鉴权标识，该注册鉴权标识用于注册至主叫运营商网络。
本实施例对注册鉴权标识不做限定，本实施例以该注册鉴权标识为令牌(token)为例进行示例性说明。
步骤203、第一终端向主叫S-CSCF发送注册请求。
其中，所述注册请求包括所述第一用户的第一用户标识和所述注册鉴权标识。
本实施例所示的注册请求为会话发起协议(session initiation protocol，SIP)注册(REGISTER)消息，该注册请求需要携带第一用户的第一用户标识和所述注册鉴权标识。
本实施例所示的token可使用基于64个可打印字符来表示二进制数据(Base64)的编码格式,该token可通过授权(Authorization)头域和扩展的鉴权方式(如Bearer)携带,如消息格式可为：Authorization:Bearer<Base64(<token>)>。
例如，该SIP REGISTER消息具体可为如下所示：
SIP REGISTER:2b.ims.<operator>.com
From/To:SIP zhangsan％40xxx.com@2b.ims.<operator>.com
Authorization:Bearer<Base64(<token>)>
以下对第一终端向主叫S-CSCF发送注册请求的过程进行说明：
参见图1所示，第一终端133向主叫P-CSCF126发送该注册请求，主叫P-CSCF再转发该注册请求至主叫S-CSCF124，其中，主叫P-CSCF按照SIP用户注册的标准流程(参见3GPP TS 24.229)处理SIP REGISTER消息后转发给主叫S-CSCF。
步骤204、主叫S-CSCF向网络鉴权服务器发送第一用户标识和注册鉴权标识。
主叫S-CSCF判断注册请求使用Bearer的鉴权方式时，向网络鉴权服务器发送第一用户标识和注册鉴权标识，以请求网络鉴权服务器利用注册鉴权标识对第一用户进行鉴权。
步骤205、网络鉴权服务器向企业鉴权服务器发送鉴权请求。
本实施例所示的网络鉴权服务器接收到该第一用户标识的情况下，即可根据该第一用户标识确定出对应的企业鉴权服务器。
由上述示例可知，本实施例所示的第一用户标识为用户的邮箱地址(例如，zhangsan@xxx.com)，则网络鉴权服务器即可在第一用户标识中获得企业域名(例如xxx.com)。网络鉴权服务器根据该企业域名即可查询出企业鉴权服务器的地址。
具体地，由上述所示可知，网络鉴权服务器从主叫S-CSCF接收到的第一用户标识为zhangsan％40xxx.com，本步骤所示的网络鉴权服务器在根据第一用户标识确定对应的企业鉴权服务器的过程中，企业鉴权服务器对被转义的第一用户标识(zhangsan％40xxx.com)进行恢复以获取到恢复转义后的第一用户标识(zhangsan@xxx.com)。可见，网络鉴权服务器即可根据恢复转义后的第一用户标识查询出对应的企业鉴权服务器的地址。
本实施例所示的网络鉴权服务器向所述企业鉴权服务器所发送的鉴权请求包括注册鉴权标识。可选地，本实施例所示可通过超文本传输安全协议(hyper text transfer protocol over securesocket layer，HTTPS)发送所述鉴权请求。
步骤206、企业鉴权服务器判断注册鉴权标识是否有效，若否，则执行步骤207，若是，则执行步骤208。
本实施例所示的注册鉴权标识为token，则企业鉴权服务器即可判断该token是否位于有效期内，该有效期可为绝对有效期，例如，该有效期的起始时刻为A1，该有效期的终止时刻为A2，该A1时刻和A2时刻可为任意互不相同的两个时刻。若企业鉴权服务器判断出该token位于该有效期内，则企业鉴权服务器确定该token有效，若企业鉴权服务器判断出该token位于该有效期之外，则企业鉴权服务器确定该token无效。
又如，该有效期可为剩余有效时长，可见，若注册鉴权标识对应的剩余有效时长还有剩余时间，则企业鉴权服务器判断该token有效，若注册鉴权标识对应的剩余有效时长已无剩余时间，则企业鉴权服务器判断该token无效。
步骤207、企业鉴权服务器向网络鉴权服务器发送鉴权标识无效通知。
具体地，本实施例所示的企业鉴权服务器向网络鉴权服务器发送该鉴权标识无效通知，该鉴权标识无效通知用于指示该注册鉴权标识(token)无效。网络鉴权服务器接收到该鉴权标识无效通知的情况下，则不再执行与第一用户注册的相关流程。
步骤208、企业鉴权服务器向网络鉴权服务器发送鉴权成功指示。
本实施例所示的鉴权成功指示包括鉴权标识有效通知，该鉴权标识有效通知用于指示 该注册鉴权标识(token)有效。
本实施例所示的鉴权成功指示还包括第二用户标识，具体地，企业鉴权服务器预先创建不同的用户标识和不同的鉴权标识的对应关系，在企业鉴权服务器确定该注册鉴权标识有效的情况下，企业鉴权服务器即可将该有效的注册鉴权标识对应的第二用户标识发送至网络鉴权服务器。
可选地，本实施例所示的鉴权成功指示可包括如下所示的至少一项：
用于指示注册鉴权标识的有效期的消息，第一用户的名称(例如，zhangsan)，第一用户的头像的下载地址，用于指示该第一用户是否具有外呼权限的消息等。
步骤209、网络鉴权服务器向主叫应用服务器发送待显示数据。
本实施例中，在网络鉴权服务器确定第一用户通过鉴权的情况下，网络鉴权服务器即可将已获取到的待显示数据向主叫应用服务器发送。
本实施例以所述待显示数据包括与第一用户对应的信息和/或与第一用户所属的企业对应的信息，具体说明请参见图1相关的说明，具体不做赘述。
网络鉴权服务器获取待显示数据的方式可为，在企业鉴权服务器判断注册鉴权标识有效的情况下，企业鉴权服务器向网络鉴权服务器发送该待显示数据。又如，网络鉴权服务器在企业开户阶段获取该待显示数据。又如，网络鉴权服务器从企业鉴权服务器获取一部分的待显示数据(如与第一用户相关的信息)，网络鉴权服务器在企业开户阶段获取另一部分待显示数据(如与第一用户所属的企业相关的信息)等，具体在本实施例中不做限定。
本实施例所示的网络鉴权服务器确定第一用户通过鉴权的方式有可选地两种：
方式1：
由网络鉴权服务器负责对第一用户鉴权，具体地，所述网络鉴权服务器确定通过鉴权的条件有两个，一个条件是根据已接收到鉴权标识有效通知。另一个条件是该网络鉴权服务器确定第一用户标识和第二用户标识相同。
方式2：
由企业鉴权服务器负责对第一用户鉴权，企业鉴权服务器再将鉴权结果向网络鉴权服务器通知，具体地，所述网络鉴权服务器向企业鉴权服务器发送的鉴权请求包括所述第一用户标识，所述企业鉴权服务器在判断所述注册鉴权标识有效且所述第一用户标识和所述第二用户标识相同，则向网络鉴权服务器发送注册鉴权成功指示，网络鉴权服务器根据该注册鉴权成功指示以确定第一用户通过鉴权。
步骤210、主叫应用服务器获取呼叫名片。
本实施例所示的以主叫应用服务器用于获取呼叫名片为例进行示例性说明，在其他示例中，用于获取呼叫名片的设备可为主叫运营商网络所包括的任一设备。本实施例所示的主叫应用服务器获取呼叫名片的几种可选地方式为：
方式1
本实施例所示的主叫应用服务器能够接收到来自网络鉴权服务器的待显示数据，主叫应用服务器即可按照呼叫名片的排版方式，对待显示数据进行排版以获取呼叫名片。其中，该呼叫名片的排版方式可在企业开户阶段向网络鉴权服务器发送的，又如，该呼叫名片的 排版方式可在步骤209的过程中由网络鉴权服务器向主叫应用服务器发送的，即，网络鉴权服务器在确定第一用户通过鉴权的情况下，网络鉴权服务器即可将该呼叫名片的排版方式向主叫应用服务器发送。
该呼叫名片的排版方式是指，所生成的呼叫名片中，第一用户对应的信息和/或第一用户所属的企业对应的信息中，各信息的显示方式以及显示位置。
例如，第一用户的名称，第一用户的工号，第一用户的头像、第一用户的职位信息，与第一用户相关的音视频文件，第一用户所属的协会的信息，企业名称，企业商标，与企业相关的图片，与企业相关的音视频文件以及企业所属的协会的信息等，在呼叫名片中的显示方式以及显示位置。
本方式以呼叫名片存储于主叫应用服务器为例进行示例性说明，在其他示例中，在主叫应用服务器获取到呼叫名片后，主叫应用服务器将已生成的呼叫名片发送至文件服务器进行存储，并本地记录该呼叫名片的存储地址。
方式2
主叫应用服务器接收来自网络鉴权服务器的所述待显示数据以及呼叫名片的排版方式的情况下，网络鉴权服务器将待显示数据以及呼叫名片的排版方式转发给主叫媒体服务器122。主叫媒体服务器122按照呼叫名片的排版方式对待显示数据进行排版以获取呼叫名片。
主叫媒体服务器122将已生成的呼叫名片发送至文件服务器进行存储，并将呼叫名片的存储地址发送给主叫应用服务器。
方式3：
本方式中，网络鉴权服务器获取到待显示数据以及呼叫名片的排版方式的情况下，网络鉴权服务器按照呼叫名片的排版方式对待显示数据进行排版以生成呼叫名片。然后，网络鉴权服务器将该呼叫名片发送给主叫应用服务器。其中，网络鉴权服务器向主叫应用服务器发送该呼叫名片方式可为，网络鉴权服务器将所述呼叫名片存储至文件服务器，网络鉴权服务器将呼叫名片的存储地址发送给主叫应用服务器，所述主叫应用服务器即可根据该地址从文件服务器下载该呼叫名片。
采用本实施例所示的方法，企业内部的第一用户向企业外部的第二用户呼叫时，先执行注册处理流程，基于该注册处理流程，主叫应用服务器能够成功地获取到呼叫名片，以便于后续第一用户呼叫第二用户时，主叫应用服务器能够将该呼叫名片发送至第二用户，无需在呼叫的过程中执行生成呼叫名片的步骤，缩短了呼叫处理的时延，提高了呼叫效率，以使在第一用户呼叫第二用户的过程中，该呼叫名片能够显示于第二终端上。
而且基于本实施例所示的方法，在第一终端执行注册处理流程的过程中，实现了信任安全联盟所示的企业鉴权第一用户的过程。其中，为保证第一用户向第二用户所发送的呼叫名片的安全性，则本申请所示能够创建信任安全联盟，该信任安全联盟是指，主叫运营商网络鉴权企业，企业鉴权第一用户(可以理解，该第一用户为该企业的员工)，可见，若企业被主叫运营商网络鉴权通过，第一用户被企业鉴权通过，那么，主叫运营商网络可信任来自企业的数据，企业可信任来自第一用户的数据，主叫运营商网络基于可信任的来自企业的数据即可构造可信任的呼叫名片，从而保证主叫运营商网络向第二用户所发送的呼 叫名片的可信性。
需明确的是，上述对信任安全联盟所包括的对象的说明为可选地示例，不做限定，例如，该信任安全联盟还可指，主叫运营商网络鉴权第三方网络，第三方网络鉴权企业，企业鉴权第一用户，其中，该第三方网络可为企业租用的用于执行呼叫相关业务的网络，例如，该第三方网络可为软件即服务(software-as-a-service SaaS)平台。可见，若第三方网络被主叫运营商网络鉴权通过，企业被第三方网络鉴权通过，第一用户被企业鉴权通过，那么，主叫运营商网络可信任来自第三方网络的数据，第三方网络可信任来自企业的数据，企业可信任来自第一用户的数据，主叫运营商网络基于可信任的来自第三方网络的数据即可构造可信任的呼叫名片，从而保证主叫运营商网络向第二用户所发送的呼叫名片的可信性。
而且本实施例所示的方法，因主叫运营商网络鉴权企业，那么，网络鉴权服务器信任来自企业鉴权服务器的数据(如部分或全部待显示数据)，那么，无需第一用户在主叫运营商网络开户的情况下，即可使用主叫运营商网络提供的呼叫第二用户的业务，可见，本实施例所示的方法，第一用户能够在免开户的情况下实现对第二用户的呼叫，解决企业租用主叫运营商网络存在的企业员工(即第一用户)开户问题，从而避免了第一用户在主叫运营商网络开户所导致的第一用户上线慢，第一用户的个人隐私信息暴露的问题。
实施例二
本实施例说明基于图2所示的方法，在第一用户已注册至主叫运营商网络的情况下，第一用户如何使用第一终端实现对第二终端的呼叫。具体参见图3所示。
图3为本申请所提供的主叫通信系统执行呼叫的一种实施例步骤流程图。
步骤301、第一终端向第一呼叫设备发送第一呼叫请求消息。
本实施例所示的第一呼叫设备用于对该第一呼叫请求消息进行主叫侧验证，第一呼叫设备能够根据已通过主叫侧验证的第一呼叫请求消息触发第一用户对第二用户的呼叫。
本实施例所示的第一呼叫设备为主叫运营商网络所包括的主叫S-CSCF为例进行示例性说明，在其他示例中，该第一呼叫设备可为主叫运营商网络所包括的任一设备，或，该第一呼叫设备所执行的功能，可由主叫运营商网络所包括的至少两个设备执行，具体在本实施例中不做限定。
所述第一呼叫请求消息为SIP INVITE消息，该第一呼叫请求消息基于控制面传输，其中，第一呼叫请求消息基于控制面传输是指，该第一呼叫请求消息为通过SIP协议传输的信令流。
该SIP INVITE消息包括所述第一用户的第一用户标识和呼叫鉴权标识，对第一用户标识和呼叫鉴权标识的说明，请参见实施例一所示的对第一用户的用户标识和注册鉴权标识的说明，具体不做赘述。
以下对第一终端向主叫S-CSCF发送第一呼叫请求消息的过程进行说明：
第一终端向主叫P-CSCF发送该SIP INVITE消息，主叫P-CSCF按照SIP用户始发呼叫的标准流程(参见3GPP TS 24.229和3GPP TS 26.114)处理该SIP INVITE消息后转发给 主叫S-CSCF。
本实施例所示的SIP INVITE消息的格式示例可参见如下所示：
INVITE tel:+86139XXXXXXXXX
From：<sip：zhangsan％40xxx.com@2b.ims.<operator>.com>
To：<tel:+86139XXXXXXXXX>
Authorization:Bearer<Base64(<token>)>
其中，“+86139XXXXXXXXX”为第二用户的号码。本实施例所示的第一用户标识UserID以zhangsan@xxx.com为例，本示例通过SIP用户标识携带第一用户标识，该SIP用户标识可为zhangsan@xxx.com@2b.ims.<operator>.com，其中，2b.ims.<operator>.com为主叫运营商网络为基于异构标识(即第一用户标识)接入主叫运营商网络的统一定义的固定域名。
因SIP协议所规定的消息中不能够包括两个“@”，则第一终端可对UserID(如zhangsan@xxx.com)中的“@”进行转义，本实施例对转义的具体规则的说明为可选地示例，不做限定，例如，第一终端将UserID中的“@”转义为“％40”。
本实施例所示的token可使用基于64个可打印字符来表示二进制数据(Base64)的编码格式,该token可通过授权(Authorization)头域和扩展的鉴权方式(如Bearer)携带,如消息格式可为：Authorization:Bearer<Base64(<token>)>。
步骤302、第一呼叫设备判断呼叫鉴权标识是否满足预设条件，若否，则执行步骤303，若是，则执行步骤304。
本实施例所示以第一呼叫设备为主叫运营商网络所包括的主叫S-CSCF执行步骤302为例进行示例性说明，在其他示例中，也可由主叫运营商网络所包括的其他任一设备执行本实施例所示的步骤302，对执行主体的说明，请参见上述步骤301所示，具体不做赘述。
本实施例所示的预设条件为所述呼叫鉴权标识和目标鉴权标识相同，且所述目标鉴权标识有效，可知，在主叫S-CSCF判断出呼叫鉴权标识满足预设条件的情况下，主叫S-CSCF即可确定该第一呼叫请求消息通过主叫侧验证。其中，该目标鉴权标识为所述主叫S-CSCF在实施例一所示的注册阶段所缓存的注册鉴权标识。
若所述主叫S-CSCF判断呼叫鉴权标识和目标鉴权标识相同，且所述目标鉴权标识有效，确定该呼叫鉴权标识满足该预设条件。
步骤303、第一呼叫设备拒绝第一呼叫请求消息所请求的呼叫。
执行步骤303的第一呼叫设备的说明，请参见步骤302所示，具体不做赘述。
在所述主叫S-CSCF拒绝第一呼叫请求消息所请求的呼叫的情况下，所述第一用户无法基于该第一呼叫请求消息实现对第二用户的呼叫。
步骤304、第一呼叫设备向第二呼叫设备发送第一呼叫请求消息。
本实施例所示的第一呼叫设备在确定第一呼叫请求消息经过主叫侧验证后，即可对该第一呼叫请求消息进行处理，并将处理后的第一呼叫请求消息发送给第二呼叫设备，该第二呼叫设备为被叫运营商网络所包括的任一设备或该第二呼叫设备可为被叫运营商网络所包括的至少两个设备实现，具体不做限定。执行本实施例所示的步骤304的第一呼叫设备 可为主叫运营商网络所包括的主叫S-CSCF等任一设备，对执行主体的说明，可参见上述步骤所示，具体不做赘述。
以下对第一呼叫设备向第二呼叫设备发送第一呼叫请求消息的具体过程进行说明：
可知，在步骤303中，作为第一呼叫设备的主叫S-CSCF已确定第一呼叫请求消息经过主叫侧验证后，主叫S-CSCF对该第一呼叫请求消息进行处理，主叫S-CSCF可将处理后的第一呼叫请求消息发送至第二呼叫设备。
其中，主叫S-CSCF对该第一呼叫请求消息进行处理具体处理过程如下：
本实施例中，主叫S-CSCF可从安全密钥存储(secure key store，SKS)获取私钥。主叫S-CSCF获取第一呼叫请求消息的呼叫数据，并基于该私钥对呼叫数据进行签名以获取第一签名信息，其中，呼叫数据可包括第一用户的标识，第二用户的标识，第一终端的网际互连协议(internet protocol，IP)地址和端口号等，该呼叫数据用于创建第一呼叫设备和第二呼叫设备之间的媒体通道。本实施例所示的主叫S-CSCF可将该第一签名信息设置在第一呼叫请求消息的头消息中。
具体地，创建第一呼叫设备和第二呼叫设备之间的媒体通道是指，第一呼叫设备通过该第一呼叫请求消息向第二呼叫设备发送用于创建媒体通道的第一终端的网际互连协议(internet protocol，IP)地址和端口号。第二呼叫设备根据该第一呼叫请求消息，向第一呼叫设备返回用于创建媒体通道的第二终端的IP地址和端口号，基于第一终端的IP地址和端口号，以及第二终端的IP地址和端口号，能够创建第一呼叫设备和第二呼叫设备之间的媒体通道，即该媒体通道的一端为第一呼叫设备的IP地址和端口号，媒体通道的另一端为第二呼叫设备的IP地址和端口号，基于该媒体通道实现第一呼叫设备和第二呼叫设备之间的媒体面信息的传输。
其中，该媒体面信息是指采用媒体面协议封装的报文，该媒体面协议可为安全实时传输协议(securereal-time transport protocol，SRTP)或实时传输协议(real-time transport protocol，RTP)等。
本实施例所示的主叫S-CSCF还可在第一呼叫请求消息中设置第一指示消息，该第一指示消息用于请求签名密钥，该签名密钥为用于对呼叫名片进行签名的密钥。
可选地，本实施例所述的第一指示消息还可用于指示所述第一呼叫设备支持对呼叫名片签名的能力。例如，本实施例所示的第一指示消息可为“Supported：early-media-authentication-with-shaken”。在第二呼叫设备接收到该第一指示消息的情况下，即可根据该第一指示消息确定第一呼叫设备向第二呼叫设备请求签名密钥，而且第一呼叫设备支持对呼叫名片签名的能力。
可选地，本实施例所示的第一呼叫请求消息还包括认证等级信息，本实施例所示的主叫S-CSCF预先创建第一用户的标识与认证等级信息的对应关系，在主叫S-CSCF接收到第一用户的标识的情况下，即可确定对应的认证等级信息。其中，认证等级信息可包括A级等级信息，B级等级信息以及C级等级信息，其中，A级等级信息，B级等级信息以及C级等级信息表示第一用户的可信度依次降低。
以下对第一呼叫设备向第二呼叫设备发送该处理后的第一呼叫请求消息的过程进行示 例性说明：
本实施例中，主叫S-CSCF将第一呼叫请求消息的目的IP地址设置为第二呼叫设备的IP地址，将第一呼叫请求消息的目的端口号设置有第二呼叫设备的端口号，主叫S-CSCF根据第一呼叫请求消息所携带的目的IP地址和目的端口号向第二呼叫设备发送第一呼叫请求消息，以实现第一呼叫设备向第二呼叫设备发送第一呼叫请求消息的目的。
步骤305、第二呼叫设备向第二终端发送第一呼叫请求消息。
本实施例中，在第二呼叫设备确定第一呼叫请求消息经过被叫侧验证后，再将该经过被叫侧验证的第一呼叫请求消息发送至第二终端。本实施例所示的第二呼叫设备可为被叫运营商网络所包括的任一设备，例如，该第二呼叫设备可为被叫运营商网络所包括的被叫S-CSCF、被叫应用服务器或被叫P-CSCF等任一设备，对被叫运营商网络的结构的说明，可参见图1所示的对主叫运营商网络的结构的说明，具体不做赘述。
本实施例以第二呼叫设备为被叫S-CSCF为例进行示例性说明，以下对被叫S-CSCF实现对第一呼叫请求消息的被叫侧验证的过程进行说明：
被叫S-CSCF接收该第一呼叫请求消息后，被叫S-CSCF根据已获取的公钥对第一呼叫请求消息所包括的第一签名信息进行签名验证，该公钥为经过证书中心(certificate authority，CA)认证后的公钥。
若被叫S-CSCF确定该第一签名信息通过签名验证，则被叫S-CSCF确定所述第一呼叫请求消息经过被叫侧验证。在被叫S-CSCF确定该第一签名信息通过签名验证后，说明该呼叫数据为未经过篡改而且完整的数据。
被叫S-CSCF确定第一呼叫请求消息经过被叫侧验证后，被叫S-CSCF通过被叫P-CSCF向第二终端发送所述第一呼叫请求消息。
具体地，被叫S-CSCF将第一呼叫请求消息的IP地址设置为被叫P-CSCF的IP地址，再将目的端口号设置为被叫P-CSCF的端口号，被叫S-CSCF根据第一呼叫请求消息所携带的目的IP地址和目的端口号向被叫P-CSCF发送第一呼叫请求消息。该第一呼叫请求消息携带第二终端的标识，被叫P-CSCF根据第二终端的标识获取对应的第二终端的IP地址和端口号，被叫P-CSCF将第一呼叫请求消息的目的IP地址设置为第二终端的IP地址，再将第一呼叫请求消息的目的端口号修改为第二终端的端口号，被叫P-CSCF根据第一呼叫请求消息所携带的目的IP地址和目的端口号，向第二终端发送该第一呼叫请求消息。
步骤306、第二终端向第二呼叫设备发送180振铃消息。
在第二终端已成功接收到第一呼叫请求消息的情况下，该第二终端可根据该第一呼叫请求消息振铃，第二终端成功振铃的情况下，可向第二呼叫设备发送180振铃消息，以通知该第二终端已振铃。
第二终端向第二呼叫设备发送180振铃消息的过程，可参见第二呼叫设备向第二终端发送第一呼叫请求消息的过程，具体不做赘述。
本实施例中，在第一呼叫请求消息已携带认证等级信息的情况下，则第二终端可显示该认证等级信息。例如，若第一呼叫请求消息携带A级等级信息，那么，第二终端可在振铃的同时显示该A级等级信息。
本实施例所示的180振铃消息还携带第二终端的IP地址和端口号，以实现第一呼叫设备和第二呼叫设备之间的媒体通道的创建。
步骤307、第二呼叫设备向第一呼叫设备发送180振铃消息。
本实施例所示的第二呼叫设备接收到该180振铃消息后，可对该180振铃消息进行处理，并将处理后的180振铃消息转发给第一呼叫设备。
具体地，第二呼叫设备将主密钥(S-key)和主盐密钥(S-salt)设置于180振铃消息中。本实施例所示的所述主密钥和所述主盐密钥为用于SRTP所需要的密钥。
本实施例中，第二呼叫设备可在本步骤307所示的，在第二呼叫设备接收到180振铃消息的情况下获取该主密钥和主盐密钥，或者，第二呼叫设备可在接收到来自第一呼叫设备的第一呼叫请求消息的情况下，获取该主密钥和主盐密钥，具体在本实施例中不做限定，本实施例以第二呼叫设备在接收到第一呼叫请求消息的情况下获取该主密钥和主盐密钥为例，以下对第二呼叫设备获取该主密钥和主盐密钥的过程进行说明：
首先，第二呼叫设备确定第一呼叫请求消息已携带该第一指示消息，由步骤304所示可知，该第一指示消息用于请求签名密钥。第二呼叫设备根据该第一呼叫请求消息确定需要获取用于SRTP的主密钥和主盐密钥。
其次，第二呼叫设备基于SRTP密钥管理算法获取对应的主密钥和主盐密钥。
本实施例所示的第二呼叫设备为保证向第一呼叫设备所传输的主密钥和主盐密钥的安全，第二呼叫设备可基于已存储的公钥对主密钥和主盐密钥进行签名以获取第二签名信息。第二呼叫设备将该第二签名信息设置于180振铃消息中。
本实施例所示的第二呼叫设备还可在180振铃消息中设置第二指示消息，其中，所述第二指示消息用于指示第二呼叫设备支持验证所述待显示数据安全性的能力。可知，第一呼叫设备在接收到该第二指示消息的情况下，即可将签名后的呼叫名片发送给第二呼叫设备。第一呼叫设备和第二呼叫设备基于该第一指示消息和第二指示消息的协商，能够实现第二终端显示经由第一呼叫设备签名和经由第二呼叫设备对呼叫名片进行签名验证的目的。
本实施例所示的第二呼叫设备还可在180振铃消息中设置第二呼叫设备的地址，其中，该第二呼叫设备的地址包括第二呼叫设备的IP地址以及端口号。
本实施例中，在第二呼叫设备接收到来自第一呼叫设备的第一呼叫请求消息的情况下，第二呼叫设备能够获取第一呼叫请求消息所携带的第一终端的IP地址和端口号。在第一呼叫设备接收到该180振铃消息的情况下，第一呼叫设备能够获取第二终端的IP地址和端口号，基于第一终端的IP地址和端口号，以及第二终端的IP地址和端口号，能够创建第一呼叫设备和第二呼叫设备之间的媒体通道。
步骤308、第一呼叫设备向第一终端发送180振铃消息。
所述第一呼叫设备接收到该180振铃消息后，即可向第一终端发送该180振铃消息，第一呼叫设备向第一终端发送180振铃消息的过程，可参见第二呼叫设备向第二终端发送第一呼叫请求消息的过程，具体不做赘述。本实施例所示的180振铃消息可携带第一用户的标识，以保证第一呼叫设备能够基于该第一用户的标识获取第一终端的IP地址和端口号，以向第一终端发送该180振铃消息。第一终端根据该180振铃消息确定第二终端已成功接 收到第一呼叫请求消息，且该第二终端已振铃。
步骤309、第一呼叫设备获取签名密钥。
具体地，第一呼叫设备接收到180振铃消息后，从180振铃消息中提取出第二签名信息。第一呼叫设备基于私钥对第二签名信息进行签名验证以获取所述第二签名信息所携带的所述主密钥和所述主盐密钥。第一呼叫设备通过密钥推导函数对所述主密钥和所述主盐密钥进行计算以获取签名密钥。
步骤310、第一呼叫设备向第二呼叫设备发送SRTP协议报文。
本实施例所示的第一呼叫设备能够获取呼叫名片，具体说明请参见实施例一所示，具体不做赘述。
为更好地理解，以下结合表1所示对SRTP协议报文的结构进行说明：
表1
Figure PCTCN2022122530-appb-000001
其中，V表示版本号，P表示填充位，X表示扩展位，CC表示特约信源(CSRC)标识符的数目，M表示用于指示不同有效载荷含义的标记，PT表示有效载荷类型。
本实施例所示的SRTP协议报文的payload携带呼叫名片，第一呼叫设备基于签名密钥对payload进行签名以获取第一验证签名信息，该第一验证签名信息作为表1所示的身份验证标签(authentication tag)。
上述所示的180振铃消息已携带第二呼叫设备的地址，第一呼叫设备根据第二呼叫设备的地址，向第二呼叫设备发送该SRTP协议报文。可知，由于本实施例所示的SRTP协议报文是基于SRTP协议传输的报文，该SRTP协议报文在第一呼叫设备和第二呼叫设备之间基于媒体通道传输。
步骤311、第二呼叫设备向第二终端发送呼叫名片。
第二呼叫设备将来自第一呼叫设备的SRTP协议报文转发给第二呼叫设备，第二呼叫设备可从SRTP协议报文中获取第二终端的IP地址和端口号，第二呼叫根据SRTP协议报文所携带的第二终端的IP地址和端口号，向第二终端发送呼叫名片。
步骤312、第二终端显示该呼叫名片。
可知，本实施例所示的第二终端能够在振铃的过程中，且在第二终端支持视频通话功能的情况下，所述第二终端显示该呼叫名片。
步骤313、第二呼叫设备判断呼叫名片是否通过安全性验证，若是，则执行步骤314，若否，则执行步骤315。
所述第二呼叫设备从SRTP协议报文中获取到呼叫名片后，所述第二呼叫设备判断该呼叫名片是否通过安全性验证，以下对所述第二呼叫设备如何判断该呼叫名片是否通过安全性验证的过程进行说明：
所述第二呼叫设备通过该签名密钥对呼叫名片进行签名以获取第二验证签名信息，若所述第二呼叫设备判断SRTP协议报文所携带的第一验证签名信息和第二验证签名信息相同，则确定呼叫名片通过安全性验证，则执行步骤314。若所述第二呼叫设备判断SRTP协议报文所携带的第一验证签名信息和第二验证签名信息不相同，则确定呼叫名片未通过安全性验证，则执行步骤315。
步骤314、第二呼叫设备向第二终端发送第一通知信息。
在所述第二呼叫设备确定呼叫名片通过安全性验证，则向第二终端发送用于指示呼叫名片通过安全性验证的第一通知信息，第二终端接收到该第一通知信息后，即可显示该第一通知信息，以保证第二用户根据第二终端已显示的第一通知信息，确定所显示的呼叫名片是安全的。
本实施例对第一通知信息的类型不做限定，该第一通知信息的类型可为文本信息，语音信息，或视频信息等，具体不做限定。
步骤315、第二呼叫设备向第二终端发送第二通知信息。
在所述第二呼叫设备确定呼叫名片未通过安全性验证，则向第二终端发送用于指示呼叫名片未通过安全性验证的第二通知信息，第二终端接收到该第二通知信息后，即可显示该第二通知信息，以保证第二用户根据第二终端已显示的第二通知信息，确定所显示的呼叫名片是不安全的。
本实施例对步骤311和步骤312之间的执行时序不做限定。本实施例以先执行步骤311，在执行步骤313为例进行示例性说明，即第二呼叫设备先向第二终端发送呼叫名片，再判断呼叫名片是否通过安全性验证。可知，第二终端先对呼叫名片进行显示，而后再接收来自第二呼叫设备的第一通知信息或第二通知信息，以确定已显示的呼叫名片是否安全。
在其他示例中，也可先执行步骤313，再执行步骤311，即第二呼叫设备先判断呼叫名片是否通过安全性验证，在第二呼叫设备确定呼叫名片已通过安全性验证的情况下，再将呼叫名片发送至第二终端，可知，此示例下的第二终端所接收到的呼叫名片为安全的。
本实施例中，在呼叫处理的过程中，因第一用户无需直接在主叫运营商网络开户，则避免第一用户的个人隐私信息在主叫运营商网络处暴露。本实施例所示的第二终端所显示的呼叫名片所包括的各个信息全部来自企业鉴权服务器和/或网络鉴权服务器，而非第一用户，避免了呼叫名片存在造假的情况。
而且第二终端所显示的呼叫名片是经过第一呼叫设备签名，第二呼叫设备的签名验证的，提高了呼叫名片的安全性，避免了呼叫名片出现篡改和泄漏的情况，提高了呼叫名片的安全和可信。
因本实施例所示的呼叫名片基于媒体通道传输，有效地提高了呼叫名片所传输的待显示数据的数据量，基于媒体通道传输能够实现第一用户垮运营商实现对第二用户呼叫的目的。
实施例三
实施例二所示的第一用户呼叫第二用户的过程中，需要第一用户预先注册至主叫运营商网络，注册过程如实施例一所示。以下结合图4所示对第一用户无需预先注册至主叫运营商网络的情况下，直接实现第一用户呼叫第二用户的过程进行说明。
图4为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图。
步骤401、第一终端向第一呼叫设备发送第二呼叫请求消息。
在第一用户确定需要呼叫第二用户时，所述第一用户即可通过该第一终端向第一呼叫设备发送第二呼叫请求消息，以触发第一用户对第二用户的呼叫。所述第二呼叫请求消息可为SIP INVITE消息，该SIP INVITE消息包括所述第一用户的第一用户标识和呼叫鉴权标识，对第一用户标识和呼叫鉴权标识的说明，请参见实施例二所示的对第一用户的第一用户标识和呼叫鉴权标识的说明，具体不做赘述。对第一呼叫设备的具体说明，请参见实施例二所示，具体不做赘述。
步骤402、第一呼叫设备向企业鉴权服务器发送呼叫鉴权请求。
本实施例以第一呼叫设备为主叫S-CSCF为例，主叫S-CSCF向主叫应用服务器发送第二呼叫请求消息。其中，若主叫S-CSCF确定该第二呼叫请求消息所包括的呼叫鉴权标识与目标鉴权标识相同，而且主叫S-CSCF判断第二呼叫请求消息使用Bearer的鉴权方式时，所述主叫S-CSCF向网络鉴权服务器发送包括第一用户标识和呼叫鉴权标识的第二呼叫请求消息，以请求网络鉴权服务器利用呼叫鉴权标识对第一用户进行鉴权。对呼叫鉴权标识和Bearer的鉴权方式的具体说明，请详见实施例二所示，具体不做赘述。
本实施例所示的网络鉴权服务器接收到来自主叫S-CSCF的第一用户标识和呼叫鉴权请求后，向企业鉴权服务器发送鉴权请求的过程的说明，请参见实施例一的步骤205所示，具体不做赘述。
步骤403、企业鉴权服务器判断呼叫鉴权标识是否有效，若否，则执行步骤404，若是，则执行步骤405。
本实施例所示的步骤504的具体执行过程，请参见实施例二的步骤206所示，具体不做赘述。
步骤404、企业鉴权服务器向第一呼叫设备发送呼叫鉴权标识无效通知。
具体地，本实施例所示的企业鉴权服务器可向第一呼叫设备发送该呼叫鉴权标识无效通知，具体执行过程的说明，可参加实施例一的步骤207所示，具体不做赘述。
步骤405、企业鉴权服务器向第一呼叫设备发送呼叫鉴权成功指示。
具体地，本实施例所示的企业鉴权服务器可向第一呼叫设备发送该呼叫鉴权成功指示，具体执行过程的说明，可参加实施例一的步骤208所示，具体不做赘述。
步骤406、第一呼叫设备获取待显示数据。
本实施例所示的第一呼叫设备获取该待显示数据的过程，可参加实施例一所示的步骤209至步骤210所示，具体不做赘述。
步骤407、第一呼叫设备向第二呼叫设备发送第二呼叫请求消息。
步骤408、第二呼叫设备向第二终端发送第二呼叫请求消息。
步骤409、第二终端向第二呼叫设备发送180振铃消息。
步骤410、第二呼叫设备向第一呼叫设备发送180振铃消息。
步骤411、第一呼叫设备向第一终端发送180振铃消息。
步骤412、第一呼叫设备获取签名密钥。
步骤413、第一呼叫设备向第二呼叫设备发送SRTP协议报文。
步骤414、第二呼叫设备向第二终端发送呼叫名片。
步骤415、第二终端显示该呼叫名片。
步骤416、第二呼叫设备判断呼叫名片是否通过安全性验证，若是，则执行步骤417，若否，则执行步骤418。
步骤417、第二呼叫设备向第二终端发送第一通知信息。
步骤418、第二呼叫设备向第二终端发送第二通知信息。
本实施例所示的步骤407至步骤418的执行过程，请参加实施例二所示的步骤304至步骤315所示，具体不做赘述。
本实施例中，第一用户在对第二用户进行呼叫的过程中，第一用户无需预先注册至运营商网络，避免在第一用户呼叫第二用户的过程中，需要预先进行注册的步骤，提高了第一用户呼叫第二用户的效率，同时减少了注册相关资源的消耗。
而且在主叫运营商网络、企业、企业员工(第一用户)之间建立信任安全联盟，可保证第二终端振铃时，所显示的呼叫名片的信息是安全的，而且呼叫名片满足呼叫名片的排版方式，以保证呼叫名片所呈现的各项信息能够符合企业定制的需求，且呼叫名片的风格统一。
在呼叫处理的过程中，因第一用户无需直接在运营商网络开户，则避免第一用户的个人隐私信息在主叫运营商处暴露，而且在对第二用户进行呼叫的过程中，呼叫名片所显示的信息也可不涉及第一用户的个人隐私信息，有效地保证了第一用户的个人隐私信息的安全。
本实施例所示的第二终端所显示的呼叫名片所包括的各个信息全部来自企业鉴权服务器和/或网络鉴权服务器，而非第一用户，如果呼叫名片存在造假的问题，则可以基于信任安全联盟形成的信任链进行溯源和追责。
实施例四
实施例二所示的第一呼叫设备通过向第二呼叫设备发送SRTP协议报文的方式，以使第二终端显示呼叫名片。而本实施例所示的第一呼叫可不基于SRTP协议，实现呼叫名片的传输，本实施例所示的方法基于图2所示的方法，在第一用户已注册至主叫运营商网络的情况下，第一用户如何使用第一终端实现对第二终端的呼叫。具体参见图5所示。
图5为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图。
步骤501、第一终端向第一呼叫设备发送第一呼叫请求消息。
步骤502、第一呼叫设备判断呼叫鉴权标识是否满足预设条件，若否，则执行步骤503， 若是，则执行步骤504。
步骤503、第一呼叫设备拒绝第一呼叫请求消息所请求的呼叫。
步骤504、第一呼叫设备向第二呼叫设备发送第一呼叫请求消息。
步骤505、第二呼叫设备向第二终端发送第一呼叫请求消息。
步骤506、第二终端向第二呼叫设备发送180振铃消息。
步骤507、第二呼叫设备向第一呼叫设备发送180振铃消息。
步骤508、第一呼叫设备向第一终端发送180振铃消息。
本实施例所示的步骤501至步骤508的执行过程的说明，请参见实施例二所示的步骤301至步骤308所示，具体执行过程不做赘述。
步骤509、第一呼叫设备获取签名密钥。
本实施例所示的验证签名可参见实施例二所示的步骤309所示，可选地，本实施例所示的签名密钥还可为主叫运营商网络根据预先选定的安全散列算法(secure hash algorithm，SHA)所包括的任一算法导出，例如，本实施例所示的签名密钥为主叫运营商网络根据预先选定的算法SHA1导出。
步骤510、第一呼叫设备向第二呼叫设备发送媒体报文。
本实施例所示的媒体报文可采用实时传输协议(real-time transport protocol，RTP)。RTP协议为语音、图像、传真等多种多媒体数据提供端到端的实时传输服务。本实施例所示的媒体报文可包括呼叫名片，主叫运营商网络(如主叫运营商网络所包括的主叫媒体服务器)基于签名密钥对呼叫名片进行签名以获取第一验证签名信息，并将该第一验证签名信息设置于媒体报文中。本实施例以RTP协议为例进行示例性说明，不做限定，在其他示例中，可采用任一媒体面协议传输呼叫名片和签名。
步骤511、第二呼叫设备向第二终端发送呼叫名片。
步骤512、第二终端显示该呼叫名片。
步骤513、第二呼叫设备判断呼叫名片是否通过安全性验证，若是，则执行步骤514，若否，则执行步骤515。
步骤514、第二呼叫设备向第二终端发送第一通知信息。
步骤515、第二呼叫设备向第二终端发送第二通知信息。
本实施例所示的步骤511至步骤515的执行过程的说明，请参见步骤311至步骤315所示，具体不做赘述。
本申请所示的第一用户也可无需预先注册至主叫运营商网络的情况下，直接实现第一用户呼叫第二用户的过程，具体执行过程可参见实施例三所示，实施例三所示的签名密钥可为本实施例所示的SHA所包括的任一算法，具体过程不做赘述。
实施例五
上述实施例中，以第一呼叫设备为主叫运营商网络所包括的设备，第二呼叫设备为被叫运营商网络所包括的设备为例，说明第一用户向第二用户呼叫的过程。本实施例结合图6所示以第一呼叫设备为第一用户所使用的第一终端，第二呼叫设备为第二用户所使用的 第二终端为例，说明第一终端实现对呼叫名片的签名过程，以第二终端实现呼叫名片的签名验证过程，以实现第一用户呼叫第二用户为例进行示例性说明：
图6为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图。
步骤601、第一终端向主叫运营商网络发送第三呼叫请求消息。
本实施例所示的第三呼叫请求消息的具体说明，可参加实施例二的步骤301所示，具体不做赘述，本实施例所示的第三呼叫请求消息还包括第一签名信息，该第一签名消息的具体说明可如下所示：
第一终端可获取私钥。第一终端获取呼叫数据，并基于该私钥对呼叫数据进行签名以获取第一签名信息，其中，呼叫数据可包括第一用户的标识，第二用户的标识等，该呼叫数据用于创建第一终端和第二终端之间的媒体通道传输。本实施例所示的第一终端可将该第一签名信息设置在第三呼叫请求消息的头消息中。对获取该第一签名消息的具体说明，也可参见实施例一的步骤304所示，具体不做赘述。
本实施例所示的第三呼叫请求消息还包括第一指示消息，该第一指示消息用于请求签名密钥，该签名密钥为用于对呼叫名片进行签名的密钥，对第一指示消息的具体说明，可参见实施例一的步骤304所示，具体不做赘述。
步骤602、主叫运营商网络判断呼叫鉴权标识是否满足预设条件，若否，则执行步骤603，若是，则执行步骤604。
步骤603、主叫运营商网络拒绝第三呼叫请求消息所请求的呼叫。
步骤604、主叫运营商网络向被叫运营商网络发送第三呼叫请求消息。
本实施例所示的步骤602至步骤604的执行过程的说明，请参见实施例二的步骤302至步骤304所示，具体不做赘述。
步骤605、被叫运营商网络向第二终端发送第三呼叫请求消息。
步骤606、第二终端确定第三呼叫请求消息通过被叫侧验证后，向被叫运营商网络发送180振铃消息。
本实施例所述的第二终端接收到第三呼叫请求消息后，对第三呼叫请求消息进行被叫侧验证，在确定第三呼叫请求消息通过被叫侧验证后，向被叫运营商网络发送180振铃消息。以下对第二终端如何实现对第三呼叫请求消息进行被叫侧验证的过程进行说明：
第二终端根据已获取的公钥对第三呼叫请求消息所包括的第一签名信息进行签名验证，该公钥的说明可参见实施例二所示，具体不做赘述。若第二终端第一签名信息通过签名验证后，第二终端确定第三呼叫请求消息所携带的呼叫数据为未经过篡改而且完整的数据。
本实施例所示的180振铃消息的具体说明，请参见实施例二的步骤306所示，具体不做赘述。
步骤607、被叫运营商网络向主叫运营商网络发送180振铃消息。
步骤608、主叫运营商网络向第一终端发送180振铃消息。
步骤609、第一终端获取签名密钥。
本实施例所示的第一终端获取签名密钥的过程，可参见实施例二的步骤309所示的主叫运营商网络获取签名密钥的过程，具体不做赘述。
步骤610、第一终端向主叫运营商网络发送SRTP协议报文。
具体地，本实施例所示的第一终端获取呼叫名片，第一终端通过该SRTP协议报文携带该呼叫名片。本实施例所示的第一终端获取SRTP协议报文的具体过程，可参见实施例二的步骤310所示的主叫运营商网络获取该SRTP协议报文的过程，具体不做赘述。
步骤611、主叫运营商网络向被叫运营商网络发送SRTP协议报文。
步骤612、被叫运营商网络向第二终端发送呼叫名片。
步骤613、第二终端显示该呼叫名片。
本实施例所示的步骤613的执行过程的说明，请参见实施例二所示的步骤312所示，具体不做赘述。
步骤614、第二终端判断呼叫名片是否通过安全性验证，若是，则执行步骤615，若否，则执行步骤616。
本实施例所示的第二终端判断呼叫名片是否通过安全性验证的过程，请参见实施例二的步骤313所示的被叫运营商服务器判断呼叫名片是否通过安全性验证的过程，具体不做赘述。
步骤615、第二终端显示第一通知信息。
步骤616、第二终端显示第二通知信息。
本实施例所示的第一通知信息和第二通知信息的说明，请分别参见实施例二的步骤314和步骤315所示，具体不做赘述。
可知，本实施例所示的第一终端负责对呼叫名片进行签名，而第二终端负责对呼叫名片进行签名验证并进行显示，可减少主叫运营商网络和被叫运营商网络的算力资源。而且因本实施例由第一终端和第二终端执行呼叫名片的签名和签名验证过程，则使得第一终端和第二终端可应用至任意类型的运营商网络中，降低了对运营商网络类型的限制。
实施例六
实施例五所示的第一用户呼叫第二用户的过程中，需要第一用户预先注册至主叫运营商网络，注册过程如实施例一所示。以下结合图7所示对第一用户无需预先注册至主叫运营商网络的情况下，直接实现第一用户呼叫第二用户的过程进行说明，本实施例所示以第一呼叫设备为第一用户所使用的第一终端，第二呼叫设备为第二用户所使用的第二终端为例，具体说明请参见实施例五所示：
图7为本申请所提供的主叫通信系统执行呼叫的另一种实施例步骤流程图。
步骤701、第一终端向主叫运营商网络发送第四呼叫请求消息。
在第一用户确定需要呼叫第二用户时，所述第一用户即可通过该第一终端向主叫运营商网络发送第四呼叫请求消息，以触发第一用户对第二用户的呼叫。所述第四呼叫请求消息可为SIP INVITE消息，该SIP INVITE消息包括所述第一用户的第一用户标识和呼叫鉴权标识，对第一用户标识和呼叫鉴权标识的说明，请参见实施例二所示的对第一用户的第一用户标识和呼叫鉴权标识的说明，具体不做赘述。
本实施例所示的第四呼叫请求消息还包括第一签名信息，可选地，该第四呼叫请求消 息还包括第一指示消息，对第一签名消息和第一指示消息的说明，请参见实施例五的步骤601所示，具体不做赘述。
步骤702、主叫运营商网络向企业鉴权服务器发送呼叫鉴权请求。
步骤703、企业鉴权服务器判断呼叫鉴权标识是否有效，若否，则执行步骤704，若是，则执行步骤705。
步骤704、企业鉴权服务器向第一终端发送呼叫鉴权标识无效通知。
步骤705、企业鉴权服务器向第一终端发送呼叫鉴权成功指示。
步骤706、第一终端获取待显示数据。
本实施例所示的第一终端获取该待显示数据的过程，可参加实施例一所示的步骤209至步骤210所示，具体不做赘述。
步骤707、主叫运营商网络向被叫运营商网络发送第四呼叫请求消息。
步骤708、被叫运营商网络向第二终端发送第四呼叫请求消息。
步骤709、第二终端向被叫运营商网络发送180振铃消息。
步骤710、被叫运营商网络向主叫运营商网络发送180振铃消息。
步骤711、主叫运营商网络向第一终端发送180振铃消息。
步骤712、第一终端获取签名密钥。
步骤713、第一终端向主叫运营商网络发送SRTP协议报文。
步骤714、主叫运营商网络向被叫运营商网络发送SRTP协议报文。
步骤715、被叫运营商网络向第二终端发送呼叫名片。
步骤716、第二终端显示该呼叫名片。
步骤717、第二终端判断呼叫名片是否通过安全性验证，若是，则执行步骤718，若否，则执行步骤719。
步骤718、第二终端显示第一通知信息。
步骤719、第二终端显示第二通知信息。
本实施例所示的步骤707至步骤719的执行过程，请参加实施例五所示的步骤604至步骤616所示，具体不做赘述。
本实施例中，第一用户在对第二用户进行呼叫的过程中，第一用户无需预先注册至运营商网络，避免在第一用户呼叫第二用户的过程中，需要预先进行注册的步骤，提高了第一用户呼叫第二用户的效率，同时减少了注册相关资源的消耗。而且本实施例所示的第一终端负责对呼叫名片进行签名，而第二终端负责对签名后的呼叫名片进行签名验证并进行显示，可减少主叫运营商网络和被叫运营商网络的算力资源。本实施例由第一终端和第二终端执行呼叫名片的签名和签名验证过程，则使得第一终端和第二终端可应用至任意类型的运营商网络中，降低了对运营商网络类型的限制。
本申请中，实施例五和实施例六所示的呼叫名片也可不基于SRTP协议，实现呼叫名片的传输，具体说明可参见实施例四所示，具体不做赘述。
本申请中，对呼叫名片的签名过程，可由第一终端执行，具体说明请参见实施例五和实施例六所示，而对签名后的呼叫名片签名验证的过程，可由第二呼叫设备执行，具体说 明可参见实施例一至实施例四任一实施例所示。又如，对呼叫名片的签名过程，可由第一呼叫设备执行，具体说明可参见实施例一至实施例四任一实施例所示，而对签名后的呼叫名片签名验证的过程，可由第二终端执行，具体说明可参加实施例五或实施例六所示，具体不做赘述。
需明确地是，在实施例一至实施例六中，运营商网络以IMS网络为例，本申请对运营商网络的具体网络类型不做限定，例如，本实施例所示的运营商网络可适用于任意架构的电信网络，具体网络类型在本实施例中不做限定。
实施例七
本实施例结合图8所示对用于执行上述方法实施例的第一呼叫设备的结构进行说明：
图8为本申请所提供的第一呼叫设备的一种实施例结构示例图。
所述第一呼叫设备包括：
第一获取模块801，用于获取签名密钥；
第二获取模块802，用于获取第一用户的待显示数据，所述第一用户用于所述第一呼叫设备呼叫第二呼叫设备，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；
签名模块803，用于通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息；
发送模块804，用于通过所述第一呼叫设备和所述第二呼叫设备之间的媒体通道，向所述第二呼叫设备发送所述待显示数据以及所述第一验证签名信息，所述第一验证签名信息用于验证所述待显示数据的安全性。
其中，所述签名模块803分别与第一获取模块801以及第二获取模块802连接，且所述签名模块803还与发送模块804连接。
可选地，若本实施例所示的第一呼叫设备应用于实施例二中，本实施例所示的第一呼叫设备还包括判断模块800，所述判断模块800用于执行步骤302以及步骤303。其中，所述判断模块800与发送模块804连接。所述发送模块804用于执行步骤304以及步骤308，所述第一获取模块801用于执行步骤309，所述签名模块803用于根据来自所述第一获取模块801的签名密钥以及来自第二获取模块802的待显示数据获取第一验证签名信息，具体说明请参见步骤310所示，所述发送模块804用于执行步骤310。
可选地，若本实施例所示的第一呼叫设备应用于实施例三中，所述发送模块804还用于执行步骤402，所述第二获取模块802用于执行步骤406，所述发送模块804用于执行步骤407以及步骤411，所述第一获取模块801用于执行步骤412，所述签名模块803用于根据来自所述第一获取模块801的签名密钥以及来自第二获取模块802的待显示数据获取第一验证签名信息，具体说明请参见步骤413所示，所述发送模块804用于执行步骤413。
可选地，若本实施例所示的第一呼叫设备应用于实施例四中，所述判断模块800用于执行步骤502以及步骤503，所述发送模块804用于执行步骤504以及步骤508，所述第一获取模块801用于执行步骤509，所述签名模块803用于根据来自所述第一获取模块801 的签名密钥以及来自第二获取模块802的待显示数据获取第一验证签名信息，具体说明请参见步骤510所示，所述发送模块804用于执行步骤510。
可选地，若本实施例所示的第一呼叫设备应用于实施例五中，所述发送模块804用于执行步骤601，所述第一获取模块801用于执行步骤609，所述签名模块803用于根据来自所述第一获取模块801的签名密钥以及来自第二获取模块802的待显示数据获取第一验证签名信息，具体说明请参见步骤610所示，所述发送模块804用于执行步骤610。
可选地，若本实施例所示的第一呼叫设备应用于实施例六中，所述发送模块804用于执行步骤701，所述第一获取模块801用于执行步骤712，所述签名模块803用于根据来自所述第一获取模块801的签名密钥以及来自第二获取模块802的待显示数据获取第一验证签名信息，具体说明请参见步骤713所示，所述发送模块804用于执行步骤713。
实施例八
本实施例结合图9所示对用于执行上述方法实施例的第二呼叫设备的结构进行说明：
图9为本申请所提供的第二呼叫设备的一种实施例结构示例图。
所述第二呼叫设备包括：
接收模块901，用于接收来自第一呼叫设备的待显示数据以及第一验证签名信息，所述第一验证签名信息为通过签名密钥对所述待显示数据进行签名以获取，所述待显示数据和所述第一验证签名信息通过所述第一呼叫设备和所述第二呼叫设备之间的媒体通道传输，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；
签名模块902，用于通过所述签名密钥对所述待显示数据进行签名以获取第二验证签名信息；
验证模块903，用于若确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证，使所述待显示数据显示。
其中，所述接收模块901分别与所述签名模块902和所述验证模块903连接。
可选地，若本实施例所示的第二呼叫设备应用于实施例二中，所述第二呼叫设备还包括发送模块900，所述发送模块900可与接收模块901连接。所述发送模块900用于执行步骤305以及步骤307，所述接收模块901用于通过发送模块900，将已接收的待显示数据发送至第二终端，具体过程请参见步骤311所示，所述签名模块902和所述验证模块903，共同用于执行步骤313，所述发送模块900用于执行步骤314至步骤315。
可选地，若本实施例所示的第二呼叫设备应用于实施例三中，所述第二呼叫设备还包括发送模块900，所述发送模块900用于执行步骤408以及步骤410，所述接收模块901用于通过发送模块900，将已接收的待显示数据发送至第二终端，具体过程请参见步骤414所示，所述签名模块902和所述验证模块903，共同用于执行步骤416，所述发送模块900用于执行步骤417至步骤418。
可选地，若本实施例所示的第二呼叫设备应用于实施例四中，所述第二呼叫设备还包括发送模块900，所述发送模块900用于执行步骤505以及步骤507，所述接收模块901用 于通过发送模块900，将已接收的待显示数据发送至第二终端，具体过程请参见步骤511所示，所述签名模块902和所述验证模块903，共同用于执行步骤513，所述发送模块900用于执行步骤514至步骤515。
可选地，若本实施例所示的第二呼叫设备应用于实施例五中，所述第二呼叫设备还包括发送模块900，所述发送模块900用于执行步骤606，所述接收模块901用于接收来自被叫运营商网络的待显示数据，具体执行过程请参见步骤612所示，所述签名模块902和所述验证模块903，共同用于执行步骤614，所述发送模块900用于执行步骤615至步骤616。
可选地，若本实施例所示的第二呼叫设备应用于实施例六中，所述第二呼叫设备还包括发送模块900，所述发送模块900用于执行步骤709，所述接收模块901用于接收来自被叫运营商网络的待显示数据，具体执行过程请参见步骤715所示，所述签名模块902和所述验证模块903，共同用于执行步骤717，所述发送模块900用于执行步骤718至步骤719。
实施例九
本实施例结合图10所示，从实体硬件的角度对用于执行上述方法实施例的呼叫设备的结构进行说明：本实施例所示的呼叫设备可为上述所示的第一呼叫设备或第二呼叫设备。
图10为本申请所提供的呼叫设备的一种实施例结构示例图。
呼叫设备1000具体包括：处理器1001、存储器1002、总线1003、收发器1004以及网络接口1006。
具体的，存储器1002可以包括以易失性和/或非易失性存储器形式的计算机存储媒体，如只读存储器和/或随机存取存储器。存储器1002可以存储操作系统、应用程序、其他程序模块、可执行代码和程序数据。
收发器1004可以用于向呼叫设备输入命令和信息，该收发器1004可以通过总线1003连接至处理器1001。收发器1004还可以用于呼叫设备输出信息，例如所选定的占位服务器和/或占位虚拟机。
呼叫设备可以通过网络接口1006连接到通信网络中，在联网环境下，呼叫设备中存储的计算机执行指令可以存储在远程存储设备中，而不限于在本地存储。
当呼叫设备中的处理器1001执行存储器1002中存储的可执行代码或应用程序时，呼叫设备可以执行以上任一方法实施例由呼叫设备执行的操作，具体执行过程参见上述方法实施例，在此不再赘述。
本申请还提供了一种通信系统，该通信系统包括主叫通信系统以及被叫通信系统。
其中，主叫通信系统的具体说明，请详见图1所示，被叫通信系统的说明，请参见图1所示，具体不做赘述。本实施例所示的通信系统用于执行上述各方法实施例，具体执行过程，不做赘述。
以上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (29)

  1. 一种呼叫处理的方法，其特征在于，所述方法包括：
    第一呼叫设备获取签名密钥；
    所述第一呼叫设备获取第一用户的待显示数据，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；
    所述第一呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息；
    所述第一呼叫设备通过所述第一呼叫设备和第二呼叫设备之间的媒体通道，向所述第二呼叫设备发送所述待显示数据以及所述第一验证签名信息，所述第一验证签名信息用于验证所述待显示数据的安全性。
  2. 根据权利要求1所述的方法，其特征在于，所述第一呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息之前，所述方法还包括：
    所述第一呼叫设备向所述第二呼叫设备发送第一指示消息，所述第一指示消息用于指示所述第一呼叫设备支持对所述待显示数据签名的能力；
    所述第一呼叫设备接收来自所述第二呼叫设备的第二指示消息，所述第二指示消息用于指示所述第二呼叫设备支持验证所述待显示数据安全性的能力。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一呼叫设备获取第一用户的待显示数据包括：
    所述第一呼叫设备接收呼叫请求消息，所述呼叫请求消息携带所述待显示数据。
  4. 根据权利要求1或2所述的方法，其特征在于，所述第一呼叫设备获取第一用户的待显示数据包括：
    所述第一呼叫设备接收呼叫请求消息；
    所述第一呼叫设备获取与所述呼叫请求消息对应的所述待显示数据。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述第一呼叫设备获取签名密钥包括：
    所述第一呼叫设备向所述第二呼叫设备发送呼叫请求消息，所述呼叫请求消息用于请求获取所述签名密钥；
    所述第一呼叫设备接收来自所述第二呼叫设备的主密钥和主盐密钥，所述主密钥和所述主盐密钥用于安全实时传输协议SRTP；
    所述第一呼叫设备根据所述主密钥和所述主盐密钥，生成所述签名密钥。
  6. 根据权利要求5所述的方法，其特征在于，所述第一呼叫设备接收来自所述第二呼叫设备的主密钥和主盐密钥包括：
    所述第一呼叫设备接收来自所述第二呼叫设备的签名信息，所述签名信息包括通过公钥签名的所述主密钥和所述主盐密钥；
    所述第一呼叫设备通过私钥验证所述签名信息以获取所述主密钥和所述主盐密钥。
  7. 根据权利要求1至6任一项所述的方法，与所述第一用户对应的信息包括如下所示的至少一项：
    所述第一用户的名称，所述第一用户的工号，所述第一用户的头像，所述第一用户的职位信息，与所述第一用户相关的音视频文件，或所述第一用户所属的协会的信息；
    与所述第一用户所属的企业对应的信息包括如下所示的至少一项：
    所述企业名称，所述企业的商标，与所述企业相关的音视频文件，或所述企业所属的协会的信息。
  8. 一种呼叫处理的方法，其特征在于，所述方法包括：
    第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息，所述第一验证签名信息为通过签名密钥对所述待显示数据进行签名以获取，所述待显示数据和所述第一验证签名信息通过所述第一呼叫设备和所述第二呼叫设备之间的媒体通道传输，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；
    所述第二呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第二验证签名信息；
    若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证，使所述待显示数据显示。
  9. 根据权利要求8所述的方法，其特征在于，所述第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息之前，所述方法还包括：
    所述第二呼叫设备接收来自所述第一呼叫设备的第一指示消息，所述第一指示消息用于指示所述第一呼叫设备支持对所述待显示数据签名的能力；
    所述第二呼叫设备向所述第一呼叫设备发送第二指示消息，所述第二指示消息用于指示所述第二呼叫设备支持验证所述待显示数据安全性的能力。
  10. 根据权利要求8或9所述的方法，其特征在于，所述若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证之后，所述方法还包括：
    所述第二呼叫设备向第二终端发送所述待显示数据，所述第二终端为第二用户所使用的终端，所述第二终端用于显示所述待显示数据。
  11. 根据权利要求8或9所述的方法，其特征在于，所述第二呼叫设备为第二终端，所述第二终端为第二用户所使用的终端，所述若所述第二呼叫设备确定所述第一验证签名信 息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证之后，所述方法还包括：
    所述第二呼叫设备显示所述待显示数据。
  12. 根据权利要求10所述的方法，其特征在于，所述若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证之后，所述方法还包括：
    所述第二呼叫设备向所述第二终端发送通知消息，所述通知消息用于指示所述待显示数据通过安全性验证。
  13. 根据权利要求8至12任一项所述的方法，其特征在于，所述第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息之前，所述方法还包括：
    所述第二呼叫设备接收来自所述第一呼叫设备的呼叫请求消息，所述呼叫请求消息用于请求获取所述签名密钥；
    所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送主密钥和主盐密钥，所述主密钥和所述主盐密钥用于安全实时传输协议SRTP，所述主密钥和所述主盐密钥用于生成所述验证签名。
  14. 根据权利要求13所述的方法，其特征在于，所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送主密钥和主盐密钥包括：
    所述第二呼叫设备通过公钥对所述主密钥和所述主盐密钥签名以获取签名信息；
    所述第二呼叫设备向所述第一呼叫设备发送所述签名信息。
  15. 根据权利要求8至14任一项所述的方法，其特征在于，所述第二呼叫设备接收来自第一呼叫设备的待显示数据以及第一验证签名信息之前，所述方法还包括：
    所述第二呼叫设备接收来自所述第一呼叫设备的呼叫请求消息；
    所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送所述签名密钥。
  16. 根据权利要求8至14任一项所述的方法，其特征在于，与所述第一用户对应的信息包括如下所示的至少一项：
    所述第一用户的名称，所述第一用户的工号，所述第一用户的头像，所述第一用户的职位信息，与所述第一用户相关的音视频文件，或所述第一用户所属的协会的信息；
    与所述第一用户所属的企业对应的信息包括如下所示的至少一项：
    所述企业名称，所述企业的商标，与所述企业相关的音视频文件，或所述企业所属的协会的信息。
  17. 一种呼叫设备，其特征在于，包括：
    第一获取模块，用于获取签名密钥；
    第二获取模块，用于获取第一用户的待显示数据，所述第一用户为与所述呼叫设备对应的用户，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；
    签名模块，用于通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息；
    发送模块，用于通过所述呼叫设备和另一呼叫设备之间的媒体通道，向所述另一呼叫设备发送所述待显示数据以及所述第一验证签名信息，所述第一验证签名信息用于验证所述待显示数据的安全性。
  18. 一种呼叫设备，其特征在于，包括：
    接收模块，用于接收来自另一呼叫设备的待显示数据以及第一验证签名信息，所述第一验证签名信息为通过签名密钥对所述待显示数据进行签名以获取，所述待显示数据和所述第一验证签名信息通过所述另一呼叫设备和呼叫设备之间的媒体通道传输，所述待显示数据包括与第一用户对应的信息和/或与所述第一用户所属的企业对应的信息，所述第一用户为与所述另一呼叫设备对应的用户；
    签名模块，用于通过所述签名密钥对所述待显示数据进行签名以获取第二验证签名信息；
    验证模块，用于若确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证，使所述待显示数据显示。
  19. 一种呼叫设备，其特征在于，包括相互耦合的处理器和存储器，所述存储器中存储了计算机程序代码，所述处理器调用并执行所述存储器中的计算机程序代码，使得所述呼叫设备执行如权利要求1-7任一项所述的方法。
  20. 一种呼叫设备，其特征在于，包括相互耦合的处理器和存储器，所述存储器中存储了计算机程序代码，所述处理器调用并执行所述存储器中的计算机程序代码，使得所述呼叫设备执行如权利要求8-16任一项所述的方法。
  21. 一种通信系统，其特征在于，包括如权利要求19所述的呼叫设备以及如权利要求20所述的呼叫设备。
  22. 一种计算机可读的存储介质，其特征在于，所述存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如权利要求1至16任一项所述的方法。
  23. 一种呼叫处理的方法，其特征在于，所述方法包括：
    第一呼叫设备获取签名密钥；
    所述第一呼叫设备获取第一用户的待显示数据，所述待显示数据包括与所述第一用户对应的信息和/或与所述第一用户所属的企业对应的信息；
    所述第一呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息；
    所述第一呼叫设备通过所述第一呼叫设备和第二呼叫设备之间的媒体通道，向所述第二呼叫设备发送所述待显示数据以及所述第一验证签名信息；
    所述第二呼叫设备接收来自所述第一呼叫设备的所述待显示数据以及所述第一验证签名信息；
    所述第二呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第二验证签名信息；
    若所述第二呼叫设备确定所述第一验证签名信息和所述第二验证签名信息相同，确定所述待显示数据通过安全性验证，使所述待显示数据显示。
  24. 根据权利要求23所述的方法，其特征在于，所述第一呼叫设备通过所述签名密钥对所述待显示数据进行签名以获取第一验证签名信息之前，所述方法还包括：
    所述第一呼叫设备向所述第二呼叫设备发送第一指示消息，所述第一指示消息用于指示所述第一呼叫设备支持对所述待显示数据签名的能力；
    所述第二呼叫设备接收来自所述第一呼叫设备的所述待显示数据以及所述第一验证签名信息之前，所述方法还包括：
    所述第二呼叫设备向所述第一呼叫设备发送第二指示消息，所述第二指示消息用于指示所述第二呼叫设备支持验证所述待显示数据安全性的能力。
  25. 根据权利要求23或24所述的方法，其特征在于，所述第一呼叫设备获取第一用户的待显示数据包括：
    所述第一呼叫设备接收呼叫请求消息，所述呼叫请求消息携带所述待显示数据。
  26. 根据权利要求23或24所述的方法，其特征在于，所述第一呼叫设备获取第一用户的待显示数据包括：
    所述第一呼叫设备接收呼叫请求消息；
    所述第一呼叫设备获取与所述呼叫请求消息对应的所述待显示数据。
  27. 根据权利要求23至26任一项所述的方法，其特征在于，所述第一呼叫设备获取签名密钥之前，所述方法还包括：
    所述第一呼叫设备向所述第二呼叫设备发送呼叫请求消息，所述呼叫请求消息用于请求获取所述签名密钥；
    所述第二呼叫设备接收来自所述第一呼叫设备的所述待显示数据以及所述第一验证签 名信息之前，所述方法还包括：
    所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送主密钥和主盐密钥，所述主密钥和所述主盐密钥用于安全实时传输协议SRTP；
    所述第一呼叫设备获取签名密钥包括：
    所述第一呼叫设备接收来自所述第二呼叫设备的所述主密钥和所述主盐密钥；
    所述第一呼叫设备根据所述主密钥和所述主盐密钥，生成所述签名密钥。
  28. 根据权利要求27所述的方法，其特征在于，所述第二呼叫设备根据所述呼叫请求消息向所述第一呼叫设备发送主密钥和主盐密钥包括：
    所述第二呼叫设备通过公钥对所述主密钥和所述主盐密钥签名以获取签名信息；
    所述第二呼叫设备向所述第一呼叫设备发送所述签名信息。
  29. 根据权利要求23至28任一项所述的方法，其特征在于，与所述第一用户对应的信息包括如下所示的至少一项：
    所述第一用户的名称，所述第一用户的工号，所述第一用户的头像，所述第一用户的职位信息，与所述第一用户相关的音视频文件，或所述第一用户所属的协会的信息；
    与所述第一用户所属的企业对应的信息包括如下所示的至少一项：
    所述企业名称，所述企业的商标，与所述企业相关的音视频文件，或所述企业所属的协会的信息。
PCT/CN2022/122530 2021-09-30 2022-09-29 一种呼叫处理的方法、相关设备以及存储介质 WO2023051679A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111166679.8A CN115915112A (zh) 2021-09-30 2021-09-30 一种呼叫处理的方法、相关设备以及存储介质
CN202111166679.8 2021-09-30

Publications (1)

Publication Number Publication Date
WO2023051679A1 true WO2023051679A1 (zh) 2023-04-06

Family

ID=85750405

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/122530 WO2023051679A1 (zh) 2021-09-30 2022-09-29 一种呼叫处理的方法、相关设备以及存储介质

Country Status (2)

Country Link
CN (1) CN115915112A (zh)
WO (1) WO2023051679A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117155601B (zh) * 2023-07-14 2024-07-26 中移互联网有限公司 呼叫方法、装置、电子设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108886520A (zh) * 2016-01-25 2018-11-23 黑莓有限公司 建立会话发起协议会话
US10154136B1 (en) * 2016-03-22 2018-12-11 Symantec Corporation Call block policy using validated identities and selected attribute sharing
US20200028690A1 (en) * 2018-07-17 2020-01-23 Verizon Patent And Licensing Inc. Validating and securing caller identification to prevent identity spoofing
US20200053136A1 (en) * 2018-08-13 2020-02-13 T-Mobile Usa, Inc. Originating caller verification via insertion of an attestation parameter
US20200336314A1 (en) * 2019-04-17 2020-10-22 Verizon Patent And Licensing Inc. Validating and securing caller identification to prevent identity spoofing
US20220086276A1 (en) * 2020-09-16 2022-03-17 Douglas Ranalli Verified Calling Party Information Display Confirmation System

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108886520A (zh) * 2016-01-25 2018-11-23 黑莓有限公司 建立会话发起协议会话
US10154136B1 (en) * 2016-03-22 2018-12-11 Symantec Corporation Call block policy using validated identities and selected attribute sharing
US20200028690A1 (en) * 2018-07-17 2020-01-23 Verizon Patent And Licensing Inc. Validating and securing caller identification to prevent identity spoofing
US20200053136A1 (en) * 2018-08-13 2020-02-13 T-Mobile Usa, Inc. Originating caller verification via insertion of an attestation parameter
US20200336314A1 (en) * 2019-04-17 2020-10-22 Verizon Patent And Licensing Inc. Validating and securing caller identification to prevent identity spoofing
US20220086276A1 (en) * 2020-09-16 2022-03-17 Douglas Ranalli Verified Calling Party Information Display Confirmation System

Also Published As

Publication number Publication date
CN115915112A (zh) 2023-04-04

Similar Documents

Publication Publication Date Title
US11496319B2 (en) Method of identity authentication for voice over internet protocol call and related device
KR101461455B1 (ko) 인증 방법, 시스템 및 장치
US10516660B2 (en) Methods, systems, devices and products for authentication
US9648006B2 (en) System and method for communicating with a client application
US7421732B2 (en) System, apparatus, and method for providing generic internet protocol authentication
CN101635823A (zh) 一种终端对视频会议数据进行加密的方法及系统
CN106658486A (zh) 一种加密通话的呼叫方法、装置及终端
US10893414B1 (en) Selective attestation of wireless communications
US8923279B2 (en) Prevention of voice over IP spam
US10595203B2 (en) Enhanced establishment of IMS session with secure media
WO2017197968A1 (zh) 一种数据传输方法及装置
WO2023051679A1 (zh) 一种呼叫处理的方法、相关设备以及存储介质
WO2007112642A1 (fr) Procédé et dispositif de mise en place d&#39;un service d&#39;identificateur multimédia d&#39;utilisateur
CN100544247C (zh) 安全能力协商方法
CN102065069B (zh) 一种身份认证方法、装置和系统
US20230353569A1 (en) Call processing method, related device, and communications system
Bremler-Barr et al. Unregister attacks in SIP
US8085937B1 (en) System and method for securing calls between endpoints
US11888848B1 (en) Two-factor authentication with public key infrastructure
EP4319047A1 (en) Trusted sender signature messaging system
KR20180050910A (ko) 통신 시스템에서 발신자를 인증하기 위한 장치 및 방법
CN115767527A (zh) 一种均衡安全和效率的改进型5g消息rcs接入鉴权ims-aka机制
CN114726958B (zh) 身份验证方法、装置、电子设备及可读存储介质
US20240097903A1 (en) Ipcon mcdata session establishment method
WO2025094204A1 (en) System and method for authenticating a user equipment

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22875061

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22875061

Country of ref document: EP

Kind code of ref document: A1