[0063] The specific embodiments of the present invention will be described in further detail below in conjunction with the drawings and embodiments. The following examples are used to illustrate the present invention, but not to limit the scope of the present invention.
[0064] figure 1 It is a flowchart of a data encryption method of an audio-visual monitoring device according to an embodiment of the present invention; refer to figure 1 , The method includes:
[0065] S101: A random number is generated by the random number generator as a symmetric password;
[0066] It should be noted that the execution subject of the method of this embodiment is an audio-visual monitoring device, which is a device that can collect audio-visual, which can be a camera with an audio-visual collection function, or an image. The sensor, of course, can also be other equipment, which is not limited in this embodiment.
[0067] It is understandable that since the random number generated is used as the symmetric password in this embodiment, one encryption can be achieved once, thereby improving the security of the audiovisual data.
[0068] S102: Perform symmetric encryption on the collected video and audio data by using the symmetric password to obtain a secret video and audio file;
[0069] It should be noted that by symmetrically encrypting the collected video and audio data through the symmetric password, the encrypted video and audio file can be obtained, that is, the encrypted video and audio file is performed on the collected video and audio data. Symmetrically encrypted files.
[0070] S103: Acquire the corresponding first identification public key from the identification public key matrix according to the identification of the video and audio display device;
[0071] It is understandable that the video and audio monitoring device is provided with a product or user digital certificate, and the digital certificate includes: an identification public key matrix and a second identification private key of the local device.
[0072] In order to facilitate the generation of the digital certificate, in this embodiment, refer to figure 2 , Can produce the identification private key matrix and identification public key matrix through the specially developed key production system in advance, and use the product or user identification (that is, the identification used to reflect the identity of the product or the identification used to reflect the user's identity) as the audiovisual Monitor the device identification, and HASH to the identification private key matrix to generate the first identification private key of the local device through modulo-N integer operation, and then generate the product or user digital certificate together with the identification public key matrix.
[0073] In this embodiment, the local device refers to the video and audio monitoring device.
[0074] Of course, the product or user digital certificate can be directly written into the product in the form of encrypted software data, or written into the identification USBKEY and issued to the user for use.
[0075] The logo USBKEY includes but is not limited to TF card KEY and SIM card KEY, which are all developed and produced by a special security chip (for example: HS08K, HS32U2, Z8D64, Z8168 or Z32) that meets the national secret certification and license. In the process of product and user application, digital signature and encryption of product or user identification and data, instructions and other information are completed.
[0076] The digital certificate or identification key conforms to the ITU-T X.509 international standard, conforms to the certificate specification of the combined public key cryptosystem, and conforms to the CA certificate specification.
[0077] S104: Use the first identification public key to perform asymmetric encryption on the symmetric password to obtain a key file;
[0078] It is understandable that the first identification public key is an identification public key corresponding to the identification of the audiovisual display device, that is, there is a one-to-one correspondence between the first identification public key and the identification of the audiovisual display device.
[0079] It should be noted that, by using the first identification public key to perform asymmetric encryption on the symmetric password, a key file can be obtained, that is, the key file is obtained after performing asymmetric encryption on the symmetric password. document.
[0080] S105: Sign the key file with the first identification private key of the local device;
[0081] Since the first identification private key of the local device is generated based on the product or user identification, it has a one-to-one correspondence with the product or user identification, that is, the first identification private key of the local device can reflect all State the identity of the product or user ID.
[0082] It is understandable that signing the key file usually uses the first identification private key of the local device to encrypt the digital digest of the key file.
[0083] S106: Combine the encrypted video and audio file and the signed key file into a encrypted data file, and send the encrypted data file to the video and audio display device.
[0084] In a specific implementation, the encrypted video and audio file and the signed key file can be merged into a encrypted data file through a private protocol algorithm.
[0085] In this embodiment, a random number generator is used to generate a random number as a symmetric password, and the collected video and audio data is symmetrically encrypted by the symmetric password to obtain a secret video and audio file. Obtain the corresponding first identification public key, use the first identification public key to perform asymmetric encryption on the symmetric password to obtain a key file, and sign the key file with the first identification private key of the local device, The encrypted video and audio file and the signed key file are merged into a encrypted data file, and the encrypted data file is sent to the video and audio display device, thereby ensuring that the video and audio data transferred after collection are all encrypted Documents are prevented from being intercepted, misappropriated, tampered, etc., and problems such as leakage and system damage are avoided.
[0086] image 3 It is a flowchart of a data encryption method of an audiovisual monitoring device in another embodiment of the present invention; refer to image 3 , The method includes:
[0087] S300: Collect video and audio data according to preset video and audio collection and coding parameters;
[0088] It should be noted that the execution subject of the method of this embodiment is also an audiovisual monitoring device.
[0089] It is understandable that the preset video and audio collection and coding parameters can be understood as the parameters used in the previous collection, or can be the parameters stored in the video and audio monitoring device, which is not limited in this embodiment.
[0090] S301: A random number is generated by the random number generator as a symmetric password;
[0091] S302: Perform symmetric encryption on the collected video and audio data by using the symmetric password to obtain a secret video and audio file;
[0092] S303: Acquire the corresponding first identification public key from the identification public key matrix according to the identification of the video and audio display device;
[0093] S304: Use the first identification public key to perform asymmetric encryption on the symmetric password to obtain a key file;
[0094] S305: Sign the key file with the first identification private key of the local device.
[0095] Steps S301~S305 and figure 1 Steps S101 to S105 in the illustrated embodiment are the same, and will not be repeated here.
[0096] Figure 4 It is a flowchart of a data encryption method of an audiovisual monitoring device according to another embodiment of the present invention; refer to Figure 4 , The method includes:
[0097] S400: Adjust the video and audio collection and coding parameters according to the adjustment instruction sent by the video and audio display device, and collect the video and audio data according to the adjusted video and audio collection and coding parameters;
[0098] It should be noted that the execution subject of the method of this embodiment is also an audiovisual monitoring device.
[0099] It is understandable that, in order to facilitate the adjustment of the parameters by the audiovisual display device, in this embodiment, the parameters provided by the audiovisual display device may also be used to collect audiovisual data.
[0100] S401: A random number is generated by the random number generator as a symmetric password;
[0101] S402: Perform symmetric encryption on the collected video and audio data by using the symmetric password to obtain a secret video and audio file;
[0102] S403: Acquire the corresponding first identification public key from the identification public key matrix according to the identification of the video and audio display device;
[0103] S404: Use the first identification public key to perform asymmetric encryption on the symmetric password to obtain a key file;
[0104] S405: Sign the key file with the first identification private key of the local device.
[0105] Steps S401 to S405 and figure 1 Steps S101 to S105 in the illustrated embodiment are the same, and will not be repeated here.
[0106] Figure 5 It is a flowchart of a data encryption method of an audiovisual monitoring device in another embodiment of the present invention; refer to Figure 5 , The method includes:
[0107] S500: Receive and store the video and audio display device identifier sent by the video and audio display device;
[0108] It should be noted that the execution subject of the method of this embodiment is also an audiovisual monitoring device.
[0109] It is understandable that after the audiovisual monitoring device is safely opened, it needs to be registered in the audiovisual display device, that is, the audiovisual monitoring device sends the audiovisual monitoring device identification to the audiovisual display device, and The video and audio display device receives and stores the video and audio monitoring device identifier sent by the video and audio monitoring device.
[0110] Of course, usually, the video and audio display device also sends the video and audio display device identification to the video and audio monitoring device, and the video and audio monitoring device receives and stores the video and audio display device identification.
[0111] S501: A random number is generated by the random number generator as a symmetric password;
[0112] S502: Perform symmetric encryption on the collected video and audio data by using the symmetric password to obtain a secret video and audio file;
[0113] S503: Obtain the corresponding first identification public key from the identification public key matrix according to the identification of the video and audio display device;
[0114] S504: Use the first identification public key to perform asymmetric encryption on the symmetric password to obtain a key file;
[0115] S505: Sign the key file with the first identification private key of the local device.
[0116] Steps S501~S505 and figure 1 Steps S101 to S105 in the illustrated embodiment are the same, and will not be repeated here.
[0117] Image 6 It is a flowchart of a data decryption method of an audiovisual monitoring device according to an embodiment of the present invention; refer to Image 6 , The method includes:
[0118] S601: Receive the encrypted data file sent by the video and audio monitoring equipment;
[0119] It should be noted that the execution subject of the method of this embodiment is an audio-visual display device, which is a device capable of displaying audio-visual, and it can be a server with an audio-visual display function or The user equipment of the video and audio display function, of course, can also be other equipment, which is not limited in this embodiment.
[0120] In a specific implementation, the user equipment may be a PC, a notebook computer, a tablet computer, or a smart phone, which is not limited in this embodiment.
[0121] S602: Unpack the encrypted data file to obtain a encrypted video and audio file and a key file;
[0122] In a specific implementation, the encrypted data file can be unpacked through a private protocol algorithm.
[0123] S603: Acquire the corresponding second identification public key from the identification public key matrix according to the identification of the video and audio monitoring device;
[0124] It is understandable that the video and audio display device is also provided with a product or user digital certificate, and the digital certificate includes: an identification public key matrix and a second identification private key of the local device.
[0125] In order to facilitate the generation of the digital certificate, in this embodiment, an identification private key matrix and an identification public key matrix can be produced in advance through a dedicated key production system, and the product or user identification (that is, the identification used to reflect the identity of the product, Or the identification used to reflect the user identity) as the video and audio display device identification, and HASH to the identification private key matrix to generate the second identification private key of the local device through modulo-N integer operation, and then generate the product or user number together with the identification public key matrix certificate.
[0126] In this embodiment, the local device refers to an audiovisual display device.
[0127] Of course, the product or user digital certificate can be directly written into the product in the form of encrypted software data, or written into the identification USBKEY and issued to the user for use.
[0128] The logo USBKEY includes but is not limited to TF card KEY and SIM card KEY, which are all developed and produced by a special security chip (for example: HS08K, HS32U2, Z8D64, Z8168 or Z32) that meets the national secret certification and license. In the process of product and user application, digital signature and encryption of product or user identification and data, instructions and other information are completed.
[0129] The digital certificate or identification key conforms to the ITU-T X.509 international standard, conforms to the certificate specification of the combined public key cryptosystem, and conforms to the CA certificate specification.
[0130] S604: Verify the signature of the key file through the second identification public key;
[0131] It is understandable that since the key file is signed by the video and audio monitoring device using the first identification private key, the first identification private key is generated according to the video and audio monitoring device identification, and the second identification public key is The video and audio monitoring device identification is obtained from the identification public key matrix. Therefore, the first identification private key and the second identification public key have a corresponding relationship, and the two can be mutually encrypted and decrypted.
[0132] Therefore, when the key file is signed by the video and audio monitoring device using the first identification private key to encrypt the digital digest of the key file, the second identification public key can be used to decrypt the digital digest , And match the decrypted digital digest with the key file. If the match is successful, it is deemed that the verification has passed.
[0133] S605: When the verification is passed, use the second identification private key of the local device to decrypt the key file to obtain a symmetric password;
[0134] It is understandable that since the key file is encrypted by the video and audio monitoring device using the first identification public key, the first identification public key is obtained from the identification public key matrix according to the video and audio display device identification, and the The second identification private key is generated according to the identification of the audiovisual display device. Therefore, the first identification public key and the second identification private key have a corresponding relationship, and the two can be mutually encrypted and decrypted.
[0135] It should be noted that the symmetric password can be obtained by using the second identification private key of the local device to decrypt the key file, that is, the symmetric password is the data after decrypting the key file.
[0136] S606: Decrypt the encrypted video and audio file by using the obtained symmetric password to obtain video and audio data.
[0137] It is understandable that by decrypting the encrypted video and audio file through the obtained symmetric password, the video and audio data can be obtained, that is, the video and audio data is obtained after decrypting the encrypted video and audio file data.
[0138] Figure 7 It is a flowchart of a data decryption method of an audiovisual monitoring device in another embodiment of the present invention; refer to Figure 7 , The method includes:
[0139] S700: Receive and store the video and audio monitoring device identifier sent by the video and audio monitoring device;
[0140] It should be noted that the execution subject of the method in this embodiment is also an audiovisual display device.
[0141] S701: Receive the encrypted data file sent by the video and audio monitoring equipment;
[0142] S702: Unpack the encrypted data file to obtain a encrypted video and audio file and a key file;
[0143] S703: Acquire the corresponding second identification public key from the identification public key matrix according to the identification of the video and audio monitoring device;
[0144] S704: Verify the signature of the key file through the second identification public key;
[0145] S705: When the verification is passed, use the second identification private key of the local device to decrypt the key file to obtain a symmetric password;
[0146] S706: Decrypt the encrypted video and audio file by using the obtained symmetric password to obtain video and audio data.
[0147] Steps S701 to S706 and Image 6 Steps S601 to S606 in the illustrated embodiment are the same, and will not be repeated here.
[0148] Reference Picture 8 Before data encryption and decryption, security authentication is usually required, that is, the video and audio display device X obtains the corresponding A logo public key from the logo public key matrix according to the video and audio monitoring device A logo (that is, corresponding to the above-mentioned "second logo Public key"), the plain text of the instruction to be transmitted is identified by the public key A (the plain text of the instruction may be a trigger instruction for the video and audio monitoring device to start monitoring, or it may be adjusting the video and audio of the video and audio monitoring device The adjustment instruction of the acquisition or encoding parameters, of course, can also be other instructions) perform asymmetric encryption to obtain the instruction ciphertext, and use the X identification private key (that is, corresponding to the above-mentioned "second identification private key") to the instruction ciphertext Sign, and send the signed cipher text of the command to the video and audio monitoring device A;
[0149] Reference Picture 9 The video and audio monitoring device A receives the instruction ciphertext, obtains the corresponding X identification public key (that is, corresponding to the above-mentioned "first identification public key") from the identification public key matrix according to the X identification of the video and audio display device, and passes the X identifies the public key to verify the signature of the instruction ciphertext, and when the verification is passed, uses the A identification private key (that is, corresponding to the above-mentioned "first identification private key") to decrypt the instruction ciphertext to obtain the instruction plaintext, and Follow the instructions in plain text to execute instructions.
[0150] After the security certification of the audio-visual monitoring equipment A, it can configure its audio-visual acquisition and encoding parameters according to the pre-set audio-visual acquisition and encoding parameters or the received adjustment instructions to realize audio-visual acquisition. After the video and audio information data is encoded with video and audio, it is symmetrically encrypted to output A encrypted video and audio files;
[0151] It is understandable that since the video and audio display device X logo is stored in the video and audio monitoring device A, the X logo public key is calculated from the logo public key matrix according to the video and audio display device X logo, and the X logo public key is used to encrypt the symmetric password , Obtain the A key file, and then sign the A key file with the A identification private key;
[0152] The signed A key file and the A secret video and audio file are packaged together through a private protocol algorithm to form a secret data file, and output to the video and audio display device through a wired network, wireless network, cloud or Internet platform.
[0153] Correspondingly, the video and audio display device X saves the encrypted data files of each video and audio monitoring device in the video and audio data storage array, and at the same time performs the following processing on the encrypted data files of each video and audio monitoring device:
[0154] Suppose it is aimed at the encrypted data file of video and audio monitoring device A, refer to Picture 8 , First, unpack the encrypted data file according to the reversible process of the private protocol algorithm of the encrypted data package, and obtain the A encrypted video and audio file and the A key file respectively. According to the A logo of the video and audio monitoring device, the ID public key matrix is calculated The A identification public key is output, and the signature of the A key file is verified by the A identification public key. When the verification is passed, the A key file is decrypted by the X identification private key to obtain a symmetric password, and then the symmetric password is used to A dense video and audio file is symmetrically decrypted to obtain video and audio data, and the video and audio data can also be output to the monitor for decoding and playback.
[0155] Compared with the prior art, the foregoing embodiments have at least one of the following advantages:
[0156] 1. Use Pin code verification and identification key two-factor authentication to improve the security level;
[0157] 2. Use random numbers to generate a symmetric password for video data encryption, which can achieve one encryption at a time;
[0158] 3. Use asymmetric algorithms to encrypt symmetric passwords, which improves the security of symmetric passwords.
[0159] 4. The encrypted file is digitally signed again with the private key of the encryptor to ensure the security of the data during transmission and prevent tampering.
[0160] 5. Combine the key file and ciphertext data to facilitate file transfer.
[0161] 6. After receiving the encrypted data, decompose it to obtain the encrypted video and key file. Perform identity verification on the key file and decrypt the symmetric password, and then directly decrypt the encrypted video, which greatly facilitates the application and improves security.
[0162] 7. The plain text of the instruction is encrypted and signed, and is used through signature verification and decryption when used to ensure the security and reliability of the transmission of the plain text of the instruction, as well as non-repudiation.
[0163] 8. At each device side, the corresponding identification public key is extracted based on the identification through its own digital certificate, which realizes offline local key exchange, which greatly facilitates the application of the system and high-strength security assurance.
[0164] 9. The information data of the entire video and audio monitoring system is constructed, and the instructions are a fully encrypted transmission and interaction system under any platform and mode.
[0165] For the method implementation, for the sake of simple description, it is expressed as a series of action combinations, but those skilled in the art should know that the implementation of the present invention is not limited by the described sequence of actions, because according to the implementation of the present invention Some steps can be performed in other order or simultaneously. Secondly, those skilled in the art should also know that the implementations described in the specification are all preferred implementations, and the actions involved are not necessarily required by the implementations of the present invention.
[0166] Picture 10 It is a structural block diagram of a video and audio monitoring equipment of the present invention; reference Picture 10 , The video and audio monitoring equipment includes:
[0167] The password generating unit 1001 is used to generate a random number as a symmetric password by a random number generator;
[0168] The symmetric encryption unit 1002 is configured to perform symmetric encryption on the collected video and audio data through the symmetric password to obtain a secret video and audio file;
[0169] The public key obtaining unit 1003 is configured to obtain the corresponding first identification public key from the identification public key matrix according to the video and audio display device identification;
[0170] The asymmetric encryption unit 1004 is configured to use the first identification public key to perform asymmetric encryption on the symmetric password to obtain a key file;
[0171] The file signing unit 1005 is configured to sign the key file with the first identification private key of the local device;
[0172] The fusion sending unit 1006 is configured to merge the encrypted video and audio file and the signed key file into a encrypted data file, and send the encrypted data file to the audiovisual display device.
[0173] In an optional implementation manner of the present invention, the video and audio monitoring device further includes:
[0174] The data collection unit is used to collect video and audio data according to preset video and audio collection and coding parameters;
[0175] or,
[0176] It is used to adjust the video and audio collection and coding parameters according to the adjustment instructions sent by the video and audio display device, and collect video and audio data according to the adjusted video and audio collection and coding parameters.
[0177] In an optional implementation manner of the present invention, the video and audio monitoring device further includes:
[0178] The identification receiving unit is configured to receive and store the video and audio display device identification sent by the video and audio display device.
[0179] Picture 11 It is a structural block diagram of a video and audio display device of the present invention; reference Picture 11 , The video and audio display equipment includes:
[0180] The file receiving unit 1101 is used to receive the encrypted data file sent by the video and audio monitoring equipment;
[0181] The data unpacking unit 1102 is configured to unpack the encrypted data file to obtain the encrypted video and audio file and the key file;
[0182] The public key obtaining unit 1103 is configured to obtain the corresponding second identification public key from the identification public key matrix according to the video and audio monitoring device identification;
[0183] The signature verification unit 1104 is configured to verify the signature of the key file through the second identification public key;
[0184] The password obtaining unit 1105 is configured to use the second identification private key of the local device to decrypt the key file to obtain a symmetric password when the verification is passed;
[0185] The file decryption unit 1106 is configured to decrypt the encrypted video and audio file by using the obtained symmetric password to obtain video and audio data.
[0186] In an optional implementation manner of the present invention, the video and audio display device further includes:
[0187] The identifier receiving unit is configured to receive and store the video and audio monitoring device identifier sent by the video and audio monitoring device.
[0188] As for the device implementation, since it is basically similar to the method implementation, the description is relatively simple, and for related parts, please refer to the description of the method implementation.
[0189] It should be noted that in the various components of the device of the present invention, the components are logically divided according to the functions to be realized. However, the present invention is not limited to this, and each component can be re-divided as needed. Or combination.
[0190] The various component implementations of the present invention may be implemented by hardware, or by software modules running on one or more processors, or by their combination. In this device, the PC realizes remote control of the device or device through the Internet, and precisely controls each operation step of the device or device. The present invention can also be implemented as a device or device program (for example, a computer program and a computer program product) for executing part or all of the methods described herein. In this way, the program for implementing the present invention can be stored on a computer readable medium, and the files or documents generated by the program can be statistically generated, generating data reports and cpk reports, etc., and can perform batch testing and statistics on power amplifiers. It should be noted that the above-mentioned embodiments illustrate rather than limit the present invention, and those skilled in the art can design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of multiple such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several devices, several of these devices may be embodied in the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.
[0191] The above embodiments are only used to illustrate the present invention, not to limit the present invention. Those of ordinary skill in the relevant technical fields can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, all The equivalent technical solutions also belong to the scope of the present invention, and the patent protection scope of the present invention should be defined by the claims.
