Security verification method and system based on Kinesis Video Streams
By adopting a secure verification system with dynamic encryption and real-time permission verification in Kinesis Video Streams, the problem of insufficient security at rest and end-to-end in video streaming is solved, and efficient and secure transmission of video content and user permission management is achieved. , improving security and user experience.
Patent Information
- Application Number
- CN202411349153.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-26
- Publication Date
- 2024-12-13
AI Technical Summary
In the video streaming and access control, the existing technology has problems such as lack of dynamicity in the static encryption mechanism, insufficient end-to-end security, easy to be cracked by relying on a single authentication method, cloud processing errors lead to security vulnerabilities and lagging user-related information updates.
Using a security verification system based on Kinesis Video Streams, the device generates event records and requests unique alarm_id and kvs upload URLs, divides the video stream into 3-second clips, dynamically encrypts the user ID list, and is between cloud servers and applications. Realize real-time permission verification to ensure the security of each link.
It realizes end-to-end security verification of video content, prevents unauthorized users from accessing, supports flexible user management and fast permission updates, improves security and user experience, and reduces data transmission and storage requirements.
Smart Images
Figure CN119135961A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of security verification technology, and in particular to a security verification method and system based on Kinesis Video Streams. Background Art
[0002] With the development of Internet of Things (IoOT) technology, more and more devices are able to upload video streams to the cloud through network connections; these video streams may contain sensitive information or personal privacy content, so it is particularly important to ensure that only authorized users can access these videos. Amazon Kinesis Video Streams (KVS) is a service provided by Amazon that allows users to easily ingest and process real-time video data from various sources. However, in traditional video streaming and access control, static security measures are usually adopted, such as fixed keys or one-time generated playback links, which guarantee security to a certain extent.
[0003] When a user attempts to access a video stored in KVS, the common practice is to request the cloud server to generate a temporary URL, and then use the URL to download and play the video. Although this approach provides a certain degree of protection, there are still some potential security risks. For example, if an abnormality occurs in the internal processing of the cloud, the playback link generated for one user may be incorrectly assigned to another user, allowing unauthorized users to access and view the video content.
[0004] In addition, existing security mechanisms often lack end-to-end security verification capabilities, that is, in the entire process of video streaming from device upload to end-user viewing, no strict permission verification is performed at each link. This may result in unauthorized users being able to obtain video data due to security vulnerabilities in the middle link, even if the video clip has been correctly encrypted.
[0005] Deficiencies of existing technology: 1. Lack of dynamic encryption mechanism: Existing systems usually use static encryption methods. Once the key is leaked, all related video content will be at risk. In addition, different encryption keys are not used for video streams of different events to increase security.
[0006] 2. Insufficient end-to-end security: Existing technologies do not implement complete end-to-end security verification during the entire life cycle of video streams, including uploading, storage, and playback. Especially during the playback phase, user permission verification is often not strict enough and is vulnerable to attacks.
[0007] 3. Reliance on a single authentication method: Many systems rely on a one-time playback link or a fixed authentication token to control access, which can be easily cracked or abused. Especially when multiple users share the device, it is difficult to effectively distinguish and manage the access rights of different users.
[0008] 4. Risk of cloud processing errors: When errors or failures occur within the cloud, incorrect playback links may be generated, causing video content to be mistakenly exposed to unauthorized users. In this case, existing security measures cannot prevent this from happening.
[0009] 5. Delayed update of user-associated information: When a device is associated with multiple users, if the user-associated information is not updated or synchronized to the device in a timely manner, newly added or removed users may not be able to obtain or lose the corresponding access rights immediately.
[0010] Therefore, the prior art has deficiencies and needs further improvement. Summary of the invention
[0011] In view of the problems existing in the prior art, the present invention provides a security verification method and system based on Kinesis Video Streams.
[0012] To achieve the above object, the specific scheme of the present invention is as follows: The present invention provides a security verification system based on Kinesis Video Streams, the system comprising: A device for detecting events, generating event records and requesting a unique alarm_id and kvs upload URL from a cloud server. The device can package the video stream into several fragments (each fragment is 3 seconds long) and dynamically encrypt the user ID list using the alarm_id and append it to each fragment, and then upload the fragments to the cloud kvs storage; The cloud server is used to receive requests from devices and generate a unique alarm_id and the corresponding kvs upload URL. It also supports applications' requests for playback links of video clips within a specified time period and can generate playback links based on the requests. It can also process binding requests between applications and devices, send binding tokens to devices, and send the ID information of the bound user to the device for persistent storage after successful binding. The application is used to request the event list of the device and the playback link of a specific event from the cloud server, download the video clips of the corresponding time period, and decrypt the user ID list through the alarm_id to verify the access rights of the current user. When the verification passes, the video can be rendered and played.
[0013] Furthermore, the device also includes an algorithm module, which is configured to automatically detect the occurrence of an event and trigger the recording and uploading process of the video stream when the event occurs.
[0014] Furthermore, the cloud server further includes a security mechanism for ensuring that even in the event of internal processing anomalies, unauthorized users are prevented from directly downloading and playing video content that does not belong to them through a signed URL.
[0015] Furthermore, the user ID list is dynamically generated through the cloud, and is encrypted using a different alarm_id for each event to increase security.
[0016] Furthermore, the application can perform real-time user ID verification after obtaining the playback link, and re-verify each time a new video clip is downloaded, thereby achieving end-to-end security control.
[0017] The present invention also provides a security verification method based on Kinesis Video Streams. Based on the above security verification system, the method includes the following steps: S1, the device detects the occurrence of an event and requests the cloud server to generate an event record; S2, the cloud server responds to the request and returns a unique alarm_id and kvs upload URL; S3, the device divides the event-related video stream into multiple fragments, and dynamically encrypts the user ID list through the alarm_id and attaches it to each fragment, and then uploads these fragments to the kvs storage in the cloud; S4, when the event ends, the device stops uploading; S5, the application requests the event list of the device from the cloud server; S6, the cloud server returns an event list containing alarm_id; S7, the application selects one or more events and requests corresponding playback links; S8, the cloud server generates a playback link and feeds it back to the application; S9, the application downloads the video clip through the playback link, decrypts the user ID list using the alarm_id during the download process, and verifies whether the current user's ID exists in the decrypted user ID list; S10: If the verification is passed, the application allows the downloaded video clip to be rendered and played.
[0018] Furthermore, step S1 also includes the application establishing a temporary communication session with the device through a network connection, so that the device receives and parses the binding token sent by the cloud server, completing the binding process between the device and the user.
[0019] Furthermore, step S3 also includes the cloud server verifying the validity of the user ID list in each segment when receiving each segment uploaded by the device to ensure data integrity and correctness.
[0020] Furthermore, in step S6, the cloud server is also provided with an event log database, which records all generated alarm_ids and their associated information, including device ids and timestamps, for the convenience of subsequent query and management.
[0021] Furthermore, in step S10, before playing the video, the application not only verifies the user ID, but also checks the user's access permission level to ensure that only users with the corresponding permission level can access the specific type of video content.
[0022] The technical solution of the present invention has the following beneficial effects: 1. Enhanced security: By generating a unique alarm_id for each event and using the alarm_id to dynamically encrypt the user ID list, even if the playback link is leaked, unauthorized users cannot decrypt and obtain the user ID list, and thus cannot watch the video content.
[0023] 2. End-to-end security verification: The present invention ensures security verification during the entire process from uploading video clips on the device side to playing videos on the application side. The user ID is verified again each time a new video clip is downloaded, thus achieving true end-to-end security control.
[0024] 3. Flexible user management: Supports multi-user binding and sharing functions, allowing users to easily share device access rights. The cloud server can update user association information on the device in real time to ensure that only users who currently have access rights can watch related video content.
[0025] 4. Prevent security vulnerabilities caused by internal errors: Even if abnormalities or errors occur in the internal processing of the cloud, the use of dynamic encryption and user ID list verification mechanism can effectively prevent unauthorized users from directly downloading and playing video content that does not belong to them through signed URLs.
[0026] 5. Improve user experience: By optimizing the management and transmission of video clips, users can quickly obtain video playback links within a specified time period after requesting them, and play them immediately after confirming their permissions, providing a smooth user experience.
[0027] 6. Data privacy protection: By dynamically encrypting the user ID list, even if the video clip is intercepted during transmission, the attacker cannot easily obtain the user's personal information, thereby better protecting the user's privacy.
[0028] 7. Efficient resource utilization: The duration of each video clip is fixed at 3 seconds, which allows for more efficient management and retrieval of data while reducing unnecessary data transmission, saving network bandwidth and storage space.
[0029] 8. Scalability and adaptability: The methods and techniques of the present invention are not only applicable to Kinesis Video Streams, but can also be applied to other similar video stream processing platforms, and have good scalability and adaptability. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 is a system block diagram of the present invention; Figure 2 It is the overall flow chart of the present invention; Figure 3 It is the process of APP application binding / sharing device and persistent storage of user ID information of the present invention; Figure 4 It is a process diagram of uploading kvs by the device of the present invention; Figure 5 It is a verification process diagram of the APP of the present invention obtaining the URL of the corresponding event video for playback. DETAILED DESCRIPTION
[0031] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments; it can be understood that the specific embodiments described herein are only used to explain the present invention rather than to limit the present invention; it should also be noted that, for ease of description, only the parts related to the present invention rather than all are shown in the accompanying drawings.
[0032] Combination Figure 1-Figure 5 As shown, the present invention provides a security verification system based on Kinesis Video Streams, characterized in that the system includes: A device for detecting events, generating event records and requesting a unique alarm_id and kvs upload URL from a cloud server. The device can package the video stream into several fragments (each fragment is 3 seconds long) and dynamically encrypt the user ID list using the alarm_id and append it to each fragment, and then upload the fragments to the cloud kvs storage; The cloud server is used to receive requests from devices and generate a unique alarm_id and the corresponding kvs upload URL. It also supports applications' requests for playback links of video clips within a specified time period and can generate playback links based on the requests. It can also process binding requests between applications and devices, send binding tokens to devices, and send the ID information of the bound user to the device for persistent storage after successful binding. The application is used to request the event list of the device and the playback link of a specific event from the cloud server, download the video clips of the corresponding time period, and decrypt the user ID list through the alarm_id to verify the access rights of the current user. When the verification passes, the video can be rendered and played.
[0033] The device also includes an algorithm module, which is configured to automatically detect the occurrence of an event and trigger the recording and uploading process of the video stream when the event occurs.
[0034] The cloud server further includes a security mechanism for ensuring that even in the case of internal processing anomalies, unauthorized users are prevented from directly downloading and playing video content that does not belong to them through signed URLs.
[0035] The user ID list is dynamically generated through the cloud and encrypted using a different alarm_id for each event to increase security.
[0036] The application can perform real-time user ID verification after obtaining the playback link, and re-verify each time a new video clip is downloaded, thereby achieving end-to-end security control.
[0037] The present invention also provides a security verification method based on Kinesis Video Streams. Based on the above security verification system, the method includes the following steps: S1, the device detects the occurrence of an event and requests the cloud server to generate an event record; S2, the cloud server responds to the request and returns a unique alarm_id and kvs upload URL; S3, the device divides the event-related video stream into multiple fragments, and dynamically encrypts the user ID list through the alarm_id and attaches it to each fragment, and then uploads these fragments to the kvs storage in the cloud; S4, when the event ends, the device stops uploading; S5, the application requests the event list of the device from the cloud server; S6, the cloud server returns an event list containing alarm_id; S7, the application selects one or more events and requests corresponding playback links; S8, the cloud server generates a playback link and feeds it back to the application; S9, the application downloads the video clip through the playback link, decrypts the user ID list using the alarm_id during the download process, and verifies whether the current user's ID exists in the decrypted user ID list; S10: If the verification is passed, the application allows the downloaded video clip to be rendered and played.
[0038] Step S1 also includes the application establishing a temporary communication session with the device through a network connection, so that the device receives and parses the binding token sent by the cloud server, completing the binding process between the device and the user.
[0039] Step S3 also includes the cloud server verifying the validity of the user ID list in each segment when receiving each segment uploaded by the device to ensure data integrity and correctness.
[0040] In step S6, the cloud server is also provided with an event log database, which records all generated alarm_ids and their associated information, including device ids and timestamps, for the convenience of subsequent query and management.
[0041] In step S10, before playing the video, the application not only verifies the user ID, but also checks the user's access permission level to ensure that only users with the corresponding permission level can access the specific type of video content. Specific embodiment: For the scenario where the user gets the playback link of the kvs video uploaded by the device without the relationship chain, the present invention adds the user-related ID list of the device through the user metadata in each fragment video data uploaded by the device, with the duration of each fragment being 3 seconds, wherein the ID list is dynamically encrypted by uploading the alarm_id of the corresponding event; then when the APP views the video of the corresponding time period, it first obtains the alarm_id of the event list (each event is a unique alarm_id, generated by the cloud, including the device id, timestamp and random number), and then obtains the corresponding playback link, and obtains the user ID list by dynamically decrypting the alarm_id when downloading each fragment, and verifies the current APP user ID. When the verification passes, rendering and playback are allowed.
[0043] When the current device is connected to Amazon Kinesis Video Streams to upload video streams, the APP requests the cloud to obtain the playback link for the specified time period. The cloud requests kvs to generate the corresponding URL and send it to the APP. Then the APP downloads the video of the corresponding time period for rendering and playback.
[0044] When the cloud internal processing is abnormal or an error occurs, the device kvs video playback link under user1 is given to user2. User2 gets the signed URL and can directly download, render and play the video. End-to-end security verification cannot be guaranteed. 1. Figure 3 It is the process of APP binding / sharing device and persistent storage of user ID information: APP1 applies for a binding token from the cloud, and the cloud returns the binding token to APP1; APP1 establishes a connection with Devices through AP hotspot and Bluetooth and sends a binding token to Devices. Devices parse the token through Wi-Fi and return it to APP1. It also reports whether the binding result is allowed to the cloud. APP1 calls the binding interface to bind the device based on the binding token, and feeds back the binding result to the cloud; The cloud sends the bound user 1 information to Devices; Devices persistently stores user 1 information; APP1 calls the sharing interface and sends feedback to the cloud, which then sends the sharing request to user 2. APP2 user 2 confirms sharing to cloud; The cloud sends a confirmation analysis result to APP1; The cloud sends the shared user 2 information to Devices; Devices persistently stores user 2 information.
[0045] 2. Device upload kvs process: First, the algorithm module on the Devices detects that an event has occurred, and then requests the cloud to generate an event record. The cloud will return an alarm_id and the kvs (Key-Value Store) upload URL; next, the Devices will fragment the video stream, dynamically encrypt the user ID list through the alarm_id, and then upload it to the kvs. When the algorithm module detects that the event has ended, it stops uploading.
[0046] This process is mainly used to save event-related data in the cloud for subsequent analysis and query. Among them, alarm_id is a unique identifier used to identify different events; kvs is a key-value storage system that can easily manage and retrieve data. In addition, in order to protect user privacy, a dynamic encryption method is also used to process the user ID list.
[0047] 3. Verification process of APP obtaining the URL of the corresponding event video to be played: The app requests the device's event list from the cloud.
[0048] The cloud returns an event list, including a list of alarm_ids.
[0049] The APP requests the playback URL of the corresponding event.
[0050] Cloud generates a URL link to kvs.
[0051] Kvs returns; Download the fragment through the URL, decrypt the user ID list through the alarm_id of the event, and then verify it.
[0052] After passing, render and play.
[0053] In this process, the APP first requests the device's event list from the cloud, and the device returns the event list containing alarm_id. Then the APP requests the corresponding playback URL based on the alarm_id, and the Cloud generates the URL and returns it to the APP. After the APP receives the URL, it downloads the fragment through the URL and uses the alarm_id to decrypt the user ID list for verification. If the verification passes, it will be rendered and played.
[0054] On the client side, the APP dynamically decrypts the user ID list carried in the fragment through the alarm_id of the event, and verifies the current user relationship chain and permissions to ensure end-to-end secure access. Beneficial effects: When the present invention binds / shares the device through the user, the cloud sends the corresponding user ID list, and the persistent storage is updated on the device. When the device detects that an event has occurred, it requests the cloud to generate an event record, and returns the alarm_id of the event and the upload URL of kvs; during the device uploading the kvs video, the user ID list (encrypted by alarm_id) is attached to each fragment data packaged and uploaded through usermetadata. When the APP plays the video of the specified event, it requests the cloud interface to obtain the alarm_id and playback URL of the event; when downloading the fragment, the user ID list is decrypted through the alarm_id, and the relationship chain and permissions between the current user ID and the user ID carried in the fragment are verified to ensure end-to-end playback verification, and prevent users from watching kvs videos uploaded by devices without relationship chains due to internal errors in the cloud.
[0055] Working principle: This paper proposes a security verification method and system based on Amazon Kinesis Video Streams (KVS), the main purpose of which is to ensure that only authorized users can access and watch the video content uploaded by the device. The following is the detailed working principle of the system: 1. Device binding and user management Binding process: The application (APP) requests a binding token from the cloud, and the cloud generates and returns a binding token to the application. The application establishes a connection with the device through AP hotspot, Bluetooth, etc., and sends the binding token to the device. The device parses the token through Wi-Fi networking and confirms the binding status to the cloud. Once the binding is successful, the cloud will send the user's ID information to the device, and the device will store this information persistently.
[0056] Sharing process: If a user wants to share a device with other users, the application can call the sharing interface, and the cloud will send a sharing request to the target user. After the target user confirms, the cloud will send the new user ID information to the device, and the device will update its stored user association information.
[0057] 2. Video stream upload Event detection: When the algorithm module on the device detects that an event has occurred (such as motion detection), it will request the cloud to generate an event record.
[0058] Generate a unique identifier: The cloud responds to the request and generates a unique alarm_id and kvs upload URL. alarm_id is a unique identifier generated for each event, which contains information such as device ID, timestamp, and random number.
[0059] Fragment packaging and encryption: The device divides the event-related video stream into fragments of 3 seconds each, and dynamically encrypts the user ID list through alarm_id. Then, the device uploads these encrypted fragments to the KVS storage in the cloud.
[0060] Upload ends: When the event ends, the device stops uploading video clips.
[0061] 3. Obtaining playback links and verifying permissions Request event list: The application requests the device's event list from the cloud. The cloud returns an event list containing alarm_id.
[0062] Request playback link: The application selects a specific event as needed and requests the corresponding playback link from the cloud. The cloud generates the playback link and feeds it back to the application.
[0063] Downloading segments and decryption: The application downloads video segments by playing the link, and decrypts the user ID list using alarm_id every time a new video segment is downloaded.
[0064] Permission verification: After decrypting and obtaining the user ID list, the application verifies whether the current user's ID exists in the list. If the verification passes, the video is allowed to be rendered and played; otherwise, playback is denied.
[0065] 4. Dynamic encryption and security mechanism Dynamic encryption: The user ID list for each event is encrypted with a different alarm_id, so that even if the playback link is leaked, unauthorized users cannot decrypt and access the video content.
[0066] End-to-end security verification: During the entire life cycle of the video stream, from device upload to application playback, strict permission verification is performed at each step to ensure end-to-end security.
[0067] Error handling: Even if an exception or error occurs in the internal processing of the cloud, the use of dynamic encryption and user ID list verification mechanism can effectively prevent unauthorized users from directly downloading and playing video content that does not belong to them through signed URLs.
[0068] 5. User experience optimization Quick response: The application can obtain the video playback link within the specified time period in a short time, and play it immediately after confirming the permission, providing a smooth user experience.
[0069] Efficient resource utilization: The duration of each video clip is fixed at 3 seconds, which allows for more efficient management and retrieval of data while reducing unnecessary data transmission, saving network bandwidth and storage space.
[0070] Through the above working principle, the present invention provides an efficient, safe and easy-to-manage video stream security verification solution, which can be widely used in home security, industrial monitoring and other fields, and ensures the security and privacy of video content.
[0071] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the inventive concept of the present invention, or directly / indirectly applied in other related technical fields are included in the protection scope of the present invention.
Claims
1. A security verification system based on Kinesis Video Streams, It is characterized in that The system includes: A device for detecting events, generating event records and requesting a unique alarm_id and a kvs upload URL from a cloud server, wherein the device is capable of packaging a video stream into a number of fragments and appending a user ID list to each fragment by dynamically encrypting the user ID list using the alarm_id, and then uploading the fragments to the cloud kvs storage; The cloud server is used to receive requests from devices and generate a unique alarm_id and the corresponding kvs upload URL. It also supports applications' requests for playback links of video clips within a specified time period and can generate playback links based on the requests. It can also process binding requests between applications and devices, send binding tokens to devices, and send the ID information of the bound user to the device for persistent storage after successful binding. The application is used to request the event list of the device and the playback link of a specific event from the cloud server, download the video clips of the corresponding time period, and decrypt the user ID list through the alarm_id to verify the access rights of the current user. When the verification passes, the video can be rendered and played.
2. The system according to claim 1, It is characterized in that The device also includes an algorithm module, which is configured to automatically detect the occurrence of an event and trigger the recording and uploading process of the video stream when the event occurs.
3. The system according to claim 1 or 2, It is characterized in that The cloud server further includes a security mechanism for ensuring that even in the case of internal processing anomalies, unauthorized users are prevented from directly downloading and playing video content that does not belong to them through signed URLs.
4. The system according to any one of claims 1 to 3, It is characterized in that The user ID list is dynamically generated through the cloud and encrypted using a different alarm_id for each event to increase security.
5. The system according to any one of claims 1 to 4, It is characterized in that The application can perform real-time user ID verification after obtaining the playback link, and re-verify each time a new video clip is downloaded, thereby achieving end-to-end security control.
6. A security verification method based on Kinesis Video Streams, based on the security verification system according to any one of claims 1 to 5, It is characterized in that The method comprises the following steps: S1, the device detects the occurrence of an event and requests the cloud server to generate an event record; S2, the cloud server responds to the request and returns a unique alarm_id and kvs upload URL; S3, the device divides the event-related video stream into multiple fragments, and dynamically encrypts the user ID list through the alarm_id and attaches it to each fragment, and then uploads these fragments to the kvs storage in the cloud; S4, when the event ends, the device stops uploading; S5, the application requests the event list of the device from the cloud server; S6, the cloud server returns an event list containing alarm_id; S7, the application selects one or more events and requests corresponding playback links; S8, the cloud server generates a playback link and feeds it back to the application; S9, the application downloads the video clip through the playback link, decrypts the user ID list using the alarm_id during the download process, and verifies whether the current user's ID exists in the decrypted user ID list; S10: If the verification passes, the application allows the downloaded video clip to be rendered and played.
7. The method according to claim 6, It is characterized in that Step S1 also includes the application establishing a temporary communication session with the device through a network connection, so that the device receives and parses the binding token sent by the cloud server, completing the binding process between the device and the user.
8. The method according to claim 6 or 7, It is characterized in that Step S3 also includes the cloud server verifying the validity of the user ID list in each segment when receiving each segment uploaded by the device to ensure data integrity and correctness.
9. The method according to any one of claims 6 to 8, It is characterized in that In step S6, the cloud server is also provided with an event log database, which records all generated alarm_ids and their associated information, including device ids and timestamps, for the convenience of subsequent query and management.
10. The method according to any one of claims 6 to 9, It is characterized in that In step S10, before playing the video, the application not only verifies the user ID, but also checks the user's access permission level to ensure that only users with the corresponding permission level can access the specific type of video content.