H.323 video conference secure transmission system and method based on isolated transmission equipment

Abstract

The invention provides an H.323 video conference secure transmission system and method based on isolated transmission equipment, and relates to the technical field of data transmission. Comprising an extranet conference agent used for receiving a registration signaling of a conference calling terminal and transmitting the registration signaling to an intranet conference agent; after the conference called terminal completes registration, receiving a conference call of the conference calling terminal and transmitting the conference call to the intranet conference agent; receiving a call response and forwarding the call response to the conference call terminal; the intranet conference agent is used for receiving the registration signaling and the conference call sent by the extranet conference agent, and forwarding the registration signaling and the conference call to the called conference terminal; and receiving a call response sent by the called conference terminal, and transmitting the call response to the external network conference agent. According to the invention, high-efficiency transmission of audio and video data is realized, centralized management is carried out through a single-guide mode, and the system is suitable for scenes requiring low-delay and high-reliability audio and video transmission, such as online conferences, video live broadcast and multimedia applications.

Description

Technical Field

[0001] The present invention belongs to the technical field of data transmission, and in particular relates to an H.323 video conference secure transmission system and method based on isolated transmission equipment. Background Art

[0002] H.323 conference proxy includes two subdivisions: UDP and UDP / TCP. With the development of network technology, the demand for data transmission is growing, especially in the fields of real-time data processing and video surveillance. Although audio and video proxy through TCP, especially through multi-layer TCP forwarding (such as TCP / UDP proxy and then through a single channel), can improve the reliability of data transmission, it also brings some objective defects. The following is a detailed analysis:

[0003] 1) Increased latency

[0004] Each additional UDP / TCP forwarding will increase the delay. The connection establishment, data confirmation and retransmission mechanism of the connection-oriented protocol TCP will significantly reduce the user experience in real-time audio and video transmission, especially in delay-sensitive applications (such as online meetings and real-time live broadcasts).

[0005] 2) Resource consumption

[0006] In the resource consumption analysis, the TCP protocol usually consumes more bandwidth and processing resources than the connectionless UDP protocol due to its connection establishment and data confirmation mechanism; in the comparison between multi-process and single-process, the single-process model has a lower memory usage and is suitable for resource-limited environments, but it may cause low CPU utilization during processing and limit performance; relatively speaking, although the TCP / UDP proxy and audio and video proxy multi-process models have higher memory consumption, each process running independently can better utilize the performance of multi-core CPUs, especially in high-concurrency scenarios, but the overhead caused by frequent context switching and inter-process communication needs to be carefully managed. Therefore, the choice of single-process or multi-process model requires a balance between performance and resource consumption based on specific application scenarios and resource constraints.

[0007] 3) Increased maintenance complexity

[0008] Forwarding through TCP / UDP proxy services undoubtedly increases the complexity of the system structure. When troubleshooting, it is necessary to identify the performance and operating status of each layer, which will increase the difficulty of maintenance and fault recovery time. The complexity of the system not only affects performance, but may also introduce potential security risks. In a multi-layer proxy environment, any failure in any link may cause the entire system to crash, causing inconvenience to users.

[0009] 4) Network congestion and multipath issues

[0010] Under the multi-layer TCP proxy structure, the bandwidth and delay characteristics of different network links may vary significantly. The transmission delay of data packets between different paths will change, which makes it impossible to guarantee the quality of the overall audio and video stream, and may cause asynchrony, distortion or freeze. This phenomenon is particularly obvious in a dynamic network environment, which in turn affects the overall user experience. For application scenarios that pursue high-quality audio and video transmission, this impact cannot be underestimated.

[0011] Therefore, the traditional cross-single-conductor data transmission method has certain bottlenecks in terms of transmission rate, delay and system resource utilization. Summary of the invention

[0012] In order to overcome the shortcomings of the above-mentioned prior art, the present invention provides a H.323 video conferencing secure transmission system and method based on isolated transmission equipment. By setting an external network conference proxy and an internal network conference proxy, as well as a one-way network gateway device between the two, efficient transmission of audio and video data is achieved based on TCP and UDP proxy services, latency is reduced and resource utilization is improved, and centralized management is performed in a single-channel manner. It is suitable for scenarios that require low latency and high reliability audio and video transmission, such as online meetings, live video broadcasts, and multimedia applications.

[0013] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0014] A first aspect of the present invention provides an H.323 video conference secure transmission system based on an isolated transmission device.

[0015] An H.323 video conference secure transmission system based on an isolated transmission device includes a conference agent, wherein the conference agent includes an external network conference agent and an internal network conference agent, wherein:

[0016] The external network conference proxy is used to receive the registration signaling of the conference calling terminal and transmit it to the internal network conference proxy through the first network gate; after the conference called terminal completes the registration, it receives the conference call of the conference calling terminal and transmits it to the internal network conference proxy through the first network gate; receives the call response and forwards it to the conference calling terminal;

[0017] The intranet conference proxy is used to receive the registration signaling and conference call sent by the extranet conference proxy, and forward the registration signaling and conference call to the conference called terminal; receive the call response sent by the conference called terminal, and transmit the call response to the extranet conference proxy through the second network gate;

[0018] The first network gatekeeper and the second network gatekeeper are both unidirectional network gatekeeper devices.

[0019] As an optional technical solution, after receiving the registration signaling of the conference call terminal, the external network conference agent is further used to:

[0020] Perform security checks and analysis on registration signaling, discard non-standard protocols, and modify signaling according to the task configuration issued by the front end after signaling analysis is completed.

[0021] As an optional technical solution, after receiving the registration signaling of the external network conference agent, the internal network conference agent is further used to:

[0022] According to the tasks configured by the management platform, a routing strategy is formulated and the registration signaling is forwarded to the target conference gateway, that is, the called terminal of the conference, according to the routing strategy.

[0023] As an optional technical solution, the called terminal of the conference, after receiving the registration signaling, is further configured to:

[0024] Add the conference call terminal to the gateway to complete the conference call terminal registration.

[0025] As an optional technical solution, after receiving the conference call from the conference call terminal, the external network conference agent is further used to:

[0026] The conference call is parsed and security checked, and then transmitted to the intranet conference agent through the first network gatekeeper, wherein the security check includes signaling filtering and coding filtering.

[0027] As an optional technical solution, after receiving the conference call, the conference called terminal is further used to:

[0028] Determine a call response, wherein the call response includes approving or rejecting the conference call:

[0029] If the conference call is rejected, the conference call rejection information is sent to the intranet conference agent;

[0030] If the conference call is approved, the media stream information is sent to the intranet conference agent.

[0031] As an optional technical solution, after receiving the call response, the intranet conference agent is further used to:

[0032] After determining that the called terminal agrees to the conference call, the TCP proxy port is opened in the first network gate and the second network gate according to the H245 address and port dynamics in the call response to prepare conditions for the media interaction of the subsequent conference.

[0033] As an optional technical solution, after receiving the call response, the conference call terminal is further used to:

[0034] After determining that the called terminal agrees to the conference call, the H245 conference process is started and the media stream interaction begins.

[0035] As an optional technical solution, the external network conference agent and the internal network conference agent are also used for:

[0036] Receive the conference media stream and send it to the media stream deep detection storage terminal in the form of distribution for security check and storage; the security check includes:

[0037] Check the format of media stream packets and perform security checks on the RTP layer protocol including source address, destination address, timestamp and sequence number information. If the IP or port is in the blacklist, an alarm is triggered and the conference is blocked.

[0038] Check the video encoding format;

[0039] Perform keyword filtering.

[0040] A second aspect of the present invention provides a secure transmission method for an H.323 video conference based on an isolated transmission device.

[0041] A H.323 video conference secure transmission method based on isolated transmission equipment, comprising:

[0042] The external network conference agent receives the registration signaling of the conference call terminal and transmits it to the internal network conference agent through the first network gate;

[0043] The intranet conference proxy receives the registration signaling sent by the extranet conference proxy and forwards the registration signaling to the called terminal of the conference;

[0044] After the called terminal completes registration, the external network conference agent receives the conference call from the conference calling terminal and transmits it to the internal network conference agent through the first network gatekeeper;

[0045] The intranet conference agent receives the conference call sent by the extranet conference agent and forwards the conference call to the called terminal;

[0046] The intranet conference proxy receives the call response sent by the called terminal of the conference, and transmits the call response to the extranet conference proxy through the second network gate;

[0047] The external network conference proxy receives the call answer and forwards it to the conference call terminal.

[0048] One or more of the above technical solutions have the following beneficial effects:

[0049] 1. The present invention provides a secure transmission system and method for H.323 video conferencing based on isolated transmission equipment. By setting up an external network conference proxy and an internal network conference proxy, as well as a one-way network switch device between the two, efficient transmission of audio and video data is achieved based on TCP and UDP proxy services, reducing latency and improving resource utilization, and centralized management is performed in a single-channel manner. It is suitable for scenarios that require low latency and high reliability audio and video transmission, such as online conferencing, live video broadcasting, and multimedia applications.

[0050] 2. Through the cooperation of the task management subsystem, the signaling gateway proxy subsystem and the physical isolation switching system, the one-way dual-single-guide mode is adopted to realize the mutual on-demand H323 video conferencing in the physical isolation network. At the same time, security checks can be performed on conference signaling and video format encoding to ensure the safe transmission of data.

[0051] 3. Conference on-demand in physically isolated networks. Through the synergy of the task management subsystem, signaling gateway proxy subsystem, and physically isolated switching system, efficient conference on-demand function is achieved, ensuring the security and stability of the network.

[0052] 4. Security of conference data. On the basis of ensuring the security of conference messages and video data, the proxy system can be flexibly configured according to policies and video encoding requirements, and can easily detect and filter video conference formats, thereby effectively preventing potential security risks.

[0053] 5. Conference media stream detection and storage. By adding a media stream deep detection storage service, you can conduct in-depth analysis and detection of media stream data without affecting the conference, prevent the entry of illegal data and the transmission of file tapes and viruses, and maximize the security of transmission.

[0054] 6. Monitoring and management of multimedia data streams. The H.323 conference proxy system has the ability to monitor and manage multimedia data streams such as video and audio in real time, ensuring the overall quality of the conference and greatly improving the user experience and effectiveness of the conference.

[0055] 7. Traffic control. Through real-time monitoring and management of video, audio and other data streams, the stability and smoothness of the meeting can be ensured. Effective traffic control can not only avoid image freezes and sound delays caused by network congestion, but also dynamically adjust the data transmission rate according to the user's network conditions, thereby optimizing the user experience.

[0056] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0058] Figure 1 This is a system structure diagram of the first embodiment.

[0059] Figure 2 This is a flow chart of the management platform configuration in the second embodiment.

[0060] Figure 3 This is a flow chart of H323 signaling cross-network transmission in the second embodiment.

[0061] Figure 4 This is a flow chart of media stream depth detection and storage in the second embodiment. DETAILED DESCRIPTION

[0062] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0063] It should be noted that the terms used herein are for describing specific embodiments only and are not intended to be limiting of exemplary embodiments according to the present invention.

[0064] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0065] Embodiment 1

[0066] As mentioned above, the implementation of a video gateway conference usually consists of two parts: a single channel and a video proxy, each of which has important functions. An important problem faced by the video proxy when proxying media streams is that a large number of videos are forwarded through a single channel connection.

[0067] Single-channel part: This part is mainly responsible for the flow control and isolation of video data. It ensures the security isolation between the internal network and the external network by setting rules and policies to prevent unauthorized data access and leakage. At the same time, the single-channel technology can monitor the transmission of video data, identify and intercept abnormal traffic, thereby improving the security of the system.

[0068] Video proxy part: This part focuses on the forwarding and processing of video data. The video proxy can decode, transcode and cache video streams in real time, optimize bandwidth usage, and improve the efficiency of video transmission. It can also provide load balancing, traffic scheduling and other functions to ensure high availability and stability, and meet users' needs for access to video content.

[0069] Although audio and video proxying through TCP, especially through multi-layer TCP forwarding (such as TCP / UDP proxy and then through a single channel), can improve the reliability of data transmission, it also brings some objective defects, such as increased latency, resource consumption, increased maintenance complexity and network congestion problems.

[0070] In order to solve the above problems, the embodiment of the present invention proposes an H.323 video conference secure transmission system based on an isolated transmission device. The key technical components and solution flow of the technical solution of this embodiment will be described as a whole below.

[0071] 1. Key technical components

[0072] (1) Protocol selection

[0073] TCP proxy: Suitable for reliable transmission of video streams, ensuring data integrity and sequence, and suitable for applications that require stable playback.

[0074] UDP Proxy: Used for real-time audio transmission, reducing latency and improving user experience, especially in instant messaging and live streaming situations.

[0075] (2) Proxy Server

[0076] A dedicated proxy server is set up to support forwarding of TCP / UDP protocols. In this embodiment, the dedicated proxy server refers to a conference proxy, including an extranet conference proxy and an intranet conference proxy.

[0077] Forwarding and routing of audio and video traffic is achieved through SOCKS proxy.

[0078] (3) Single-lead mechanism

[0079] Combine audio and video over a single transmission channel, reducing management complexity and points of failure.

[0080] Realize centralized processing and transmission of audio and video data and simplify system architecture.

[0081] In this embodiment, the first network gate and the second network gate are both unidirectional network gate devices, which can realize the function of merging audio and video through a single transmission channel, thereby achieving the technical effect of efficient transmission, reducing management complexity and failure points.

[0082] 2. Program Process

[0083] (1) Collection:

[0084] Audio and video data are acquired through acquisition equipment and encoded.

[0085] (2) Proxy forwarding:

[0086] Data is first forwarded through TCP or UDP proxy, and the appropriate proxy mode is selected according to different types of streams. Among them, the external network conference proxy and the internal network conference proxy will select the appropriate protocol, namely TCP / UDP protocol, to forward data.

[0087] A proxy server routes data to a destination server or terminal.

[0088] (3) Single-conductor transmission:

[0089] All audio and video streams are transmitted using the same guide to ensure efficient data flow.

[0090] That is, unidirectional transmission is performed through the first gatekeeper and the second gatekeeper.

[0091] (4) Monitoring and management:

[0092] Monitor traffic conditions, latency, and packet loss through a centralized management platform.

[0093] Implement bandwidth control and traffic priority strategies to ensure priority transmission of critical data.

[0094] (5) Security:

[0095] The TLS / SSL protocol is used to encrypt audio and video data to ensure the security of the transmission process.

[0096] It can be understood that in the present embodiment, during the process of data transmission using the conference proxy and the one-way network gateway device, the data is encrypted.

[0097] Next, the technical solution of this embodiment will be explained in detail with reference to the accompanying drawings.

[0098] like Figure 1 As shown, an H.323 video conference secure transmission system based on an isolated transmission device includes a conference agent, wherein the conference agent includes an external network conference agent and an internal network conference agent, wherein:

[0099] The external network conference proxy is used to receive the registration signaling of the conference calling terminal and transmit it to the internal network conference proxy through the first network gate; after the conference called terminal completes the registration, it receives the conference call of the conference calling terminal and transmits it to the internal network conference proxy through the first network gate; receives the call response and forwards it to the conference calling terminal;

[0100] The intranet conference proxy is used to receive the registration signaling and conference call sent by the extranet conference proxy, and forward the registration signaling and conference call to the conference called terminal; receive the call response sent by the conference called terminal, and transmit the call response to the extranet conference proxy through the second network gate;

[0101] The first network gatekeeper and the second network gatekeeper are both unidirectional network gatekeeper devices.

[0102] exist Figure 1 In the figure, the data interaction of video conference on-demand between T1 (H323 conference terminal 1), GK1 (H323 conference gateway 1), T2T2 (H323 conference terminal 2), GK2 (H323 conference gateway 2), H323 conference intranet proxy, H323 conference extranet proxy, network gate 1 (one-way network gate), and network gate 2 (one-way network gate) is shown.

[0103] This embodiment realizes efficient transmission of audio and video data based on TCP and UDP proxy services by setting up an extranet conference proxy and an intranet conference proxy, as well as a one-way gateway device between the two, reduces latency and improves resource utilization, and performs centralized management in a single-channel manner. It is suitable for scenarios that require low-latency and high-reliability audio and video transmission, such as online meetings, live video broadcasts, and multimedia applications.

[0104] It can be understood that this embodiment actually also includes a conference calling terminal and a conference called terminal. In the process of data transmission and interaction between the conference calling terminal and the conference called terminal, the above-mentioned conference agent (external network conference agent, internal network conference agent) and one-way network gate devices (first network gate and second network gate) can be used to forward, detect, store, control flow and ensure security of data, and finally realize conference on-demand in a physically isolated network.

[0105] Next, the functions of each part of the above system in this embodiment will be described in combination with the transmission process of data stream in physically isolated network conference on-demand:

[0106] First, after the conference on-demand starts, the conference calling terminal needs to send a registration signaling to the conference called terminal. The conference calling terminal first sends the registration signaling to the external network conference proxy, which then forwards it.

[0107] In some embodiments, after receiving the registration signaling of the conference call terminal, the external network conference agent is further used to:

[0108] Perform security checks and analysis on registration signaling, discard non-standard protocols, and modify signaling according to the task configuration issued by the front end after signaling analysis is completed, such as adding return routes.

[0109] Afterwards, the external network conference agent transmits the registration signaling that has undergone security inspection and analysis to the internal network conference agent through the first network gate.

[0110] In some embodiments, after receiving the registration signaling of the external network conference agent, the internal network conference agent is further used to:

[0111] According to the tasks configured by the management platform, a routing strategy is formulated and the registration signaling is forwarded to the target conference gateway, that is, the called terminal of the conference, according to the routing strategy.

[0112] In the above process, the intranet conference agent forwards the received registration signaling to the conference baby calling terminal, which is processed by the conference called terminal.

[0113] Furthermore, the called terminal of the conference will receive the registration signaling and complete the registration of the conference terminal. When the conference gateway of the trusted network domain receives the registration of the conference terminal, it will add the conference terminal to the gateway and provide calls to other terminals.

[0114] It can be understood that the conference terminal mentioned in this embodiment is the conference calling terminal, and the conference gateway in the trusted network domain is the conference called terminal.

[0115] Therefore, in some embodiments, upon receiving the registration signaling, the called terminal of the conference is further configured to:

[0116] Add the conference call terminal to the gateway to complete the conference call terminal registration.

[0117] After the above registration is completed, the conference calling terminal will send a conference call to the conference called terminal. In this process, the conference calling terminal first forwards the conference call to the external network conference proxy, which forwards and processes it.

[0118] In some embodiments, after receiving the conference call from the conference call terminal, the external network conference agent is further used to:

[0119] The conference call is parsed and security checked, and then transmitted to the intranet conference agent through the first network gatekeeper, wherein the security check includes signaling filtering and coding filtering.

[0120] Afterwards, the external network conference agent transmits the conference call information after the analysis and security check to the internal network conference agent through the first network gate.

[0121] In some embodiments, the intranet conference agent receives the conference call information and forwards the conference call information to the conference called terminal, that is, the conference gateway of the trusted network domain.

[0122] In some embodiments, after receiving the conference call, the conference called terminal is further used to:

[0123] Determine a call response, wherein the call response includes approving or rejecting the conference call:

[0124] If the conference call is rejected, the conference call rejection information is sent to the intranet conference agent;

[0125] If the conference call is approved, the media stream information is sent to the intranet conference agent.

[0126] After the called terminal receives the conference call, it needs to determine the type of call response, which can be to agree to the conference call or to reject the conference call. The above-mentioned approval or rejection information is sent as a call response to the intranet conference agent, which is forwarded and processed by the intranet conference agent through the second network gate.

[0127] In addition to forwarding the call response as described above, in some embodiments, the intranet conference agent, after receiving the call response, is also used to:

[0128] After determining that the called terminal agrees to the conference call, the TCP proxy port is opened in the first network gate and the second network gate according to the H245 address and port dynamics in the call response to prepare conditions for the media interaction of the subsequent conference.

[0129] In some embodiments, after receiving the call response, the conference call terminal is further used to:

[0130] After determining that the called terminal agrees to the conference call, the H245 conference process is started and the media stream interaction begins. At this point, the conference process is started.

[0131] In order to further improve the security of the conference, in some embodiments, the external network conference agent and the internal network conference agent are also used to:

[0132] Receive the conference media stream and send it to the media stream deep detection storage terminal in the form of distribution for security check and storage; the security check includes:

[0133] Check the format of media stream packets and perform security checks on the RTP layer protocol including source address, destination address, timestamp and sequence number information. If the IP or port is in the blacklist, an alarm is triggered and the conference is blocked.

[0134] Check the video encoding format;

[0135] Perform keyword filtering.

[0136] It can be understood that the first network gate and the second network gate both merge and forward the audio and video data, thereby improving data transmission efficiency and reducing maintenance complexity.

[0137] After the above explanation, this system uses isolation transmission equipment and H323 audio and video conferencing proxy technology to realize cross-network transmission of monitoring traffic.

[0138] Embodiment 2

[0139] This embodiment discloses a secure transmission method for H.323 video conference based on an isolated transmission device.

[0140] A H.323 video conference secure transmission method based on isolated transmission equipment, comprising:

[0141] The external network conference agent receives the registration signaling of the conference call terminal and transmits it to the internal network conference agent through the first network gate;

[0142] The intranet conference proxy receives the registration signaling sent by the extranet conference proxy and forwards the registration signaling to the called terminal of the conference;

[0143] After the called terminal completes registration, the external network conference agent receives the conference call from the conference calling terminal and transmits it to the internal network conference agent through the first network gatekeeper;

[0144] The intranet conference agent receives the conference call sent by the extranet conference agent and forwards the conference call to the called terminal;

[0145] The intranet conference proxy receives the call response sent by the called terminal of the conference, and transmits the call response to the extranet conference proxy through the second network gate;

[0146] The external network conference proxy receives the call answer and forwards it to the conference call terminal.

[0147] Furthermore, the above-mentioned audio and video proxy efficient cross-domain data transmission method of this embodiment can be implemented by a task management subsystem, a signaling gateway proxy subsystem and a media stream depth detection storage system, such as Figure 2 , Figure 3 and Figure 4 As shown, they are respectively the management platform configuration flowchart, the H323 signaling cross-network transmission flowchart and the media stream deep detection storage flowchart of this embodiment, which can respectively correspond to the data processing processes of the above three task management subsystems, the signaling gateway agent subsystem and the media stream deep detection storage system.

[0148] in:

[0149] The task management subsystem is mainly used for proxy channel configuration, policy configuration distribution, log management, etc.

[0150] The H.323 audio and video conference proxy subsystem provides efficient proxy and protocol data conversion functions for video conference signaling and media stream interaction between isolated networks. The network gate adopts a one-way dual network gate mode and encrypts the signaling transmission at the same time. The system supports signaling action analysis and control capabilities, and can configure signaling blacklists and whitelists through configuration to block the transmission of specified signaling. Through the H.323 audio and video conference proxy system, conference terminals on both sides of the isolated network can realize conference calls and responses between trusted and untrusted areas, ensuring a safe and convenient conference experience.

[0151] The media stream deep detection storage system uses bypass mode to perform security checks on the protocol layer and content of the media stream in the video conference. During the video playback process, the media stream is security filtered in turn for RTP, H264 / H265, ACC / G711 and other encoded content. If it finds folder tapes, codes, and viruses, it will promptly alarm and interrupt the meeting. It also has the ability to store video recordings of meeting content for post-meeting review.

[0152] This embodiment discloses a secure transmission method for H.323 video conferences based on isolated transmission equipment, which is mainly used to achieve secure transmission of H323 video conference traffic in different network domains, and is particularly suitable for physically isolated network boundaries.

[0153] The realization of cross-network transmission of H323 audio and video conference mainly includes three processes, namely management platform configuration, H323 signaling cross-network transmission process and media stream deep detection and storage process. Figure 2 As shown, the management platform configuration mainly includes the following steps:

[0154] Step 1: Access configuration. Configure the IP information of devices in the non-trusted domain that are allowed to access. Unauthorized traffic will not be transmitted across the network.

[0155] Step 2: Task configuration. The management platforms on both sides perform task configuration, mainly configuring the target IP address, port, and other information of the trusted domain.

[0156] Step 3: Control policy configuration: You can configure whether to filter control signals for each proxy task, such as RAS signaling, H225 signaling, and H245 signaling, and perform different policy controls based on the authority of the administrator.

[0157] Step 4: Configure the conference audio and video codec blacklist and whitelist. By adding the conference audio and video codec blacklist and whitelist configuration to the proxy, illegal coding can be blocked and monitored.

[0158] like Figure 3 As shown, the H323 conference proxy cross-network transmission process mainly includes the following steps:

[0159] Step 1: Configure the conference terminal or H323 gateway. Add the IP address, RAS port and H245 port of the proxy gateway on the terminal or H323 gateway.

[0160] Step 2: The H323 conference agent receives the registration signaling from the conference terminal. The H323 audio and video agent is one of the core systems of this system. The conference agent in the non-trusted network domain only opens specific ports to receive and forward signaling data according to the configuration of the management platform. After receiving the registration information, the agent will perform security checks and analysis on the signaling, and will discard non-standard protocols. After the signaling analysis is completed, the signaling will be modified according to the task configuration issued by the front end, such as adding a return route.

[0161] Step 3: Registration signaling data is transmitted across network domains. After the conference agent completes the signaling processing, it will encrypt the signaling and forward it to the one-way network gate through the data receiving and forwarding subsystem, which will forward it to the conference agent service in the intranet. The data receiving and forwarding subsystem in the trusted network domain will receive the signaling data from the network gate and send it to the H323 conference agent in the trusted network domain. After receiving the registration signaling, the H323 conference agent will formulate a routing strategy according to the tasks configured by the management platform and forward the signaling to the target conference gateway according to the routing strategy.

[0162] Step 4: The conference gateway receives the registration signaling to complete the conference terminal registration. When the conference gateway in the trusted network domain receives the registration of the conference terminal, it adds the conference terminal to the gateway and provides calls to other terminals.

[0163] Step 5: The conference terminal initiates a conference call. The conference terminal in the trusted network domain initiates a conference call and sends it to the conference agent.

[0164] Step 6: The H323 conference proxy receives and forwards the conference call request. After receiving the conference call request, the H323 conference proxy will parse and perform security checks such as signaling filtering and encoding filtering, and then forward the call signaling to the conference gateway in the trusted network domain.

[0165] Step 7: The called conference terminal receives the call signaling. After the call signaling passes through the gateway, the called conference terminal receives the conference request and decides whether to approve or reject the call. If rejected, it directly replies to the H323 proxy service. If the conference is approved, it carries the media stream information to the caller and forwards it to the conference caller.

[0166] Step 8: The H323 proxy service receives the conference forwarding call response. When the proxy receives the conference response, it will dynamically open the TCP proxy port in the network gate according to the H245 address and port in the call response to prepare for the media interaction of the subsequent conference.

[0167] Step 9: The calling party receives the call answer and completes the call session. After the calling party receives the call answer, if the called party agrees, the H245 conference process is started and the media stream interaction begins.

[0168] like Figure 4 As shown in the figure, the media stream deep detection and storage process mainly includes the following steps:

[0169] Step 1: Receive the video conference media stream distribution flow. The distribution process of receiving the video conference media stream is as follows: After the meeting starts, in addition to sending the conference media stream to each conference terminal, we will also distribute it to the media stream deep detection storage service for comprehensive content analysis. Due to the distribution method, this process will not cause any delay to the original meeting, ensuring the smooth progress of the meeting.

[0170] Step 2: Media stream packet format check. For each received data packet, first perform a security check on the RTP layer protocol, including source address, destination address, timestamp, sequence number, etc. If the IP or port is found in the blacklist, an alarm will be triggered and the H323 proxy will be notified. The proxy service will block the conference in time to ensure the security of the system.

[0171] Step 3: Video encoding format check. Conduct in-depth checks on commonly used video formats for conferences, such as H264 and H265, to verify the transmission standards of these encodings and ensure that no non-standard illegal data appears. This can effectively prevent improper information from being carried through the encoding layer and ensure data security and compliance.

[0172] Step 4: Keyword filtering. By flexibly setting keywords or phrases, the system can comprehensively scan the text and audio in the media content and accurately identify content that may violate the policy. These keywords are issued by the platform policy to ensure efficient compliance and can be configured according to needs.

[0173] Step 5: Storage of conference media streams. After the media stream deep inspection storage service completes the security check of the media stream, you can choose whether to store the conference media stream according to the configuration items. The saved conference audio and video can be reviewed later.

[0174] This system realizes mutual on-demand H323 video conferencing in physically isolated networks through the cooperation of the task management subsystem, signaling gateway proxy subsystem and physical isolation switching system, using a one-way dual-single-guide mode. At the same time, it can perform security checks on conference signaling and video format encoding to ensure secure data transmission.

[0175] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0176] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. An H.323 video conference secure transmission system based on isolated transmission equipment, characterized in that: It includes conference agents, which include external network conference agents and internal network conference agents, wherein: The external network conference proxy is used to receive the registration signaling of the conference calling terminal and transmit it to the internal network conference proxy through the first network gate; after the conference called terminal completes the registration, it receives the conference call of the conference calling terminal and transmits it to the internal network conference proxy through the first network gate; receives the call response and forwards it to the conference calling terminal; The intranet conference proxy is used to receive the registration signaling and conference call sent by the extranet conference proxy, and forward the registration signaling and conference call to the conference called terminal; receive the call response sent by the conference called terminal, and transmit the call response to the extranet conference proxy through the second network gate; The first network gatekeeper and the second network gatekeeper are both unidirectional network gatekeeper devices.

2. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 1, characterized in that: After receiving the registration signaling of the conference call terminal, the external network conference agent is further used to: Perform security checks and analysis on registration signaling, discard non-standard protocols, and modify signaling according to the task configuration issued by the front end after signaling analysis is completed.

3. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 1, characterized in that: After receiving the registration signaling of the external network conference agent, the internal network conference agent is further used to: According to the tasks configured by the management platform, a routing strategy is formulated and the registration signaling is forwarded to the target conference gateway, that is, the called terminal of the conference, according to the routing strategy.

4. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 1, characterized in that: The called terminal of the conference, upon receiving the registration signaling, is further configured to: Add the conference call terminal to the gateway to complete the conference call terminal registration.

5. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 1, characterized in that: After receiving the conference call from the conference call terminal, the external network conference agent is further used to: The conference call is parsed and security checked, and then transmitted to the intranet conference agent through the first network gatekeeper, wherein the security check includes signaling filtering and coding filtering.

6. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 1, characterized in that: After receiving the conference call, the conference called terminal is further used to: Determine a call response, wherein the call response includes approving or rejecting the conference call: If the conference call is rejected, the conference call rejection information is sent to the intranet conference agent; If the conference call is approved, the media stream information is sent to the intranet conference agent.

7. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 6, characterized in that: After receiving the call response, the intranet conference agent is further used to: After determining that the called terminal agrees to the conference call, the TCP proxy port is opened in the first network gate and the second network gate according to the H245 address and port dynamics in the call response to prepare conditions for the media interaction of the subsequent conference.

8. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 1, characterized in that: After receiving the call response, the conference call terminal is further used to: After determining that the called terminal agrees to the conference call, the H245 conference process is started and the media stream interaction begins.

9. The H.323 video conference secure transmission system based on isolated transmission equipment as claimed in claim 1, characterized in that: The external network conference agent and the internal network conference agent are also used for: Receive the conference media stream and send it to the media stream deep detection storage terminal in the form of distribution for security check and storage; the security check includes: Check the format of media stream packets and perform security checks on the RTP layer protocol including source address, destination address, timestamp and sequence number information. If the IP or port is in the blacklist, an alarm is triggered and the conference is blocked. Check the video encoding format; Perform keyword filtering.

10. A secure transmission method for H.323 video conference based on isolated transmission equipment, characterized in that: include: The external network conference agent receives the registration signaling of the conference call terminal and transmits it to the internal network conference agent through the first network gate; The intranet conference proxy receives the registration signaling sent by the extranet conference proxy and forwards the registration signaling to the called terminal of the conference; After the called terminal completes registration, the external network conference agent receives the conference call from the conference calling terminal and transmits it to the internal network conference agent through the first network gatekeeper; The intranet conference agent receives the conference call sent by the extranet conference agent and forwards the conference call to the called terminal; The intranet conference proxy receives the call response sent by the called terminal of the conference, and transmits the call response to the extranet conference proxy through the second network gate; The external network conference proxy receives the call answer and forwards it to the conference call terminal.

Images