Cross-network video security transmission method and system

Abstract

The method comprises: a platform end establishes a local channel state table, and acquires a video browsing request of a user; whether the same video stream information is being transmitted is judged according to the video browsing request and the local channel state table, if yes, a channel transmitting the same video stream information is assigned to the user, otherwise, a channel with the minimum load rate is selected from available channels and assigned to the user; a front-end processing unit converts a device end video stream into an analog signal, and transmits the analog signal to a rear-end processing unit through the channel assigned to the user; the rear-end processing unit restores the analog signal into the original video stream, resamples the original video stream, and reorders the resampled data based on the dependence relationship between frames during video decoding; and the recombined video stream is sent to the platform end for playing, so that effective video stream transmission is realized under the premise that the management information area and the Internet area are safely isolated, and the resource utilization rate and the network detection resistance are improved.

Description

Technical Field

[0001] This application relates to the field of video streaming, and in particular to a method and system for secure cross-network video transmission. Background Technology

[0002] Currently, in data transmission practices, the two network areas that need to be transmitted are usually divided into a management information area and an internet area, and strict logical isolation is achieved by deploying information security network isolation devices between these two areas.

[0003] Especially in video surveillance applications, because video streams and on-demand commands cannot traverse these isolation devices, current video surveillance services typically employ a dual-terminal model to initiate on-demand requests separately. This model is extremely inconvenient for scenarios requiring simultaneous querying of video resources in both the management information zone and the internet zone.

[0004] Existing technical documents disclose a method for secure cross-network video transmission and a video-based information security network isolation device. However, the existing technical documents employ only a single security processing method, relying solely on the channel number as the access identifier, which can easily lead to channel conflicts. Furthermore, they do not support adaptive processing of multiple encoding formats, resulting in low system resource utilization and weak resistance to network detection. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this application provides a cross-network video secure transmission method and system, enabling normal access to video resources in the management information zone while ensuring the retrieval of video data from the Internet zone. This reduces channel conflicts, ensures effective video stream transmission under the premise of secure isolation between the management information zone and the Internet zone, and improves resource utilization and resistance to network detection.

[0006] The technical solution adopted in this application is as follows.

[0007] The first aspect of this application provides a method for secure cross-network video transmission, applied to a cross-network video secure transmission system. The system includes a platform, a device, a video-based information security network isolation device, and a logical information security network isolation device. The logical information security network isolation device is used to send a video access request from the platform to the device. The video-based secure network isolation device is used to transmit the video stream from the device to the platform based on the video access request to complete the access. The method includes: The platform establishes a local channel status table, obtains the user's video access request, and determines whether the same video stream information is being transmitted based on the video access request and the local channel status table. If so, the channel transmitting the same video stream information is assigned to the user; otherwise, the channel with the lowest load rate is selected from the available channels and assigned to the user. The video-based secure network isolation device includes a pre-processing unit and a post-processing unit. The pre-processing unit converts the device-side video stream into an analog signal and transmits it to the post-processing unit through a channel allocated to the user. The post-processing unit restores the analog signal to the original video stream and resamples it. Based on the dependency relationship between frames during video decoding, the sampled data is reordered. After receiving the reordered video frames, the pre-processing unit reassembles the video stream and sends the reassembled video stream to the platform for playback. The resampling frequency is a non-integer multiple of the original video stream frame rate.

[0008] Optionally, the dependencies between frames during video decoding include key frames (I-frames) which can be encoded independently, while non-key frames (P-frames or B-frames) require I-frames or preceding P-frames for decoding. The reordering of the adopted data based on these dependencies includes: The original video stream is divided into multiple independent frame groups. Each independent frame group includes one I-frame and multiple P-frames and / or B-frames that depend on the I-frame. The I-frame is the group head of each independent frame group. The order of multiple P-frames and / or B-frames within each independent frame group is locally rearranged. At the same time, the RTP timestamp of each rearranged frame is offset by a preset non-fixed interval.

[0009] Optionally, the method further includes: Calculate the static background block similarity between each P-frame or B-frame and the I-frame in each independent frame group, and calculate the intra-frame gradient value in each independent frame group; Determine whether a P-frame or B-frame is a redundant sampling point based on the intra-frame gradient value and / or the similarity of static background blocks, and delete the redundant sampling points.

[0010] Optionally, calculating the static background block similarity between each P-frame and I-frame in each independent frame group includes: Extract the first static background block in the I-frame; Extract the second static background block at the same coordinate position as the first static background block in the P-frame and the I-frame, and calculate the similarity between the first static background block and the second static background block.

[0011] Optionally, extracting the first static background block in the I-frame includes: The I-frame is divided into multiple non-overlapping frame blocks. For each frame block, the variance of the corresponding luminance component is calculated, and the frame block with a variance greater than a preset variance threshold is taken as the first static background block.

[0012] Optionally, the method further includes: During video encoding, the encoding identifier and frame rate in the video stream header are read, the encoding characteristics of the current video stream are identified based on the encoding identifier and frame rate, and the encoding format is determined based on the encoding characteristics. Specifically, a standardized feature library is constructed, in which pre-set combination items are defined according to two dimensions: encoding type and frame rate. Each combination item has corresponding encoding logic. After determining the encoding type based on the encoding identifier, the matching encoding logic is searched in the standardized feature library according to the determined encoding type and frame rate, and then encoded according to the encoding format corresponding to the encoding logic. After being encoded according to the encoding format, it is transmitted based on a preset dynamic fragmentation method.

[0013] Optionally, the encoding logic includes a target frame rate, obtaining the current actual frame rate, and if the frame rate fluctuation exceeds a preset fluctuation threshold for consecutive times, fine-tuning the current actual frame rate based on the inter-frame timestamp increment to achieve the target frame rate.

[0014] Optionally, the current actual frame rate can be fine-tuned based on the inter-frame timestamp increment to achieve the target frame rate, as expressed below:

[0015] in, This represents the difference between the current actual frame rate and the target frame rate. i indicates which adjustment stage is being performed. a represents the adjustment magnitude coefficient, used to control the magnitude of the frame rate adjustment. K represents the fluctuation coefficient, which is the relative magnitude of the adjustment that the current actual frame rate needs to be adjusted relative to the target frame rate. n is the total number of adjustment stages. n = min (ceil ( 2 / (K + 0.05) ), 8), where ceil() represents rounding.

[0016] Optionally, transmission based on a preset dynamic fragmentation method includes: When the current NALU size is less than the current effective MTU, the NALU will be directly encapsulated into an RTP packet; When the current effective MTU is less than the current NALU size and is less than or equal to an integer multiple of the current effective MTU, the current NALU size is divided by the current effective MTU size to obtain the number of fragments, and fragmented transmission is performed according to the number of fragments. When the current NALU size is greater than an integer multiple of the current effective MTU, reduce the interval between two I-frames and / or reduce the quantization step size of the encoder for image blocks to reduce the NALU size.

[0017] A second aspect of this application provides a cross-network video secure transmission system, including a platform, a device, a video-based information security network isolation device, and a logical information security network isolation device. The logical information security network isolation device is used to send a video access request from the platform to the device. The video-based secure network isolation device is used to transmit the video stream from the device to the platform based on the video access request to complete the access. The system further includes: A cross-network video secure transmission device, the device being used to implement the above-mentioned cross-network video secure transmission method, the device comprising: The channel allocation module is used to establish a local channel status table on the platform side. After obtaining the user's video access request, it determines whether the same video stream information is being transmitted based on the video access request and the local channel status table. If so, the channel transmitting the same video stream information is allocated to the user. Otherwise, the channel with the lowest load rate is selected from the available channels and allocated to the user. The sampling module is used to restore the analog signal to the original video stream and then resample it, and to reorder the sampled data based on the dependency relationship between frames during video decoding; wherein, the video-type secure network isolation device includes a pre-processing unit and a post-processing unit. The pre-processing unit converts the device-side video stream into an analog signal and transmits it to the post-processing unit through the channel allocated to the user. The post-processing unit transmits the analog signal to the sampling module, and the sampling frequency of the resampling is a non-integer multiple of the original video stream frame rate; The video reassembly module is used to reassemble the video stream after the preprocessing unit receives the reordered video frames, and then send the reassembled video stream to the platform for playback.

[0018] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when loaded onto the processor, implements the above-described cross-network video secure transmission method.

[0019] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described cross-network video secure transmission method.

[0020] Compared with the prior art, the beneficial effects of this application include at least the following: This application determines whether the same video stream information is being transmitted based on the video access request and the local channel status table. If so, the channel transmitting the same video stream information is assigned to the user; otherwise, the channel with the lowest load rate is selected from the available channels and assigned to the user. This achieves direct distribution of the same video to users who have opened the same video via the same channel, avoiding the process of re-pulling the stream. It enables channel reuse and effectively transmits video streams while maintaining secure isolation between the management information area and the internet area, improving resource utilization. After the analog signal is restored to the original video stream by the post-processing unit and resampled, the sampled data is reordered based on the dependencies between frames during video decoding, which improves resistance to network probing. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 A schematic diagram of the system architecture used in existing cross-network video secure transmission methods; Figure 2 This is a schematic flowchart of a cross-network video secure transmission method provided in an embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. The embodiments described in this application are merely some embodiments of this application, and not all embodiments. Based on the spirit of this application, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this application.

[0023] like Figure 1 As shown, Figure 1 This is a system diagram illustrating a cross-network video secure transmission method provided by existing technology. The cross-video secure transmission system includes: a management information regional environment, an internet regional environment, a video-based information security network isolation device, and a logical information security network isolation device. The management information regional environment is the platform end, and the internet regional environment is the device end; hereinafter referred to as the platform end and the device end.

[0024] The Internet regional environment platform integration service is responsible for accessing devices and processing the video source input of the front-end module in the video-based information security network isolation device. The management information regional environment platform integration service receives and displays the video source from Internet regional devices and is responsible for the video source output of the back-end module. The logical information security network isolation device provides secure isolation between internal and external network video platforms and is responsible for notifying platform devices of their channel numbers and other video stream information. The video-based information security network isolation device converts the digital signals input by the front-end module into analog signals, and the back-end module then converts the analog signals back into digital signals.

[0025] However, existing technologies lack channel multiplexing mechanisms, have limited security processing methods, do not support adaptive processing of multiple encoding formats, and have low system resource utilization and low resistance to network detection.

[0026] Combination Figure 2 As shown, Embodiment 1 of this application provides a cross-network video secure transmission method, applicable to, for example... Figure 1 The cross-video secure transmission system shown includes the following method: Step 1: The platform establishes a local channel status table, obtains the user's video access request, and determines whether the same video stream information is being transmitted based on the video access request and the local channel status table. If so, the channel transmitting the same video stream information is assigned to the user; otherwise, the channel with the lowest load rate is selected from the available channels and assigned to the user.

[0027] It is understood that the transmission channel in this application is a hardware channel connecting the front-end module main control board and the rear-end module main control board, including a decoding end and an encoding end. The decoding end is used to decode the video stream, and the encoding end is used to encode the video stream. Figure 1 As shown, the embodiments of this application include 32 channels.

[0028] The platform initializes a local channel status table, which contains the channel number, occupancy status, associated device identifier, and video source information. This information is stored in a database cache with access control, which can only be read and written by authorized fusion service processes to prevent unauthorized tampering. The associated device identifier is used to identify the target device.

[0029] Understandably, the status includes available, occupied, and damaged. Available means the channel is idle, occupied means the channel is in use, and damaged indicates that the channel may be damaged.

[0030] The platform receives real-time channel status reports from the video isolation device's post-processing unit at preset intervals. When the post-processing unit reports, it must include its own hardware identifier and a preset device-level account password. The hardware identifier includes the channel's IP address. The platform verifies that the account password matches the locally stored hardware authorization list before receiving and processing the status data, including but not limited to availability, occupancy, fault, and associated device identifiers. It also synchronously updates the corresponding fields in the status table to ensure that the data in the table matches the hardware channel status.

[0031] When different users initiate the same video access request, and the access request includes user identity identifier, target device identifier, and video source information, the platform first authenticates the user identity and verifies whether the user account permissions match the access permissions of the target device. After successful authentication, the platform extracts the request information and compares it with the status table: if there is an occupied channel with "completely matching video source information", the channel is directly reused; if there is no matching item, the channel with the lowest load rate is selected from the "available" channels in the local channel status table for allocation.

[0032] Subsequently, the platform first sends the hardware-specific account and password to the post-processing unit of the video-type secure network isolation device. After the post-processing unit verifies the validity of the account and password, it receives the "channel occupancy command" sent by the fusion service and simultaneously marks the corresponding channel in the status table as "occupied". The post-processing unit updates the hardware channel status to "occupied". After the video viewing is completed, the fusion service verifies the user's identity and hardware account permissions again. After confirming that there are no errors, it sends the "channel release command" to restore the status table and hardware channel status to "available".

[0033] In some embodiments, each encoding or decoding board has 4 channels, and encoding or decoding boards with all 4 channels idle should be selected whenever possible.

[0034] Upon startup, the converged service establishes persistent connections with each channel. While a channel is idle, it also interacts with the converged service, reporting its status every 1-2 seconds. If no status is reported for more than 10 seconds, the converged service marks the channel as damaged and stops using it until the channel reports its status to the converged service again.

[0035] In some embodiments, the platform sets a password for each channel, which is a hardware-specific account password for each channel. The post-processing unit verifies the validity of the account password before accepting the channel occupancy command sent by the platform and changing the corresponding channel status to occupied.

[0036] Step 2: The video-based secure network isolation device includes a pre-processing unit and a post-processing unit. The pre-processing unit converts the device-side video stream into an analog signal and transmits it to the post-processing unit through the channel allocated to the user. The post-processing unit restores the analog signal to the original video stream, resamples it, and reorders the sampled data based on the dependencies between frames during video decoding. After receiving the reordered video frames, the pre-processing unit reassembles the video stream and sends the reassembled video stream to the platform for playback. Step 2 specifically includes: Step 2.1: The pre-processing unit first converts the device-side video stream into an AHD (Analog High Definition, a high-definition video standard based on analog transmission technology) analog signal, and transmits it to the post-processing unit through the channel allocated to the user in Step 1; The video stream can be in PS format, which is encapsulated based on RTP (Real-time Transport Protocol).

[0037] Step 2.2: The post-processing unit first restores the AHD analog signal to the original RTP video stream and temporarily stores it in the local hardware buffer.

[0038] Step 2.3: The post-processing unit sets a secondary sampling rule based on the original video stream frame rate and resolution. The secondary sampling rule is that the sampling frequency is a non-integer multiple of the original video stream frame rate, and the resolution is the same as the original video stream.

[0039] In this embodiment, the sampling frequency is configured as a non-integer multiple of the original frame rate to eliminate timing patterns, and the sampling accuracy is kept consistent with the original video stream to ensure lossless image quality.

[0040] Step 2.4: Perform secondary sampling on the original RTP video stream according to the set secondary sampling rules: extract pixel data frame by frame and skip redundant sampling points, reorder the sampled data to destroy the temporal characteristics of the original video stream, and then encapsulate the recombined data into the standard RTP format. The post-processing unit verifies the resolution, frame rate and other key parameters of the video stream before and after sampling. After confirming that the deviation is within an acceptable range, the sampled RTP video stream is sent to the platform. The hardware-level secondary sampling enhances the anti-network detection capability and ensures the security of cross-network video transmission.

[0041] RTP formats include, but are not limited to, compliant SSRC (Synchronization Source Identifier) ​​identifiers and timestamps.

[0042] Furthermore, the sampled data is reordered based on the frame dependencies of the video decoding.

[0043] Specifically, the frame dependencies in video encoding include key frames (I-frames) which can be decoded independently, and non-key frames (P / B-frames) which depend on I-frames or preceding P-frames for decoding. The specific steps for reordering are as follows: First, the original video stream is divided into multiple independent frame groups. Each independent frame group includes one I-frame and multiple P-frames and / or B-frames that depend on the I-frame. The I-frame is the group head of each independent frame group. The order of multiple P-frames and / or B-frames within each independent frame group is locally rearranged. At the same time, the RTP timestamp of each rearranged frame is offset by a preset non-fixed interval.

[0044] In this embodiment, by setting the I (Intra-coded frame) frame at a fixed position at the beginning of an independent frame group, it can be ensured that the decoding reference source is not lost. By rearranging the order of multiple P (Predicted frame) frames and / or B (Bidirectional frame) frames within the group and randomly offsetting the timestamps, the fixed timing pattern and timestamp increment characteristics relied upon by the network probe are disrupted. Furthermore, since the decoding dependency relationship within the frame group is not broken, the probability of the original stream being detected and identified is greatly reduced without affecting the viewing experience.

[0045] Furthermore, determining redundant sampling points includes: Calculate the static background block similarity between each P-frame or B-frame and the I-frame in each independent frame group; Calculate the intra-frame gradient values ​​in each independent frame group; Whether the P-frame or B-frame is a redundant sampling point is determined based on the intra-frame gradient value and / or the similarity of the static background block.

[0046] In this embodiment, pixels in the static background and smooth regions of the video that contribute little to the content expression are identified as redundant sampling points by using static background block similarity and intra-frame gradient values. These sampling points are skipped during secondary sampling, which can save bitrate and has no subjective damage, thereby further improving resource utilization.

[0047] Furthermore, the average static background block similarity between P-frames or B-frames and I-frames is calculated. When the average background block similarity is greater than a preset similarity threshold, the frame is determined as a redundant sampling point.

[0048] Furthermore, calculating the static background block similarity between each P-frame or B-frame and the I-frame in each independent frame group includes: Extract the first static background block in the I-frame; Extract the second static background block at the same coordinate position as the first static background block in the P-frame or B-frame and the I-frame, and calculate the similarity between the first static background block and the second static background block.

[0049] Specifically, extracting the first static background block in an I-frame includes dividing the I-frame into multiple non-overlapping frame blocks. For each frame block, the variance of the corresponding luminance component is calculated, and the frame block with a variance greater than a preset variance threshold is taken as the first static background block.

[0050] Specifically, the cosine similarity between the first static background block and the second static background block is calculated as the similarity between the first static background block and the second static background block.

[0051] Specifically, the sum of absolute errors between the first static background block and the second static background block is calculated, and the sum of absolute errors is normalized to a similarity score. The similarity score is obtained by subtracting the similarity score from 1.

[0052] The higher the similarity between the first static background block and the second static background block at the same location, the more similar the frame is to the I-frame at that background block location.

[0053] In this embodiment, block matching is performed only at the position corresponding to the background block of the I-frame, which reduces the amount of computation.

[0054] Specifically, determining whether a P-frame or B-frame is a redundant sampling point based on the intra-frame gradient value includes: Calculate the gradient value of each pixel in each independent frame; calculate the average gradient change of the P-frame or B-frame based on the gradient value of each pixel; when the average gradient change is less than the gradient change threshold time, the frame is identified as a redundant sampling point.

[0055] The gradient operator is used to calculate the horizontal and vertical gradients of each pixel. The gradient value of each pixel is obtained by calculating the square root of the sum of the squares of the horizontal and vertical gradients, or by calculating the sum of the absolute values ​​of the horizontal and vertical gradients.

[0056] It should be noted that the gradient operator can be either the Sobel operator or the Scharr operator, which are existing technologies. Calculating the horizontal and vertical gradients using the gradient operator is a current technique and will not be elaborated upon here.

[0057] Step 2.5: The preprocessing unit obtains frame groups according to I-frames, and reassembles the video stream within the frame groups according to the preset non-fixed interval offset and sends it to the platform for playback.

[0058] It can accurately reconstruct the video stream and decode and play it normally by using preset frame group identification rules (i.e., locating group boundaries by marking I-frames and using a timestamp calibration algorithm (i.e., restoring the true timing by offset range). This improves resistance to network detection and further enhances security.

[0059] Step 3: During video encoding, read the encoding identifier and frame rate from the video stream header, identify the encoding characteristics of the current video stream based on the encoding identifier and frame rate, determine the encoding format based on the encoding characteristics, and transmit the encoded video stream in segments.

[0060] Currently, the frame rate and encoding format are fixed. With the diversification of connected video devices, optimizations have been made to support a wider range of video encoding formats and adaptive frame rates. On the hardware side, through embedded development optimization, the encoding identifier and frame rate field exposed in the video stream header are read. Based on the extracted source information, a matching algorithm can be automatically invoked, and dynamic frame rate adjustment logic can be embedded. The integration services of the management information regional environment platform and the internet regional environment platform also need to be adapted. The core is a general process of first identifying the inherent characteristics of the encoding, then dynamically matching processing rules, and finally unifying transmission and encapsulation: First, the encoding characteristics of the current video stream are identified through dedicated logic, such as the differences in NALU (Network Abstraction Layer Unit) header structure and fragmentation rules of different encodings. Then, differentiated processing solutions are customized for these characteristics, including NALU fragmentation methods that adapt to encoding rules and RTP timestamp calculation logic that matches encoding timing requirements. At the same time, the packetization strategy is dynamically adjusted in combination with network transmission limitations, such as the maximum size of the RTP packet body corresponding to the MTU (Maximum Transmission Unit). Finally, video streams of different encoding formats are uniformly encapsulated into standard RTP packets for output. This not only adapts to the underlying differences of various encodings, but also ensures that the backend receiver can be universally parsed, realizing adaptive transmission across encoding formats.

[0061] Identify the encoding characteristics of the current video stream based on the encoding identifier and frame rate, and determine the encoding format based on these characteristics, including: A standardized feature library is constructed, in which pre-defined combination items are arranged according to two dimensions: encoding type and frame rate, and each combination item has corresponding encoding logic; After determining the encoding type based on the encoding identifier, the system searches for matching encoding logic in the standardized feature library based on the determined encoding type and frame rate, and then performs encoding according to the encoding format corresponding to the encoding logic.

[0062] Determining the frame rate involves either reading the frame rate field in the video stream header or calculating the RTP timestamp increment of three consecutive frames.

[0063] Specifically, a standardized feature library is built in the embedded hardware storage. The library contains pre-defined combinations based on the "encoding type - frame rate" dimension. The encoding type is locked by a unique identifier, including but not limited to H.264 corresponding to the NALU start code 0x000001, H.265 corresponding to the VPS header Type value 32, and AV1 corresponding to the OBU header type field 0x08. The frame rate is associated with feature parameters, including but not limited to 25fps corresponding to an RTP timestamp base increment of 3600, and 30fps corresponding to an increment of 3000. Each combination is bound to specific processing logic, including but not limited to H.264 + 25fps bound to the FU-A segmentation algorithm and frame interval compensation logic, and H.265 + 30fps bound to the AP segmentation algorithm and dynamic timestamp adjustment logic. During matching, the embedded hardware parsing module first extracts the encoding identifier from the video stream header to determine the encoding category, then locks the frame rate parameter by reading the frame rate field in the stream header or calculating the RTP timestamp increment of three consecutive frames, and finally locates the unique match in the feature library using "encoding identifier + frame rate" as the joint search key.

[0064] The encoding logic includes a target frame rate, obtaining the current actual frame rate, and if frame rate fluctuations exceeding a preset threshold for consecutive occurrences exceed a preset fluctuation threshold, fine-tuning the current actual frame rate based on the inter-frame timestamp increment to achieve the target frame rate. Specifically, this includes: The first step is automatic parsing, which involves reading the encoding parameters of the bitstream SPS (Sequence Parameter Set) or calculating the RTP timestamps of consecutive frames and combining them with the encoding clock frequency to infer the actual frame rate. The second step is dynamic matching. After parsing, the decoding rhythm and timestamp increment are adjusted synchronously. If the frame rate fluctuation exceeds 15% for three consecutive frames, a second parsing is triggered and fine-tuned.

[0065] The secondary parsing specifically includes collecting the RTP timestamps and SPS encoding parameters of the next 10 frames; calculating the frame interval timestamp increment; and fine-tuning the current frame rate using the frame interval timestamp increment. Fine-tuning specifically includes: Calculate the relative adjustment required between the current actual frame rate and the target frame rate, denoted as the fluctuation coefficient: K=|F_target-F_current| / F_current Where K represents the fluctuation coefficient, F_current represents the current frame rate, and F_target represents the target frame rate. A smaller fluctuation coefficient K indicates that the current frame rate is close to the target frame rate, requiring only minor adjustments—that is, only one or two stages of fine-tuning—to avoid stuttering from large adjustments. When the current frame rate differs significantly from the target frame rate, a larger adjustment is needed, gradually approaching the target through multiple stages of adjustment. Adjustment is stopped when the difference between the current frame rate and the target frame rate is ≤ 0.3fps (frame rate difference threshold).

[0066] The magnitude of adjustment at each stage is expressed by the following formula:

[0067] Where ΔF = F_target - F_current represents the difference between the current frame rate and the target frame rate, i represents the current adjustment stage, n is the number of adjustments, i.e. the total number of adjustment stages, and a represents the adjustment amplitude coefficient, which is used to control the amplitude of frame rate adjustment.

[0068] Specifically, the number of adjustments is calculated using the following formula: n = min (ceil ( 2 / (K + 0.05) ), 8 ), where ceil represents rounding and K represents the volatility coefficient.

[0069] Furthermore, the adjustment amplitude coefficient is calculated using the following formula: a = 1.4 + (0.4 × (1 - K / 0.3)). When K is very small, less than 0.3, it means that the amplitude of the adjustment sequence is larger, and the amplitude of the adjustment in the later stage is larger than that in the earlier stage. When K is very large, for example, greater than 0.3, the adjustment speed becomes smoother.

[0070] In this embodiment, by adjusting the number of times inversely proportional to the fluctuation coefficient, a dynamic strategy is achieved that allows for fine-tuning of small deviations and rapid adjustment of large deviations, thus balancing convergence speed and stability and flexibly responding to network fluctuation scenarios.

[0071] Compared to the fixed frame rate in existing technologies, this application dynamically adjusts the frame rate. When an anomaly is detected, instead of immediately adopting a new value, it re-collects data to confirm whether the frame rate fluctuation is temporary. If not, it triggers fine-tuning to smoothly transition the frame rate to the new frame rate parameter, avoiding instantaneous jumps. This not only improves the high-quality video playback experience but also increases resource utilization.

[0072] Different encoding formats correspond to different fragmentation methods. Encoding is performed according to the encoding format and the corresponding fragmentation method, followed by encapsulation. Each RTP packet must carry a timestamp, and the value of this timestamp is dynamically calculated based on the characteristics of the encoding format and the actual frame rate. Therefore, the result will vary in different scenarios. For example, H.264 encoding has a default clock frequency of 90kHz, meaning 1 second corresponds to 90,000 time units. When the video frame rate is 25 frames per second, the timestamp difference, or increment, between every two frames is 90,000 ÷ 25 = 3600. Therefore, the timestamp of the first RTP packet might be X, the second frame's is X + 3600, the third frame's is X + 7200, and so on.

[0073] Furthermore, the size of the video stream packet is adjusted according to the maximum transmission unit, and each video stream packet transmits multiple fragmented video streams.

[0074] Compared to existing technologies that use a fixed packet size, including but not limited to a uniform 1400 bytes, which does not adjust with changes in network MTU, resulting in large packets being discarded due to exceeding the MTU and small packets being excessively fragmented, wasting bandwidth and increasing video transmission latency, and using the same fragmentation logic for NALUs with different encodings, the receiving end needs to wait for all fragments to be reassembled, resulting in high latency, this solution dynamically calculates the upper limit of RTP packet size by detecting the MTU in real time. Small NALUs are transmitted directly as a whole, while large NALUs are fragmented and marked, including but not limited to fragments based on the total number of fragments and their sequence numbers, before being transmitted.

[0075] The initial baseline is the default maximum transmission unit (MTU) value for the corresponding network scenario, such as 1500 bytes. User datagram protocol probe packets with the "no fragmentation" flag are sent, and the packets are sent iteratively at ±50 bytes from the baseline. When an Internet Control Message Protocol (ICP) error message is received, the maximum acceptable length is extracted as the new baseline. The probe feedback is repeated until the probe packet is transmitted completely, and the real-time MTU value is determined.

[0076] More specifically, a three-layer decision is made based on the NALU size and the current effective MTU. When the current NALU size is less than the current effective MTU, the NALU is directly encapsulated into an RTP packet. When the current effective MTU is less than the current NALU size and is less than an integer multiple of the current effective MTU, a regular fragmentation strategy is used. When the current NALU size is greater than an integer multiple of the current effective MTU, the interval between two I-frames is reduced and / or the quantization step size of the encoder for the image block is reduced.

[0077] Specifically, the ratio of the difference between the current NALU size and an integer multiple of the current effective MTU to an integer multiple of the current effective MTU is calculated, and the interval between two I-frames is reduced and / or the quantization step size of the encoder for the image block is increased according to the ratio.

[0078] Specifically, reducing the interval between two I-frames according to the ratio is expressed as follows:

[0079] in, This indicates the new interval between the two I-frames after adjustment. This indicates the current interval or preset basic interval between two I-frames. This represents an adjustable coefficient, a configurable, positive constant used to control the sensitivity of the reduction. This represents the ratio of the difference between the current NALU size and an integer multiple of the current effective MTU to an integer multiple of the current effective MTU, i.e., the overshoot ratio.

[0080] In this embodiment, reducing the interval between I-frames when the NALU is very large fundamentally lowers the upper limit of the size of a single NALU, reduces the frequency of the occurrence of very large fragment packets, and reduces transmission latency and the maximum number of fragments.

[0081] Specifically, the quantization step size of the encoder for the image patch is increased by a ratio as follows:

[0082] in, This indicates the new quantization step size after adjustment. This indicates the preset basic quantization step size or the current quantization step size. This represents an adjustable coefficient, a configurable constant greater than 0, used to control the range of quantization step size variation.

[0083] In this embodiment, increasing the quantization step size when the NALU is very large can improve the compression ratio.

[0084] Specifically, setting a maximum increase in quantization and a minimum interval constrains the above adjustments to prevent excessively large quantization steps or excessively small intervals from leading to low efficiency and poor image quality.

[0085] In one embodiment, the management information regional environment platform integration service and the internet regional environment platform integration service are network isolated and cannot directly transmit data. The operation process is as follows: Video stream request transmission: The management area fusion service continuously receives channel status information reported by the video isolation device's post-processing unit through a preset timed mechanism and maintains a local channel status table in real time. When a user initiates a video retrieval request, the management area fusion service first compares the requested video source information with the associated information of occupied channels in the status table: if a completely matching occupied channel exists, the channel is directly reused; if no match exists, the optimal channel number is actively selected from the available channels recorded in the status table. After determining the channel, a video stream retrieval request containing the channel number is sent to the post-processing unit via SIP (Session Initiation Protocol).

[0086] The post-processing unit's response: The post-processing unit returns status information such as available channel numbers for use by the management information regional environment platform's fusion service. The management information regional environment platform's fusion service selects channels, choosing those that are available, and identifies whether a channel is idle, damaged, or occupied. Furthermore, videos of the same type will be distributed to different users.

[0087] Information retrieval and transmission: After the management regional platform confirms the availability of the selected channel based on the local status table, it generates a complete retrieval instruction in RESTFUL format and forwards it to the Internet regional fusion service through a logical information security isolation device. In addition to the selected channel number, the instruction also includes the unique identifier of the target device, the region code and device type, the playback format and content parameters, and SIP signaling permission verification information.

[0088] Video Stream Confirmation and Request: The Internet regional environment platform integration service first verifies the availability of the channel number in the local status table. After confirming that the platform device is available, it sends a video stream request to the front-end processing unit, along with SIP signaling and the channel number.

[0089] Video stream transmission: After successful processing, the pre-processing unit returns the SSRC (Synchronization Source) identification code of the RTP (Real-time Transport Protocol) video stream to the Internet regional environment platform fusion service. The platform then sends the RTP-encapsulated PS format video stream back to the pre-processing unit via TCP.

[0090] AHD High-Definition Analog Transmission Protocol: The video-based information security network isolation device adopts AHD (Analog High Definition) protocol. The front-end processing unit converts the RTP video stream into an analog signal before sending it to the back-end processing unit. Using analog signal transmission mode not only avoids the risk of malicious data contamination at the source but also lays the physical layer foundation for cross-network security protection. The management information regional environment platform's converged service sends the SSRC identification code of the TCP-RTP video stream to the back-end processing unit. While converting the analog signal back to RTP format, the back-end processing unit uses secure secondary sampling technology to eliminate the timing characteristics of the video stream, further enhancing its resistance to network probing, thus forming a secondary security barrier in the signal restoration stage. The RTP-encapsulated PS format video stream generated in the first sampling is converted into an AHD analog signal and transmitted to the post-processing unit via a hardware link. During the process of restoring the AHD analog signal to the original RTP digital stream, the post-processing unit simultaneously initiates a second sampling operation. Based on the frame rate and resolution of the first sampling, it sets sampling rules and configures the sampling frequency to a non-integer multiple of the first sampling frame rate to break the fixed timing cycle. Then, it extracts pixel data frame by frame, skipping some redundant sampling points, and reorders the pixel data according to a storage logic different from the first sampling, disrupting the intra-frame timing distribution pattern. Finally, it adds a new SSRC identification code and timestamp to encapsulate the data into the standard RTP format. This entire process eliminates the original timing characteristics of the video stream, preventing network probing tools from identifying the video stream transmission logic through timing information such as frame rate period and pixel arrangement patterns, further enhancing its resistance to network probing. All these operations are completed in the signal restoration stage of the post-processing unit, essentially adding extra security protection at the critical node of signal conversion from analog to digital, ultimately forming a secondary security barrier.

[0091] Video stream returns to the management platform: The RTP-encapsulated PS format video stream, after secondary sampling, is transmitted back to the management information regional fusion service via TCP. Finally, the management information regional environment platform fusion service transmits the video stream to the post-processing unit via TCP, completing the secure cross-network transmission of the video stream.

[0092] This application employs strict isolation between the management information zone and the internet zone, preventing direct data interaction and effectively blocking the cross-network spread of malicious data. Simultaneously, a channel reuse mechanism improves resource utilization, and combined with real-time maintenance of the channel status table by the management zone, it enables automatic avoidance of faulty channels and selection of optimal channels, enhancing transmission stability. These multiple mechanisms not only ensure network security on both sides and prevent data leakage, but also optimize resource allocation and reliability, meeting the requirements for continuous low-latency video streaming. Embodiment 2 of this application provides a cross-network video secure transmission system, including a platform, a device, a video-based information security network isolation device, and a logical information security network isolation device. The logical information security network isolation device is used to send a video access request from the platform to the device. The video-based secure network isolation device is used to transmit the video stream from the device to the platform based on the video access request to complete the access. The system further includes: A cross-network video secure transmission device, the device being used to implement the cross-network video secure transmission method of Embodiment 1 above, the device comprising: The channel allocation module is used to establish a local channel status table on the platform side. After obtaining the user's video access request, it determines whether the same video stream information is being transmitted based on the video access request and the local channel status table. If so, the channel transmitting the same video stream information is allocated to the user. Otherwise, the channel with the lowest load rate is selected from the available channels and allocated to the user. The sampling module is used to restore the analog signal to the original video stream and then resample it, and to reorder the sampled data based on the dependency relationship between frames during video decoding; wherein, the video-type secure network isolation device includes a pre-processing unit and a post-processing unit. The pre-processing unit converts the device-side video stream into an analog signal and transmits it to the post-processing unit through the channel allocated to the user. The post-processing unit transmits the analog signal to the sampling module, and the sampling frequency of the resampling is a non-integer multiple of the original video stream frame rate; The video reassembly module is used to reassemble the video stream after the preprocessing unit receives the reordered video frames, and then send the reassembled video stream to the platform for playback.

[0093] Regarding the system in the above embodiments, the specific manner in which each unit performs operations has been described in detail in the embodiments related to the method, and will not be elaborated here.

[0094] Embodiment 3 of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements the cross-network video secure transmission method described in Embodiment 1.

[0095] Embodiment 4 of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the cross-network video secure transmission method according to Embodiment 1.

[0096] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0097] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application and not to limit them. Although this application has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of this application. Any modifications or equivalent substitutions that do not depart from the spirit and scope of this application should be covered within the protection scope of the claims of this application.

Claims

1. A method for secure cross-network video transmission, applied to a cross-network secure video transmission system, the system comprising a platform, a device, a video-based secure network isolation device, and a logical secure network isolation device, wherein the logical secure network isolation device is used to send a video access request from the platform to the device, and the video-based secure network isolation device is used to transmit the video stream from the device to the platform based on the video access request to complete access, characterized in that... The method includes: The platform establishes a local channel status table to obtain users' video access requests; Based on the video access request and the local channel status table, determine whether the same video stream information is being transmitted. If so, allocate the channel transmitting the same video stream information to the user; otherwise, select the channel with the lowest load rate from the available channels and allocate it to the user. The video-based secure network isolation device includes a pre-processing unit and a post-processing unit. The pre-processing unit converts the device-side video stream into an analog signal and transmits it to the post-processing unit through a channel allocated to the user. The post-processing unit restores the analog signal to the original video stream and resamples it. It then reorders the sampled data based on the dependency relationship between frames during video decoding. The resampling frequency is a non-integer multiple of the original video stream frame rate. After receiving the reordered video frames, the preprocessing unit reassembles the video stream and sends the reassembled video stream to the platform for playback.

2. The cross-network video secure transmission method according to claim 1, characterized in that: The dependencies between frames during video decoding include key frames (I-frames) which can be encoded independently, while non-key frames (P-frames or B-frames) require I-frames or preceding P-frames for decoding. The reordering of the data based on these dependencies includes: The original video stream is divided into multiple independent frame groups. Each independent frame group includes one I-frame and multiple P-frames and / or B-frames that depend on the I-frame. The I-frame is the group head of each independent frame group. The order of multiple P-frames and / or B-frames within each independent frame group is locally rearranged. At the same time, the RTP timestamp of each rearranged frame is offset by a preset non-fixed interval.

3. The cross-network video secure transmission method according to claim 2, characterized in that: The method further includes: Calculate the static background block similarity between each P-frame or B-frame and the I-frame in each independent frame group, and calculate the intra-frame gradient value in each independent frame group; Determine whether a P-frame or B-frame is a redundant sampling point based on the intra-frame gradient value and / or the similarity of static background blocks, and delete the redundant sampling points.

4. The cross-network video secure transmission method according to claim 3, characterized in that: Calculating the static background block similarity between each P-frame and I-frame in each independent frame group includes: Extract the first static background block in the I-frame; Extract the second static background block at the same coordinate position as the first static background block in the P-frame and the I-frame, and calculate the similarity between the first static background block and the second static background block.

5. The cross-network video secure transmission method according to claim 4, characterized in that: Extracting the first static background block in an I-frame includes: The I-frame is divided into multiple non-overlapping frame blocks. For each frame block, the variance of the corresponding luminance component is calculated, and the frame block with a variance greater than a preset variance threshold is taken as the first static background block.

6. The cross-network video secure transmission method according to claim 1, characterized in that: The method further includes: During video encoding, the encoding identifier and frame rate in the video stream header are read, the encoding characteristics of the current video stream are identified based on the encoding identifier and frame rate, and the encoding format is determined based on the encoding characteristics. Specifically, a standardized feature library is constructed, in which pre-set combination items are defined according to two dimensions: encoding type and frame rate. Each combination item has corresponding encoding logic. After determining the encoding type based on the encoding identifier, the matching encoding logic is searched in the standardized feature library according to the determined encoding type and frame rate, and then encoded according to the encoding format corresponding to the encoding logic. After being encoded according to the encoding format, it is transmitted based on a preset dynamic fragmentation method.

7. The cross-network video secure transmission method according to claim 6, characterized in that: The encoding logic includes a target frame rate, obtaining the current actual frame rate, and if the frame rate fluctuation exceeds a preset fluctuation threshold for consecutive times, fine-tuning the current actual frame rate based on the inter-frame timestamp increment to achieve the target frame rate.

8. The cross-network video secure transmission method according to claim 7, characterized in that: The current actual frame rate is fine-tuned based on the inter-frame timestamp increment to achieve the target frame rate, as expressed below: in, This represents the difference between the current actual frame rate and the target frame rate. i indicates which adjustment stage is being performed. a represents the adjustment magnitude coefficient, used to control the magnitude of the frame rate adjustment. K represents the fluctuation coefficient, which is the relative magnitude of the adjustment that the current actual frame rate needs to be relative to the target frame rate. n is the total number of adjustment stages. n = min (ceil ( 2 / (K + 0.05) ), 8 ) , where ceil() represents rounding.

9. The cross-network video secure transmission method according to claim 6, characterized in that: Transmission based on a preset dynamic fragmentation method includes: When the current NALU size is less than the current effective MTU, the NALU will be directly encapsulated into an RTP packet; When the current effective MTU is less than the current NALU size and is less than or equal to an integer multiple of the current effective MTU, the current NALU size is divided by the current effective MTU size to obtain the number of fragments, and fragmented transmission is performed according to the number of fragments. When the current NALU size is greater than an integer multiple of the current effective MTU, reduce the interval between two I-frames and / or reduce the quantization step size of the encoder for image blocks to reduce the NALU size.

10. A cross-network video secure transmission system, comprising a platform end, a device end, a video-based information security network isolation device, and a logical information security network isolation device, wherein the logical information security network isolation device is used to send a video access request from the platform end to the device end, and the video-based secure network isolation device is used to transmit the video stream from the device end to the platform end based on the video access request to complete the access, characterized in that... The system also includes: A cross-network video secure transmission device, the device being used to implement the cross-network video secure transmission method according to any one of claims 1 to 9, the device comprising: The channel allocation module is used to establish a local channel status table on the platform side. After obtaining the user's video access request, it determines whether the same video stream information is being transmitted based on the video access request and the local channel status table. If so, the channel transmitting the same video stream information is allocated to the user. Otherwise, the channel with the lowest load rate is selected from the available channels and allocated to the user. The sampling module is used to restore the analog signal to the original video stream and then resample it, and to reorder the sampled data based on the dependency relationship between frames during video decoding; wherein, the video-type secure network isolation device includes a pre-processing unit and a post-processing unit. The pre-processing unit converts the device-side video stream into an analog signal and transmits it to the post-processing unit through the channel allocated to the user. The post-processing unit transmits the analog signal to the sampling module, and the sampling frequency of the resampling is a non-integer multiple of the original video stream frame rate; The video reassembly module is used to reassemble the video stream after the preprocessing unit receives the reordered video frames, and then send the reassembled video stream to the platform for playback.

11. An electronic device, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the steps of the cross-network video secure transmission method according to any one of claims 1-9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the cross-network video secure transmission method according to any one of claims 1-9.

Images