A Method and System for Verifying the KDM Production Model Based on the National Cryptography Algorithm

Abstract

The embodiments of the present invention disclose a method and system for verifying a KDM production model based on a national secret algorithm. The method first verifies that a KDM file generated by a KDM production model based on an internationally accepted cryptographic algorithm is correct. The method then compares the decryption results of KDM files generated by the internationally accepted cryptographic algorithm and the KDM production model based on the national secret algorithm. If the decryption results match, the KDM file generated by the KDM production model based on the national secret algorithm is determined to be correct. This method effectively verifies the correctness of KDM files generated by the KDM production model based on the national secret algorithm.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of digital film technology, and in particular to a KDM production model verification method and system based on a national secret algorithm. Background Art

[0002] As the film industry transitioned from the film era to the digital age, the DCI mandated that digital films must be encrypted for distribution to regulate the development of digital cinema. Film content is encrypted using the AES symmetric encryption algorithm, and the content key is then transmitted to authorized theaters using a Key Delivery Message (KDM). As a key technology for transmitting film encryption keys, KDM has attracted the attention of domestic scholars. KDM, or Key Delivery Message, is an XML file defined based on an Extra-Theater Message (ETM). KDM production models based on internationally accepted cryptographic algorithms utilize the commonly used public-key cryptography algorithm RSA. RSA's security comes at the expense of encryption and decryption speed, so the high security and speed of the RSA algorithm cannot be achieved simultaneously. KDM production models based on the national secret algorithm (SM2) improve the efficiency of individual KDM production while also enabling independent control of encryption and decryption algorithms in the film industry. Since KDMs used by existing projection equipment are all generated using internationally accepted cryptographic algorithms, the KDM files generated by the national secret algorithm cannot be verified for accuracy on existing projection equipment. Summary of the Invention

[0003] To this end, an embodiment of the present invention provides a KDM production model verification method and system based on the national secret algorithm to solve the problem that existing projection equipment cannot verify the correctness of the KDM file generated by the KDM production model based on the national secret algorithm.

[0004] In order to achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0005] According to a first aspect of an embodiment of the present invention, a KDM production model verification method based on a national secret algorithm is proposed, the method comprising:

[0006] Importing the encrypted film and a first KDM file generated by a KDM production model based on an internationally accepted cryptographic algorithm into a film projection device to play the encrypted film; if the playback is successful, determining that the first KDM file is correct; if the playback fails, determining that the first KDM file is incorrect;

[0007] Decrypt and parse the generated correct first KDM file using the RSA private key to obtain first plaintext data;

[0008] Use the SM2 private key to decrypt and parse the second KDM file generated by the KDM production model based on the national secret algorithm to obtain the second plaintext data;

[0009] The second plaintext data is compared with the first plaintext data. If they are consistent, the second KDM file generated by the KDM production model based on the national encryption algorithm is judged to be correct. If they are inconsistent, the second KDM file generated by the KDM production model based on the national encryption algorithm is judged to be incorrect.

[0010] Furthermore, the method further comprises:

[0011] Encrypt and package the video to generate the mother KDM and encrypted video;

[0012] According to the mother KDM, the first KDM file is generated using a KDM production model based on an internationally common cryptographic algorithm.

[0013] Furthermore, the method further comprises:

[0014] According to the mother KDM, the second KDM file is generated using a KDM production model based on a national encryption algorithm.

[0015] Furthermore, the first plaintext data and the second plaintext data include a fixed value, a composite playlist UUID, a content key type, a content key UUID, and an AES program key.

[0016] Furthermore, the second KDM file is generated using a KDM production model based on a national encryption algorithm, specifically including:

[0017] Generate the public part of KDM, including: parsing the mother KDM file to obtain basic information of the film and content key; parsing the national secret certificate of the KDM producer and the national secret certificate of the projection equipment to obtain the KDM signer information and KDM receiver information; generating basic KDM information;

[0018] Generating the KDM private part includes: parsing the mother KDM file to determine whether the mother KDM file is encrypted using the national secret SM2 algorithm; if so, decrypting the mother KDM file using the national secret SM2 algorithm to obtain an AES program key; if not, decrypting the mother KDM file using the RSA algorithm to obtain the AES program key; parsing the producer's national secret certificate to obtain a signer certificate fingerprint; sequentially concatenating a fixed value with the obtained signer certificate fingerprint, basic film information, basic content key information, and the AES program key to generate a concatenated string; and then encrypting the concatenated string using the national secret encryption algorithm SM2 to obtain the ciphertext in the private part;

[0019] Generate the KDM signature part, including: using the producer's SM2 private key to calculate the signature value using the SM2 signature algorithm based on the obtained KDM public part and KDM private part; parsing the producer's national secret certificate chain to obtain the producer's national secret certificate chain information; splicing the obtained signature value and the producer's national secret certificate chain information to obtain the KDM signature part.

[0020] Furthermore, the basic information of the movie includes the movie name and the synthetic playlist UUID, the basic information of the content key includes the content key type and the content key UUID, and the basic information of the KDM includes the KDM UUID, the KDM release time, the KDM start time and the end time.

[0021] Furthermore, the film is encrypted and packaged to generate a mother KDM and an encrypted film, specifically including: using a professional film packaging tool to encrypt and package the film.

[0022] According to a second aspect of an embodiment of the present invention, a KDM production model verification system based on a national secret algorithm is proposed, the system comprising:

[0023] a first KDM file verification module, configured to import the encrypted film and the first KDM file generated by the KDM production model based on the international general cryptographic algorithm into a film projection device to play the encrypted film; if the playback is successful, the first KDM file is determined to be correct; if the playback fails, the first KDM file is determined to be incorrect;

[0024] A first KDM file decryption module is used to decrypt and parse the generated correct first KDM file using an RSA private key to obtain first plaintext data;

[0025] A second KDM file decryption module is used to use the SM2 private key to decrypt and parse the second KDM file generated by the KDM production model based on the national secret algorithm to obtain second plaintext data;

[0026] The second KDM file verification module is used to compare the second plaintext data with the first plaintext data. If they are consistent, it is judged that the second KDM file generated by the KDM production model based on the national encryption algorithm is correct; if they are inconsistent, it is judged that the second KDM file generated by the KDM production model based on the national encryption algorithm is incorrect.

[0027] According to a third aspect of an embodiment of the present invention, a computer storage medium is proposed, which contains one or more program instructions, and the one or more program instructions are used to be executed by a KDM production model verification system based on a national secret algorithm to perform any of the methods described above.

[0028] The embodiments of the present invention have the following advantages:

[0029] The present invention proposes a method and system for verifying a KDM production model based on a national cryptographic algorithm. The method first verifies that a KDM file generated by a KDM production model based on an internationally accepted cryptographic algorithm is correct. The method then compares the decryption results of KDM files generated using the internationally accepted cryptographic algorithm and the national cryptographic algorithm. If the decryption results match, the KDM file generated by the national cryptographic algorithm is considered correct. This method effectively verifies the correctness of KDM files generated by the national cryptographic algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other implementation drawings based on the provided drawings without inventive effort.

[0031] Figure 1 A flowchart of a KDM production model verification method based on a national encryption algorithm provided in Example 1 of the present invention;

[0032] Figure 2 A detailed implementation flow chart of a KDM production model verification method based on a national encryption algorithm provided in Example 1 of the present invention;

[0033] Figure 3 This is a workflow diagram of a KDM production model based on a national secret algorithm in a KDM production model verification method based on a national secret algorithm provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0034] The following describes the implementation of the present invention using specific embodiments. Those skilled in the art will readily understand the other advantages and benefits of the present invention from the disclosure herein. Obviously, the embodiments described are only a portion of the present invention, not all of it. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0035] Example 1

[0036] like Figure 1 and Figure 2 As shown, this embodiment proposes a KDM production model verification method based on the national secret algorithm, which includes:

[0037] S100: Import the encrypted film and the first KDM file generated by the KDM production model based on the international general cryptographic algorithm into a film projection device to play the encrypted film. If the playback is successful, it is determined that the first KDM file is correct; if the playback fails, it is determined that the first KDM file is incorrect.

[0038] Furthermore, the method further comprises:

[0039] Encrypt and package the video to generate the mother KDM and encrypted video;

[0040] According to the mother KDM, a first KDM file is generated using a KDM production model based on an internationally common cryptographic algorithm.

[0041] In this embodiment, a professional movie packaging tool such as Clipster is used to encrypt and package the movie.

[0042] S200: Use the RSA private key to decrypt and parse the generated correct first KDM file to obtain first plaintext data.

[0043] The correct first KDM file generated above is decrypted and parsed using the RSA private key, and 8 field values are obtained (as shown in Table 2 below): Structure ID (fixed value), Certificate Thumbprint (signer certificate fingerprint), CompositionPlaylistId (composition playlist UUID), KeyType (content key type), KeyId (content key UUID), Not Valid Before (content key start time), Not Valid After (content key end time), AES Content Decryption Key (AES program key).

[0044] Furthermore, the method also includes: generating a second KDM file according to the mother KDM using a KDM production model based on a national encryption algorithm.

[0045] S300: Use the SM2 private key to decrypt and parse the second KDM file generated by the KDM production model based on the national secret algorithm to obtain second plaintext data.

[0046] S400. Compare the second plaintext data with the first plaintext data. If they are consistent, it is determined that the second KDM file generated by the KDM production model based on the national encryption algorithm is correct. If they are inconsistent, it is determined that the second KDM file generated by the KDM production model based on the national encryption algorithm is incorrect.

[0047] In this embodiment, the first plaintext data and the second plaintext data include a fixed value, a composite playlist UUID, a content key type, a content key UUID, and an AES program key.

[0048] Compare the values of the eight fields in the first plaintext data and the second plaintext data. If the values of the five fields, Structure ID (fixed value), CompositionPlaylistId (composition playlist UUID), KeyType (content key type), KeyId (content key UUID), and AES Content Decryption Key (AES program key), are equal, then the second KDM file is correct, otherwise it is wrong.

[0049] KDM, Key Delivery Message, is an XML file defined based on the Extra-Theater Message (ETM), which mainly includes the following three basic information: the content key of the composition play list CPL (CPL); content key parameters - mainly the date / time window for key use; trusted device list (TDL), which specifies the devices allowed to use the content key.

[0050] A KDM file consists of three parts: a public portion, a private portion, and a signed portion. The public portion primarily describes basic KDM file information, such as the KDM identifier, KDM issuer information, KDM recipient information, film title, playlist identifier, and KDM validity period. This information allows users to initially verify the KDM's validity. The private portion contains key KDM file information, such as the AES program key and the signer's certificate fingerprint, which is used by receiving devices to decrypt and play the DCP. The signed portion describes the KDM file's digital signature information, such as the signature value and the signer's certificate chain. This allows receiving devices to verify the KDM's source and trust the received KDM.

[0051] In this embodiment, Figure 3 As shown, the second KDM file is generated using the KDM production model based on the national secret algorithm, which specifically includes the following steps:

[0052] Generate the public part of KDM, including: parsing the mother KDM file to obtain basic information of the film and content key; parsing the national secret certificate of the KDM producer and the national secret certificate of the projection equipment to obtain the KDM signer information and KDM receiver information; generating basic KDM information;

[0053] Generating the KDM private part includes: parsing the mother KDM file to determine whether the mother KDM file is encrypted using the national secret SM2 algorithm. If so, decrypting the mother KDM file using the national secret SM2 algorithm to obtain the AES program key; if not, decrypting the mother KDM file using the RSA algorithm to obtain the AES program key; parsing the producer's national secret certificate to obtain the signer certificate fingerprint; sequentially concatenating the fixed value with the obtained signer certificate fingerprint, basic film information, basic content key information, and AES program key to generate a concatenated string, and then encrypting the concatenated string using the national secret encryption algorithm SM2 to obtain the ciphertext in the private part;

[0054] Generate the KDM signature part, including: using the producer's SM2 private key to calculate the signature value using the SM2 signature algorithm based on the obtained KDM public part and KDM private part; parsing the producer's national secret certificate chain to obtain the producer's national secret certificate chain information; splicing the obtained signature value and the producer's national secret certificate chain information to obtain the KDM signature part.

[0055] The basic information of the movie includes the movie name and the composite playlist UUID. The basic information of the content key includes the content key type and the content key UUID. The basic information of the KDM includes the KDM UUID, the KDM release time, the KDM start time (UTC format) and the end time (UTC format).

[0056] Specifically, the fixed value StructureID is sequentially concatenated with the obtained signer certificate fingerprint, synthetic playlist UUID, content key type, content key UUID, KDM start time, KDM end time, and AES program key to generate a concatenated string.

[0057] The SM2 algorithm is an elliptic curve cryptography (ECC) algorithm developed in my country based on advanced international research and possesses independent intellectual property rights. This algorithm recommends a 256-bit curve as the standard curve. The algorithm standard primarily includes a digital signature algorithm, a key exchange protocol, and a public key encryption algorithm. The SM2 digital signature algorithm involves the signer signing data using their private key, and the verifier verifying the signature using the signer's public key to ensure the authenticity of the signature. The SM2 key exchange protocol involves two users using their private keys and the other party's public key to agree on a session key known only to them. The SM2 public key encryption algorithm involves the sender encrypting data using the receiver's public key, and the receiver decrypting the ciphertext using their private key.

[0058] Compared with the RSA algorithm, the SM2 algorithm has the following advantages:

[0059] High security: The 256-bit SM2 algorithm has a cryptographic strength exceeding RSA-2048.

[0060] Short key: The key length used by the SM2 algorithm is generally 256 bits, while the RSA algorithm usually requires 2048 bits.

[0061] Fast signing speed: Under the same security strength, the SM2 signature algorithm is more efficient than the RSA signature algorithm.

[0062] The SM3 algorithm, also known as a hash algorithm, generates a 256-bit hash value, also known as a "digital fingerprint," after padding and iteratively compressing a message of a certain length. Changing any character in the message will also change the corresponding hash value. The SM3 algorithm is commonly used for digital signatures and data integrity protection.

[0063] Furthermore, based on the obtained KDM public portion and KDM private portion, the maker's SM2 private key is used to calculate a signature value using the SM2 signature algorithm. Specifically, the obtained KDM public portion and KDM private portion are each normalized, and digest values are calculated using the SM3 algorithm on the normalized contents. The obtained digest values are then normalized again and then calculated using the SM2 signature algorithm to obtain a signature value. In this embodiment, C14n normalization is used.

[0064] Digital signature technology is an extension of asymmetric cryptographic algorithms. Digital signatures, also known as public-key digital signatures, are implemented using asymmetric cryptographic algorithms. The issuer encrypts information using the public key, resulting in a ciphertext known as the signature value. The recipient verifies the signature value using their private key. If verification is successful, it proves the source of the information is trustworthy. To increase signing speed, digital signature technology generally signs a digest of the information. This involves first performing a hash operation on the information to obtain a hash value, which is then encrypted using the public key. The digital signature technology in this embodiment uses sm2sign-with-sm3. This method first uses the hash algorithm SM3 to calculate the digest value of the information, which is then encrypted using the SM2 signature algorithm to obtain the signature value. The recipient verifies the signature value using their private key. If verification is successful, the recipient then uses the hash algorithm SM3 to calculate the digest value of the received information. This digest value is then compared with the digest value in the signature portion of the file. If the two values are identical, the information has not been tampered with. The application of digital signature technology ensures the integrity and authenticity of information during transmission.

[0065] In this embodiment, the KDM producer's national secret certificate and the projection equipment's national secret certificate are both national secret x509 certificates.

[0066] A digital certificate is essentially a technology that verifies the legitimacy of a public key. It binds personal information to a public key and has its legitimacy verified by an authoritative organization. A digital certificate primarily includes public key information, personal information such as name, organization, email address, and address, and a digital signature from a certification authority (CA). An x509 digital certificate includes information such as version number, serial number, signature algorithm, issuer, subject, validity period, public key information, and signature value. This example uses the open-source cryptographic toolbox GmSSL to generate a nationally encrypted x509 certificate. The nationally encrypted digital certificate uses the SM2-256 encryption algorithm and the sm2sign-with-sm3 signature algorithm.

[0067] The specific contents of the national secret x509 digital certificate used in this embodiment are shown in Table 1 below:

[0068]

[0069] The method of this embodiment generates a KDM file, and the specific implementation process is as follows:

[0070] 1. Public part

[0071] The public part of KDM, namely the label <authenticatedpublic>This tag mainly includes: MessageId (KDM identifier), MessageType (message type), IssueDate (movie release date), Signer (KDM file signer information), Recipient (KDM file recipient information), CompositionPlaylistId (UUID of the CPL file in the movie distribution package), ContentTitleText (movie name), ContentKeysNotValidBefore (content key start time), ContentKeysNotValidAfter (content key end time), KeyType (content key type), KeyId (content key UUID) and other sub-tags.

[0072] According to the KDM production model based on the national secret algorithm, the implementation process of the KDM public part is as follows:

[0073] 1.1 Parse the parent KDM to obtain CompositionPlaylistId, ContentTitleText, KeyType, and KeyId;

[0074] 1.2 Analyze the producer's national secret digital certificate and obtain the Signer value;

[0075] 1.3 parse the recipient's national secret digital certificate to obtain the Recipient value;

[0076] 1.4 Method automatically generates MessageId and IssueDate,

[0077] 1.5 The MessageType value in this method is fixed:

[0078] http: / / www.smpte-ra.org / 430-1 / 2006 / KDM#kdm-key-type;

[0079] 1.6ContentKeysNotValidBefore and ContentKeysNotValidAfter are defined by the method user, and the method converts them to UTC time.

[0080] 2. Private part

[0081] KDM private part, that is, the label <authenticatedprivate>Part, this tag mainly includes EncryptionMethod (content key encryption algorithm) and CipherData (encrypted data).

[0082] According to the KDM production model based on the national secret algorithm, the implementation process of the KDM private part is as follows:

[0083] 2.1 The value of EncryptionMethod in this method is:

[0084] "http: / / www.w3.org / 2001 / 04 / xmlenc#SM2";

[0085] 2.2 The CipherData value in this method is the ciphertext BASE64 value obtained by encrypting the concatenated string of the eight fields in Table 2 using the SM2 encryption algorithm, where:

[0086] The Structure ID is a fixed value: f1.dc.12.44.60.16.9a.0e.85.bc.30.06.42.f8.66.ab;

[0087] The Certificate Thumbprint value is parsed from the signer's national encryption certificate;

[0088] CompositionPlaylistId, KeyType, and KeyId values are parsed from the parent KDM;

[0089] Not Valid Before and Not Valid After are customized by the method user, and the method converts them to UTC time format;

[0090] The AES Content Decryption Key value is obtained by decrypting the mother KDM using the SM2 private key.

[0091] Table 2 Plaintext data of CipherData

[0092]

[0093] 3. Signature

[0094] KDM signature part, that is, the tag <signature>This tag mainly includes CanonicalizationMethod (canonicalization method), SignatureMethod (signature algorithm), DigestMethod (digest algorithm), DigestValue (digest value), SignatureValue (signature value), KeyInfo (public key information), and X509Data (x509 certificate data).

[0095] According to the KDM production model based on the national secret algorithm, the implementation process of the KDM private part is as follows:

[0096] 3.1 The CanonicalizationMethod value in this method is:

[0097] "http: / / www.w3.org / TR / 2001 / REC-xml-c14n-20010315#WithComments";

[0098] 3.2 SignatureMethod values are:

[0099] "http: / / www.w3.org / 2001 / 04 / xmldsig-more#SM3WithSM2";

[0100] 3.3 The DigestMethod value is "http: / / www.w3.org / 2001 / 04 / xmlenc#SM3";

[0101] 3.4 DigestValue is: c14n normalize the part to be calculated, and then use the SM3 algorithm to calculate the digest value of the normalized content;

[0102] 3.5 The SignatureValue value is: c14n normalize the summary part, and then use the SM2 signature algorithm to calculate the signature value;

[0103] 3.6 The KeyInfo value is used to parse the producer's signature certificate chain and obtain the signature certificate chain information;

[0104] 3.7 The X509Data value is the information of each certificate in the signature certificate chain.

[0105] In order to prove that the generation efficiency of the KDM production model based on the national secret algorithm is higher than that of the KDM production model based on the international general cryptographic algorithm, this embodiment statistically analyzes and compares the time for producing KDM by the two models, with the statistical dimensions being 1, 100, 1000, 3000, and 5000 respectively. The experimental environment is shown in Table 3, and the experimental results are shown in Table 4.

[0106] Table 3 Experimental environment

[0107]

[0108] Table 4. Time for generating KDM based on the national secret algorithm and the international general cryptographic algorithm (unit: seconds)

[0109]

[0110]

[0111] The results in Table 4 show that the KDM production model based on the national secret algorithm is more efficient than the KDM production model based on the international general cryptographic algorithm. To further analyze the KDM production model based on the national secret algorithm and the international general cryptographic algorithm, this example compares the decryption algorithm, encryption algorithm, and digital signature algorithm involved in the model. The results are shown in Tables 5 and 6.

[0112] Table 5 KDM generation time based on the national secret algorithm KDM production model (unit: seconds)

[0113]

[0114] Table 6 KDM generation time based on the KDM production model of the international common cryptographic algorithm (unit: seconds)

[0115]

[0116] From the above experimental comparison results, it can be found that the KDM production model based on the national encryption algorithm is more efficient than the KDM production model based on the international general encryption algorithm.

[0117] This embodiment proposes a method for verifying a KDM production model based on a national cryptographic algorithm. The method first verifies that the KDM file generated by the KDM production model based on the international general cryptographic algorithm is correct. The method then compares the decryption results of the KDM files generated using the international general cryptographic algorithm and the KDM production model based on the national cryptographic algorithm. If the decryption results match, the KDM file generated by the KDM production model based on the national cryptographic algorithm is considered correct. This method effectively verifies the correctness of the KDM file generated by the KDM production model based on the national cryptographic algorithm.

[0118] Example 2

[0119] Corresponding to the above-mentioned embodiment 1, this embodiment proposes a KDM production model verification system based on the national secret algorithm, the system comprising:

[0120] a first KDM file verification module, configured to import the encrypted film and the first KDM file generated by the KDM production model based on the international general cryptographic algorithm into a film projection device to play the encrypted film; if the playback is successful, the first KDM file is determined to be correct; if the playback fails, the first KDM file is determined to be incorrect;

[0121] A first KDM file decryption module is used to decrypt and parse the generated correct first KDM file using the RSA private key to obtain first plaintext data;

[0122] A second KDM file decryption module is used to use the SM2 private key to decrypt and parse the second KDM file generated by the KDM production model based on the national secret algorithm to obtain second plaintext data;

[0123] The second KDM file verification module is used to compare the second plaintext data with the first plaintext data. If they are consistent, it is judged that the second KDM file generated by the KDM production model based on the national encryption algorithm is correct; if they are inconsistent, it is judged that the second KDM file generated by the KDM production model based on the national encryption algorithm is wrong.

[0124] The functions performed by each component in the KDM production model verification system based on the national secret algorithm provided by the embodiment of the present invention have been introduced in detail in the above embodiment 1, so they will not be elaborated here.

[0125] Example 3

[0126] Corresponding to the above embodiment, this embodiment proposes a computer storage medium, which contains one or more program instructions, and the one or more program instructions are used to be executed by a KDM production model verification system based on a national secret algorithm as the method of Example 1.

[0127] Although the present invention has been described in detail above using general descriptions and specific embodiments, it will be apparent to those skilled in the art that modifications and improvements may be made thereto. Therefore, such modifications and improvements, without departing from the spirit of the present invention, are intended to be within the scope of protection claimed herein.< / signature> < / authenticatedprivate> < / authenticatedpublic>

Claims

1. A KDM production model verification method based on the national secret algorithm, characterized in that: The method comprises: Importing the encrypted film and a first KDM file generated by a KDM production model based on an internationally accepted cryptographic algorithm into a film projection device to play the encrypted film; if the playback is successful, determining that the first KDM file is correct; if the playback fails, determining that the first KDM file is incorrect; Decrypt and parse the generated correct first KDM file using the RSA private key to obtain first plaintext data; Use the SM2 private key to decrypt and parse the second KDM file generated by the KDM production model based on the national secret algorithm to obtain the second plaintext data; Comparing the second plaintext data with the first plaintext data, if they are consistent, determining that the second KDM file generated by the KDM production model based on the national secret algorithm is correct; if they are inconsistent, determining that the second KDM file generated by the KDM production model based on the national secret algorithm is incorrect; The method further comprises: Encrypt and package the video to generate the mother KDM and encrypted video; According to the mother KDM, the first KDM file is generated using a KDM production model based on an internationally accepted cryptographic algorithm. The method further includes: According to the master KDM, the second KDM file is generated using a KDM production model based on a national secret algorithm; The second KDM file is generated using a KDM production model based on a national secret algorithm, specifically including: Generate the public part of KDM, including: parsing the mother KDM file to obtain basic information of the film and content key; parsing the national secret certificate of the KDM producer and the national secret certificate of the projection equipment to obtain the KDM signer information and KDM receiver information; generating basic KDM information; Generating the KDM private part includes: parsing the mother KDM file to determine whether the mother KDM file is encrypted using the national secret SM2 algorithm; if so, decrypting the mother KDM file using the national secret SM2 algorithm to obtain an AES program key; if not, decrypting the mother KDM file using the RSA algorithm to obtain the AES program key; parsing the producer's national secret certificate to obtain a signer certificate fingerprint; sequentially concatenating a fixed value with the obtained signer certificate fingerprint, basic film information, basic content key information, and the AES program key to generate a concatenated string; and then encrypting the concatenated string using the national secret encryption algorithm SM2 to obtain the ciphertext in the private part; Generate the KDM signature part, including: using the producer's SM2 private key to calculate the signature value using the SM2 signature algorithm based on the obtained KDM public part and KDM private part; parsing the producer's national secret certificate chain to obtain the producer's national secret certificate chain information; splicing the obtained signature value and the producer's national secret certificate chain information to obtain the KDM signature part.

2. A KDM production model verification method based on a national secret algorithm according to claim 1, characterized in that: The first plaintext data and the second plaintext data include a fixed value, a composite playlist UUID, a content key type, a content key UUID, and an AES program key.

3. A KDM production model verification method based on a national secret algorithm according to claim 1, characterized in that: The basic information of the movie includes the movie name and the synthetic playlist UUID, the basic information of the content key includes the content key type and the content key UUID, and the basic information of the KDM includes the KDM UUID, the KDM release time, the KDM start time and the end time.

4. A KDM production model verification method based on a national secret algorithm according to claim 1, characterized in that: Encrypt and package the film to generate the master KDM and encrypted film, specifically including: using professional film packaging tools to encrypt and package the film.

5. A KDM production model verification system based on the national secret algorithm, characterized in that: The system includes: a first KDM file verification module, configured to import an encrypted film and a first KDM file generated using a KDM production model based on an internationally accepted cryptographic algorithm into a film projection device to play the encrypted film; if playback is successful, the first KDM file is determined to be correct; if playback fails, the first KDM file is determined to be incorrect; generating the first KDM file includes: encrypting and packaging the film to generate a master KDM and the encrypted film; and generating the first KDM file based on the master KDM using a KDM production model based on an internationally accepted cryptographic algorithm; The first KDM file decryption module is used to use the RSA private key to decrypt and parse the generated correct first KDM file to obtain the first plaintext data; the second KDM file decryption module is used to use the SM2 private key to decrypt and parse the second KDM file generated by the KDM production model based on the national secret algorithm to obtain the second plaintext data; the second KDM file generation includes: generating the second KDM file according to the mother KDM using the KDM production model based on the national secret algorithm; generating the second KDM file using the KDM production model based on the national secret algorithm specifically includes: generating the KDM public part, including: parsing the mother KDM file to obtain basic information of the film and basic information of the content key; parsing the national secret certificate of the KDM producer and the national secret certificate of the projection equipment to obtain KDM signer information and KDM receiver information; generating KDM basic information; generating the KDM private part, including: parsing the mother KDM file, Determine whether the mother KDM file is encrypted using the national secret SM2 algorithm. If so, use the national secret SM2 algorithm to decrypt the mother KDM file to obtain the AES program key. If not, use the RSA algorithm to decrypt the mother KDM file to obtain the AES program key; parse the producer's national secret certificate to obtain the signer certificate fingerprint; sequentially concatenate the fixed value with the obtained signer certificate fingerprint, basic information of the film, basic information of the content key, and the AES program key to generate a concatenation string, and then encrypt the concatenation string using the national secret encryption algorithm SM2 to obtain the ciphertext in the private part; generate the KDM signature part, including: calculating the signature value using the producer's SM2 private key using the SM2 signature algorithm based on the obtained KDM public part and KDM private part; parsing the producer's national secret certificate chain to obtain the producer's national secret certificate chain information; and concatenating the obtained signature value with the producer's national secret certificate chain information to obtain the KDM signature part; The second KDM file verification module is used to compare the second plaintext data with the first plaintext data. If they are consistent, it is judged that the second KDM file generated by the KDM production model based on the national encryption algorithm is correct; if they are inconsistent, it is judged that the second KDM file generated by the KDM production model based on the national encryption algorithm is incorrect.

6. A computer storage medium, characterized in that The computer storage medium contains one or more program instructions, and the one or more program instructions are used to be executed by a KDM production model verification system based on a national secret algorithm to perform the method described in any one of claims 1 to 4.

Images