A method and system for secure switching of downstream in an isolated environment

Abstract

The present application provides a method and system for secure exchange of data streams in an isolated environment. The method implements security protection for the entire process from collecting multimedia data to performing cross-domain isolated exchange and then outputting it to the client, thereby ensuring the reliability and security of data stream exchange.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security, and in particular to a method and system for secure flow exchange in an isolated environment. Background Art

[0002] With the rapid development of technologies such as big data, 5G, and the Internet of Things, a large number of continuous, rapidly generated, and unpredictable data flows have appeared on the network. In order to achieve cross-network, cross-system, and cross-domain big data security sharing, there is an urgent need for flow exchange in the current isolated environment.

[0003] However, how to exchange streams reliably and securely has become an urgent problem to be solved. Summary of the invention

[0004] In order to solve the above technical problems, the embodiment of the present application provides a method and system for secure exchange of stream data in an isolated environment, so as to achieve the purpose of ensuring efficient, reliable and secure exchange of stream data. The technical solution is as follows:

[0005] A method for secure exchange of streams in an isolated environment, comprising:

[0006] The stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data;

[0007] The stream sending proxy server determines the integrity verification data of the multimedia data, performs slice processing on the serialized data including the integrity verification data and the multimedia data to obtain a plurality of data stream slices, and performs security operation processing on the data stream slices to obtain security summary data;

[0008] The stream sending proxy server sends the data stream fragments and the security summary data to the cryptographic isolation switching gateway;

[0009] The cryptographic isolation exchange gateway performs security operation verification on the security summary data, and after the security operation verification passes, sends the data stream fragments to the stream security exchange server;

[0010] The stream security exchange server receives the data stream fragment, parses the data stream fragment to obtain the multimedia data and the stream authentication information, updates and maintains the stream authentication evidence based on the stream authentication information, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area;

[0011] The stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, outputs the multimedia data to the client.

[0012] Optionally, performing security operation processing on the data stream slices to obtain security summary data includes:

[0013] Performing HMAC calculation on the data stream fragments to obtain summary data;

[0014] The cryptographic isolation switching gateway performs security operation verification on the security summary data, including:

[0015] The cryptographic isolation switching gateway performs HMAC verification on the summary data.

[0016] Optionally, the method further includes:

[0017] The stream security exchange management platform collects the security audit information of the stream sending proxy server, the password isolation exchange gateway, the stream security exchange server and the stream receiving proxy server, and displays, manages and stores the security audit information.

[0018] Optionally, the method further includes:

[0019] The stream security exchange management platform manages all user information and role information in the front-end subsystem connected to the stream sending proxy server and isolates operations between the roles.

[0020] Optionally, the method further includes:

[0021] The stream security exchange management platform monitors the operating status of the stream sending proxy server, the password isolation exchange gateway, the stream security exchange server and the stream receiving proxy server, as well as the operation log of the login account.

[0022] A stream security exchange system in an isolated environment, comprising: a stream sending proxy server, a password isolation exchange gateway, a stream security exchange server, a stream receiving proxy server and a stream security exchange management platform;

[0023] The stream sending proxy server is used to collect multimedia data, add stream authentication information to the multimedia data, and determine the integrity verification data of the multimedia data, slice the serialized data containing the integrity verification data and the multimedia data to obtain multiple data stream slices, perform security calculation processing on the data stream slices to obtain security summary data, and send the data stream slices and the security summary data to the cryptographic isolation switching gateway;

[0024] The cryptographic isolation exchange gateway is used to perform security operation verification on the security summary data, and after the security operation verification is passed, send the data stream fragments to the stream security exchange server;

[0025] The stream security exchange server is used to receive the data stream fragments, parse the data stream fragments to obtain the multimedia data and the stream authentication information, update and maintain the stream authentication evidence based on the stream authentication information, generate multimedia data authentication evidence, and send the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area;

[0026] The stream receiving proxy server is configured to receive the multimedia data and the multimedia data authentication evidence, and output the multimedia data to the client after verifying the integrity of the multimedia data based on the multimedia data authentication evidence;

[0027] The stream security exchange management platform is used to manage the stream sending proxy server, the stream security exchange server and the stream receiving proxy server.

[0028] Optionally, the stream sending proxy server is specifically used to: perform HMAC calculation on the data stream fragments to obtain summary data;

[0029] The password isolation switching gateway is specifically used for:

[0030] Perform HMAC verification on the summary data.

[0031] Optionally, the flow security exchange management platform is specifically used for:

[0032] The security audit information of the stream sending proxy server, the password isolation switching gateway, the stream security switching server and the stream receiving proxy server is collected, and the security audit information is displayed, managed and stored.

[0033] Optionally, the stream security exchange management platform is further used for:

[0034] Manage all user information and role information in the front-end subsystem connected to the stream sending proxy server and isolate operations between the roles.

[0035] Optionally, the flow security exchange management platform is specifically used for:

[0036] Monitor the operating status of the stream sending proxy server, the password isolation switching gateway, the stream security switching server and the stream receiving proxy server, as well as the operation log of the login account.

[0037] Compared with the prior art, the beneficial effects of this application are:

[0038] In the present application, the stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data, determines the integrity verification data of the multimedia data, slices the serialized data containing the integrity verification data and the multimedia data to obtain multiple data stream slices, performs security calculations on the data stream slices to obtain security summary data, sends the data stream slices and the security summary data to the cryptographic isolation switching gateway, and the cryptographic isolation switching gateway performs security calculation verification on the security summary data. After the security calculation verification passes, the data stream slices are sent to the stream security switching server, and the stream security switching server sends the data stream slices to the stream security switching server. The exchange server receives the data stream fragments, parses the data stream fragments to obtain the multimedia data and the stream authentication information, updates the maintained stream authentication evidence, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area. The stream receiving proxy server receives the data stream fragments and the multimedia data authentication evidence, and after verification based on the multimedia data authentication evidence, outputs the multimedia data to the client, thereby achieving security protection for the entire process from collecting multimedia data to performing cross-domain isolated exchange and then outputting it to the client, thereby ensuring the reliability and security of data stream exchange. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0040] Figure 1 This is a flow chart of Example 1 of a method for secure exchange of streams in an isolated environment provided by the present application;

[0041] Figure 2 It is a schematic diagram of a sharding process provided by this application;

[0042] Figure 3 This is a flow chart of Example 2 of a method for secure exchange of streams in an isolated environment provided by the present application;

[0043] Figure 4 This is a flowchart of Example 3 of a method for secure exchange of streams in an isolated environment provided by the present application;

[0044] Figure 5 This is a flowchart of Example 4 of a method for secure exchange of streams in an isolated environment provided by the present application;

[0045] Figure 6This is a flowchart of Example 5 of a method for secure exchange of streams in an isolated environment provided by the present application;

[0046] Figure 7 It is a structural diagram of a downstream secure switching system in an isolated environment provided by the present application;

[0047] Figure 8 It is a structural schematic diagram of another downstream secure switching system in an isolated environment provided by the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] like Figure 1 The flowchart shown is a flow chart of Embodiment 1 of a method for secure exchange of streams in an isolated environment provided by the present application. The method may include the following steps:

[0051] Step S11: The stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data.

[0052] The streaming proxy server in the first area collects multimedia data, which may include:

[0053] S1101. The stream sending proxy server in the first area starts the acquisition proxy main program and automatically requests the acquisition proxy configuration parameters from the stream security exchange management platform.

[0054] After receiving the request from the stream sending proxy server in the first area, the stream security exchange management platform verifies whether the stream sending proxy server in the first area is a registered legal device. If the verification is successful, the verification success information and related configuration parameters are sent to the stream sending proxy server in the first area, and the stream sending proxy server in the first area is marked as ready on the stream security exchange management platform.

[0055] S1102: After receiving the verification success information, the stream sending proxy server in the first area first queries the configuration parameters of the front-end device (such as NVR device) to which the stream sending proxy server is connected from the acquired configuration information, and establishes a connection channel between the stream sending proxy server and the front-end device (1 or more).

[0056] S1103, the stream sending proxy server in the first area queries the multimedia channel status in the front-end device from the configuration information, starts a multi-thread task for the opened channel, and obtains parameter information about the channel, the parameter information including the type of streaming media protocol connected to the channel, the channel number, etc. One thread is responsible for establishing, maintaining, and canceling a streaming media channel.

[0057] S1104, the stream sending proxy server in the first area starts a monitoring process and receives channel operation instruction information from the front-end management system. When a new channel opening instruction is received, a new thread is started to maintain a channel. When a channel termination or cancellation instruction is received, the stream sending proxy server in the first area is responsible for terminating or canceling the thread maintaining the channel.

[0058] S1105: When the channel is successfully established, multimedia data from the channel is obtained.

[0059] Multimedia data may include, but is not limited to, audio data and / or video data.

[0060] Step S12: the stream sending proxy server determines the integrity verification data of the multimedia data, slices the serialized data including the integrity verification data and the multimedia data to obtain multiple data stream slices, and performs security calculations on the data stream slices to obtain security summary data.

[0061] In this embodiment, the stream sending proxy server determines the integrity verification data of the multimedia data, and performs fragmentation processing on the serialized data including the integrity verification data and the multimedia data to obtain multiple data stream fragments, which may include:

[0062] After obtaining the multimedia data, the integrity verification data of the multimedia data must be calculated first because the loss of the multimedia data will cause output problems (for example, video frame data is the smallest unit of the video stream, and the loss or tampering of the video frame data will cause the video to be unable to play or the video content to be distorted).

[0063] After calculating the integrity verification data of the multimedia data, for the convenience of transmission, a data structure object can be encapsulated, and the multimedia attribute data (such as PTS, DTS, FLAGS, DURATION, POS, etc. of the video), multimedia data, and integrity verification data are assigned to the structure object, and the structure object is serialized to obtain binary serialized data. If the binary serialized data is less than 1400 bytes, the binary serialized data is sent as an independent data packet. If the binary serialized data is larger than 1400 bytes, the binary serialized data is segmented to obtain multiple data stream segments.

[0064] Serialization can be understood as the process of converting objects in the program content into a form that can be stored or transmitted, while the properties and other values ​​of the objects remain unchanged during the conversion process.

[0065] Taking video data as an example, the serialized data including the integrity verification data and the multimedia data is sliced ​​to obtain multiple data stream slices for illustration. Figure 2 As shown, after the integrity verification data of the video frame I is determined, the integrity verification data and the video frame I are serialized, and the serialized data is fragmented to obtain multiple data stream fragments.

[0066] Step S13: The stream sending proxy server sends the data stream fragments and the security summary data to the cryptographic isolation switching gateway.

[0067] Step S14: The cryptographic isolation switching gateway performs security operation verification on the security summary data, and after the security operation verification passes, sends the data stream fragments to the stream security switching server.

[0068] Step S15: The stream security exchange server receives the data stream fragments, parses the data stream fragments to obtain the multimedia data and the stream authentication information, updates and maintains the stream authentication evidence based on the stream authentication information, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area.

[0069] Updating the flow authentication evidence based on the flow authentication information may include:

[0070] If the multimedia data is obtained by establishing a connection for the first time, an authentication tree is constructed;

[0071] If the multimedia data is not obtained by establishing a connection for the first time, the authentication tree is updated and maintained.

[0072] In this embodiment, generating multimedia data authentication evidence may include:

[0073] Get the index value of the video, call the verification evidence generation algorithm, and generate authentication evidence of the corresponding data according to the index value of the input leaf node.

[0074] The index value of the data stream shard is the number used during communication, and the index value of the leaf node is the number of the authentication tree leaf node in the stream authentication algorithm. The index value of the data stream shard is different from the index value of the leaf node and does not affect each other.

[0075] Step S16: the stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, outputs the multimedia data to the client.

[0076] In this embodiment, the stream receiving proxy server receiving the multimedia data and the multimedia data authentication evidence may include:

[0077] S1601, the stream receiving proxy server monitors a local UDP port and prepares to receive data;

[0078] S1602, when receiving the task list sent from the stream security exchange server, first determine whether there is an idle thread in the local task thread pool, if there is an idle thread, activate the thread, if there is no idle thread, create a new thread, use thread reuse, and avoid frequent thread creation;

[0079] S1603: Determine whether the task list contains a data part.

[0080] If the data portion is included, execute step S1604.

[0081] S1604: Write the multimedia data and multimedia data authentication evidence of the data part into the cache queue for use by the data processing thread.

[0082] In this embodiment, verifying the integrity of the multimedia data based on the multimedia data authentication evidence may include:

[0083] S1605, calling a data integrity verification algorithm to calculate a hash value of a leaf node corresponding to the multimedia data in the authentication tree;

[0084] S1606, according to the node hash value information in the authentication path in the authentication tree, sequentially calculate and derive the hash value of the parent node of the leaf node corresponding to the data stream shard, until finally calculating the trapdoor hash value of the root node;

[0085] S1607. Compare the calculated root node trapdoor hash value with the root node trapdoor hash value in the multimedia data authentication evidence. If the values ​​are equal, the verification succeeds, otherwise the verification fails.

[0086] In this embodiment, the stream receiving proxy server outputs the multimedia data to the client and the stream security exchange management platform, and the multimedia data can be stored on the stream security exchange management platform to implement the live broadcast or playback function on the stream security exchange management platform. For example, after receiving the video frame data, the stream receiving proxy server can push the video data to the streaming media server. In the process of providing the RTMP streaming media protocol live broadcast to the outside world, the streaming media server also dumps the video data into an MP4 file for persistent storage.

[0087] In the present application, the stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data, determines the integrity verification data of the multimedia data, slices the serialized data containing the integrity verification data and the multimedia data to obtain multiple data stream slices, performs security calculations on the data stream slices to obtain security summary data, sends the data stream slices and the security summary data to the cryptographic isolation switching gateway, and the cryptographic isolation switching gateway performs security calculation verification on the security summary data. After the security calculation verification passes, the data stream slices are sent to the stream security switching server, and the stream security switching server sends the data stream slices to the stream security switching server. The exchange server receives the data stream fragments, parses the multimedia data and the stream authentication information from the data stream fragments, updates the maintained stream authentication evidence, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area. The stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verification based on the multimedia data authentication evidence, outputs the multimedia data to the client, thereby achieving security protection for the entire process from collecting multimedia data to performing cross-domain isolated exchange and then outputting it to the client, thereby ensuring the reliability and security of data stream exchange.

[0088] As another optional embodiment of the present application, refer to Figure 3 , is a flow chart of a method for secure exchange of streams in an isolated environment provided by the present application. This embodiment is mainly a detailed solution of the method for secure exchange of streams in an isolated environment described in the above embodiment 1. Figure 3 As shown, the method may include but is not limited to the following steps:

[0089] Step S21: The stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data.

[0090] Step S22: The stream sending proxy server determines the integrity verification data of the multimedia data, slices the serialized data including the integrity verification data and the multimedia data to obtain multiple data stream slices, and performs HMAC calculation on the data stream slices to obtain summary data.

[0091] Performing HMAC calculation on the data stream fragments to obtain summary data can be understood as: HMAC uses a Hash-based Message Authentication Code (Hash-based Message Authentication Code) algorithm to calculate a key and the data stream fragments to obtain summary data.

[0092] Step S22 is a specific implementation of step S12 in Example 1.

[0093] Step S23: The stream sending proxy server sends the data stream fragments and the security summary data to the cryptographic isolation switching gateway.

[0094] Step S24: the cryptographic isolation switching gateway performs HMAC verification on the summary data. After the verification is passed, the multimedia data in the data stream fragment is integrity verified based on the complete verification data in the data stream fragment. After the integrity verification is passed, the data stream fragment is sent to the stream security switching server.

[0095] Step S24 is a specific implementation of step S14 in Example 1.

[0096] Step S25: the stream security exchange server receives the data stream fragments, parses the data stream fragments to obtain the multimedia data and the stream authentication information, updates and maintains the stream authentication evidence based on the stream authentication information, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area.

[0097] Step S26: the stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, outputs the multimedia data to the client.

[0098] As another optional embodiment of the present application, refer to Figure 4 , is a flow chart of a method for secure exchange of upstream flows in an isolated environment provided by the present application. This embodiment is mainly an extension of the method for secure exchange of downstream flows in an isolated environment described in the above embodiment 1. Figure 4 As shown, the method may include but is not limited to the following steps:

[0099] Step S31: The stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data.

[0100] Step S32: the stream sending proxy server determines the integrity verification data of the multimedia data, slices the serialized data including the integrity verification data and the multimedia data to obtain multiple data stream slices, and performs security calculations on the data stream slices to obtain security summary data.

[0101] Step S33: The stream sending proxy server sends the data stream fragments and the security summary data to the cryptographic isolation switching gateway.

[0102] Step S34: The cryptographic isolation switching gateway performs security operation verification on the security summary data, and after the security operation verification passes, sends the data stream fragments to the stream security switching server.

[0103] Step S35: The stream security exchange server receives the data stream fragments, parses the data stream fragments to obtain the multimedia data and the stream authentication information, updates and maintains the stream authentication evidence based on the stream authentication information, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area.

[0104] Step S36: The stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, outputs the multimedia data to the client.

[0105] The detailed process of steps S31-S36 can refer to the relevant introduction of steps S11-S16 in Example 1, which will not be repeated here.

[0106] Step S37, the stream security exchange management platform collects the security audit information of the stream sending proxy server, the password isolation exchange gateway, the stream security exchange server and the stream receiving proxy server, and displays, manages and stores the security audit information.

[0107] The flow security exchange management platform collects the security audit information of the flow sending proxy server, the cryptographic isolation switching gateway, the flow security exchange server and the flow receiving proxy server, and displays, manages and stores the security audit information to ensure the effectiveness of the management of the flow sending proxy server, the cryptographic isolation switching gateway, the flow security exchange server and the flow receiving proxy server.

[0108] As another optional embodiment of the present application, refer to Figure 5, is a flow chart of a method for secure exchange of upstream flows in an isolated environment provided by the present application. This embodiment is mainly an extension of the method for secure exchange of downstream flows in an isolated environment described in the above embodiment 1. Figure 5 As shown, the method may include but is not limited to the following steps:

[0109] Step S41: The stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data.

[0110] Step S42: the stream sending proxy server determines the integrity verification data of the multimedia data, slices the serialized data including the integrity verification data and the multimedia data to obtain multiple data stream slices, and performs security calculations on the data stream slices to obtain security summary data.

[0111] Step S43: The stream sending proxy server sends the data stream fragments and the security summary data to the cryptographic isolation switching gateway.

[0112] Step S44: The cryptographic isolation switching gateway performs security operation verification on the security summary data, and after the security operation verification passes, sends the data stream fragments to the stream security switching server.

[0113] Step S45: the stream security exchange server receives the data stream fragments, parses the data stream fragments to obtain the multimedia data and the stream authentication information, updates and maintains the stream authentication evidence based on the stream authentication information, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area.

[0114] Step S46: the stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, outputs the multimedia data to the client.

[0115] The detailed process of steps S41-S46 can refer to the relevant introduction of steps S11-S16 in Example 1, which will not be repeated here.

[0116] Step S47: The stream security exchange management platform manages all user information and role information in the front-end subsystem connected to the stream sending proxy server and isolates operations between the roles.

[0117] In this embodiment, the stream security exchange management platform manages all user information and role information in the front-end subsystem connected to the stream sending proxy server and isolates operations between the roles, thereby ensuring the security of the stream sending proxy server and the front-end subsystem connected to it.

[0118] As another optional embodiment of the present application, refer to Figure 6 , is a flow chart of a method for secure exchange of upstream flows in an isolated environment provided by the present application. This embodiment is mainly an extension of the method for secure exchange of downstream flows in an isolated environment described in the above embodiment 1. Figure 6 As shown, the method may include but is not limited to the following steps:

[0119] Step S51: The stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data.

[0120] Step S52: the stream sending proxy server determines the integrity verification data of the multimedia data, slices the serialized data including the integrity verification data and the multimedia data to obtain multiple data stream slices, and performs security calculations on the data stream slices to obtain security summary data.

[0121] Step S53: The stream sending proxy server sends the data stream fragments and the security summary data to the cryptographic isolation switching gateway.

[0122] Step S54: The cryptographic isolation switching gateway performs security operation verification on the security summary data, and after the security operation verification passes, sends the data stream fragments to the stream security switching server.

[0123] Step S55: The stream security exchange server receives the data stream fragment, parses the data stream fragment to obtain the multimedia data and the stream authentication information, updates and maintains the stream authentication evidence based on the stream authentication information, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area.

[0124] Step S56: the stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, outputs the multimedia data to the client.

[0125] The detailed process of steps S51-S56 can refer to the relevant introduction of steps S11-S16 in Example 1, which will not be repeated here.

[0126] Step S57, the stream security exchange management platform monitors the operating status of the stream sending proxy server, the password isolation exchange gateway, the stream security exchange server and the stream receiving proxy server, as well as the operation log of the login account.

[0127] The login account can be understood as: an account for logging into the stream sending proxy server, the stream security interaction server, or the stream receiving proxy server.

[0128] In this embodiment, the flow security exchange management platform can ensure the effectiveness of the management of the flow sending proxy server, the password isolation switching gateway, the flow security exchange server and the flow receiving proxy server by monitoring the operating status of the flow sending proxy server, the password isolation switching gateway, the flow security exchange server and the flow receiving proxy server, as well as the operation log of the login account.

[0129] Next, the downstream secure switching system in an isolated environment provided by the present application is introduced. The downstream secure switching system in an isolated environment introduced below and the downstream secure switching method in an isolated environment introduced above can refer to each other.

[0130] See also Figure 7 The flow security exchange system in an isolated environment includes: a flow sending proxy server 100, a cryptographic isolation exchange gateway 200, a flow security exchange server 300, a flow receiving proxy server 400 and a flow security exchange management platform 500.

[0131] The stream sending proxy server 100 is used to collect multimedia data, add stream authentication information to the multimedia data, and determine the integrity verification data of the multimedia data, slice the serialized data containing the integrity verification data and the multimedia data to obtain multiple data stream slices, perform security operations on the data stream slices to obtain security summary data, and send the data stream slices and the security summary data to the cryptographic isolation switching gateway 200.

[0132] The cryptographic isolation exchange gateway 200 is used to perform security operation verification on the security summary data, and after the security operation verification is passed, send the data stream fragments to the stream security exchange server 300.

[0133] The stream security exchange server 300 is used to receive the data stream fragments, parse the data stream fragments to obtain the multimedia data and the stream authentication information, and update and maintain the stream authentication evidence based on the stream authentication information, generate multimedia data authentication evidence, and send the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server 400 in the second area.

[0134] The stream receiving proxy server 400 is used to receive the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, output the multimedia data to the client.

[0135] The stream security exchange management platform 500 is used to manage the stream sending proxy server 100 , the stream security exchange server 300 and the stream receiving proxy server 400 .

[0136] It should be noted that different stream sending proxy servers 100 and stream receiving proxy servers 400 need to be set up for different regions. Among them, different stream security exchange servers 300 can be set up for different regions, such as Figure 8 Of course, different areas can also share a stream security exchange server 300.

[0137] In this embodiment, the stream sending proxy server 100 can be specifically used to: perform HMAC calculation on the data stream fragments to obtain summary data;

[0138] Accordingly, the password isolation switching gateway 200 can be specifically used for:

[0139] Perform HMAC verification on the summary data.

[0140] In this embodiment, the flow security switching management platform 500 can be specifically used for:

[0141] The security audit information of the stream sending proxy server 100, the password isolation switching gateway 200, the stream security switching server 300 and the stream receiving proxy server 400 is collected, and the security audit information is displayed, managed and stored. It should be noted that in the isolated environment, the audit information of the stream sending proxy server 100 is not directly sent to the stream security switching management platform 500, but must be forwarded to the stream security switching management platform 500 through the password isolation switching gateway 200.

[0142] In this embodiment, the flow security switching management platform 500 can also be used for:

[0143] Manage all user information and role information in the front-end subsystem connected to the stream sending proxy server 100 and isolate operations between the roles.

[0144] In this embodiment, the flow security switching management platform 500 can be specifically used for:

[0145] Monitor the operating status of the stream sending proxy server 100, the password isolation switching gateway 200, the stream security switching server 300 and the stream receiving proxy server 400, as well as the operation log of the login account.

[0146] It should be noted that each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0147] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0148] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0149] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0150] The above is a detailed introduction to a method and system for secure exchange of upstream flows in an isolated environment provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for secure switching of streams in an isolated environment, characterized in that: include: The stream sending proxy server in the first area collects multimedia data and adds stream authentication information to the multimedia data; The stream sending proxy server determines the integrity verification data of the multimedia data, performs slice processing on the serialized data including the integrity verification data and the multimedia data to obtain a plurality of data stream slices, and performs security operation processing on the data stream slices to obtain security summary data; The stream sending proxy server sends the data stream fragments and the security summary data to the cryptographic isolation switching gateway; The cryptographic isolation exchange gateway performs security operation verification on the security summary data, and after the security operation verification passes, sends the data stream fragments to the stream security exchange server; The stream security exchange server receives the data stream fragment, parses the data stream fragment to obtain the multimedia data and the stream authentication information, updates and maintains the stream authentication evidence based on the stream authentication information, generates multimedia data authentication evidence, and sends the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area; The stream receiving proxy server receives the multimedia data and the multimedia data authentication evidence, and after verifying the integrity of the multimedia data based on the multimedia data authentication evidence, outputs the multimedia data to the client.

2. The method according to claim 1, characterized in that: The performing security operation processing on the data stream slices to obtain security summary data includes: Performing HMAC calculation on the data stream fragments to obtain summary data; The cryptographic isolation switching gateway performs security operation verification on the security summary data, including: The cryptographic isolation switching gateway performs HMAC verification on the summary data.

3. The method according to claim 1, characterized in that The method further comprises: The flow security exchange management platform collects the security audit information of the flow sending proxy server, the password isolation exchange gateway, the flow security exchange server and the flow receiving proxy server, and displays, manages and stores the security audit information.

4. The method according to claim 1, characterized in that: The method further comprises: The stream security exchange management platform manages all user information and role information in the front-end subsystem connected to the stream sending proxy server and isolates operations between the roles.

5. The method according to claim 1, characterized in that The method further comprises: The stream security exchange management platform monitors the running status of the stream sending proxy server, the password isolation exchange gateway, the stream security exchange server and the stream receiving proxy server, as well as the operation log of the login account.

6. A secure downstream switching system in an isolated environment, characterized in that: include: Stream sending proxy server, password isolation switching gateway, stream security switching server, stream receiving proxy server and stream security switching management platform; The stream sending proxy server is used to collect multimedia data, add stream authentication information to the multimedia data, and determine the integrity verification data of the multimedia data, slice the serialized data containing the integrity verification data and the multimedia data to obtain multiple data stream slices, perform security calculation processing on the data stream slices to obtain security summary data, and send the data stream slices and the security summary data to the cryptographic isolation switching gateway; The cryptographic isolation exchange gateway is used to perform security operation verification on the security summary data, and after the security operation verification is passed, send the data stream fragments to the stream security exchange server; The stream security exchange server is used to receive the data stream fragments, parse the data stream fragments to obtain the multimedia data and the stream authentication information, update and maintain the stream authentication evidence based on the stream authentication information, generate multimedia data authentication evidence, and send the multimedia data and the multimedia data authentication evidence to the stream receiving proxy server in the second area; The stream receiving proxy server is configured to receive the multimedia data and the multimedia data authentication evidence, and output the multimedia data to the client after verifying the integrity of the multimedia data based on the multimedia data authentication evidence; The stream security exchange management platform is used to manage the stream sending proxy server, the stream security exchange server and the stream receiving proxy server.

7. The system according to claim 6, characterized in that The stream sending proxy server is specifically used to: perform HMAC calculation on the data stream fragments to obtain summary data; The password isolation switching gateway is specifically used for: Perform HMAC verification on the summary data.

8. The system according to claim 6, characterized in that The flow security exchange management platform is specifically used for: The security audit information of the stream sending proxy server, the password isolation switching gateway, the stream security switching server and the stream receiving proxy server is collected, and the security audit information is displayed, managed and stored.

9. The system according to claim 6, characterized in that The flow security exchange management platform is also used for: Manage all user information and role information in the front-end subsystem connected to the stream sending proxy server and isolate operations between the roles.

10. The system according to claim 6, characterized in that The flow security exchange management platform is specifically used for: Monitor the operating status of the stream sending proxy server, the password isolation switching gateway, the stream security switching server and the stream receiving proxy server, as well as the operation log of the login account.

Images