A protocol intercommunication method and device, and video monitoring system

Abstract

The present invention discloses a protocol intercommunication method and device, and a video monitoring system, wherein the protocol intercommunication method includes protocol intercommunication between a first ONVIF protocol module of an upper-level platform and a second ONVIF protocol module of a front-end device based on a private key of the upper-level platform, a public key of the upper-level platform, a certificate of the upper-level platform, a certificate key of the upper-level platform, a private key of a front-end device, a public key of the front-end device, a certificate key of the front-end device, and a certificate of the front-end device; and protocol intercommunication between a first GB28181 protocol module of an upper-level platform and a second GB28181 protocol module of a front-end device based on a private key of the upper-level platform, a public key of the upper-level platform, a symmetric encryption key, a private key of a front-end device, and a public key of a front-end device. This technical solution only integrates a general interconnection protocol, and at the same time also ensures the transmission security of the general interconnection protocol, effectively saves system resources, and reduces the hardware implementation cost.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a protocol intercommunication method and device, and a video monitoring system. Background Art

[0002] As the development direction of the security monitoring field, the integrated video monitoring solution (the manufacturer provides a complete video monitoring system of front-end camera equipment + intermediate access equipment + upper-level platform rather than just a single device) has become a focus of attention on how to ensure the secure transmission of information in the entire video monitoring system. The secure transmission of the interconnection protocol that connects all the devices in the video monitoring system and guides the flow of media streams has become the top priority in ensuring the secure transmission of information in the entire video monitoring system.

[0003] At present, the interconnection protocols used in video surveillance integrated solutions are generally divided into two categories: one is private interconnection protocol, that is, the standard set by the manufacturer itself, and only the equipment produced by itself can be interconnected through this protocol; the other is general interconnection protocol, that is, the general standard set by the international or national, and all the equipment certified by this standard can be interconnected through this protocol. The mainstream ones are ONVIF protocol and GB28181 protocol. These two types of interconnection protocols have their own advantages and disadvantages. Compared with the general interconnection protocol, the private interconnection protocol is more secure and has strong internal scalability. Manufacturers can change or supplement the content of the protocol standard at any time according to customer requirements, but it has a major defect that it cannot be interconnected with other manufacturers' equipment; compared with the private interconnection protocol, the general interconnection protocol allows all equipment certified by this standard to be interconnected, and leaves room for manufacturers to expand freely, but because the protocol standard is in plain text, the reliability of information security transmission is difficult to guarantee.

[0004] In the prior art, in order to solve the interoperability problem and information security transmission problem in the video surveillance system at the same time, each manufacturer adopts the method of integrating private interconnection protocols and general interconnection protocols on the equipment at the same time: when the equipment of other manufacturers is connected, the general interconnection protocol is used for interconnection; when the equipment of the manufacturer itself is connected, the private interconnection protocol is used for interconnection. Although this method guarantees the information security transmission of the video surveillance system to the greatest extent, the integration of private interconnection protocols and general interconnection protocols at the same time greatly consumes the system resources of the equipment and increases the hardware cost of the equipment. Summary of the invention

[0005] The present invention provides a protocol intercommunication method and device, and a video monitoring system, which are used to solve or at least partially solve the technical problem of large system resource consumption in the prior art.

[0006] In order to solve the above technical problems, the first aspect of the present invention provides a protocol intercommunication method, which is applied to an upper-level platform and a front-end device in video surveillance, wherein the upper-level platform includes a first ONVIF protocol module, a first GB28181 protocol module and a first certificate key management module, wherein the first certificate key management module pre-stores an upper-level platform private key, an upper-level platform certificate, an upper-level platform certificate key and a symmetric encryption key, and the front-end device includes a second ONVIF protocol module, a second GB28181 protocol module and a second certificate key management module, wherein the second certificate key management module pre-stores a front-end device private key, a front-end device certificate key, a front-end device certificate and an upper-level platform certificate key, and the first certificate key management module can obtain a front-end device public key from the front-end certificate by using the front-end device certificate key, and the second certificate key management module can obtain an upper-level platform public key from the upper-level platform certificate by using the upper-level platform certificate key, and the protocol intercommunication method includes:

[0007] The first ONVIF protocol module of the upper platform and the second ONVIF protocol module of the front-end device perform protocol intercommunication based on the upper platform private key, the upper platform public key, the upper platform certificate, the upper platform certificate key, the front-end device private key, the front-end device public key, the front-end device certificate key and the front-end device certificate;

[0008] The first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device communicate with each other based on the upper-level platform private key, the upper-level platform public key, the symmetric encryption key, the front-end device private key, and the front-end device public key.

[0009] In one embodiment, the first ONVIF protocol module of the upper platform and the second ONVIF protocol module of the front-end device perform protocol intercommunication based on the upper platform private key, the upper platform public key, the upper platform certificate, the upper platform certificate key, the front-end device private key, the front-end device public key, the front-end device certificate key and the front-end device certificate, including:

[0010] The first ONVIF protocol module of the upper-level platform sends an ONVIF detection message to the front-end device, wherein the ONVIF detection message carries the upper-level platform certificate, and the upper-level platform certificate includes the upper-level platform public key;

[0011] The second ONVIF protocol module of the front-end device parses the received ONVIF detection message to obtain the upper-level platform certificate, and stores the upper-level platform certificate obtained by parsing in the second certificate key management module;

[0012] The certificate key management module of the front-end device decrypts the upper-level platform certificate using the pre-stored upper-level platform certificate key to obtain the upper-level platform public key, and passes the upper-level platform public key, the front-end device certificate, and the front-end device certificate key to the second ONVIF protocol module;

[0013] The second ONVIF protocol module of the front-end device sends an ONVIF handshake request to the superior platform, and the ONVIF handshake request carries the front-end device certificate and the front-end device certificate key encrypted by the public key of the superior platform;

[0014] The first ONVIF protocol module of the upper-level platform parses the received ONVIF handshake request to obtain the front-end device certificate and the front-end device certificate key encrypted with the upper-level platform public key, and then reads the upper-level platform private key from the first certificate key management module, and uses the upper-level platform private key to decrypt the front-end device certificate and the front-end device certificate key encrypted with the upper-level platform public key. If the decryption is successful, it means that the second ONVIF protocol module of the front-end device has successfully registered with the upper-level platform, and the first ONVIF protocol module of the upper-level platform and the second ONVIF protocol module of the front-end device are interoperable;

[0015] The first ONVIF protocol module of the upper-level platform stores the front-end device certificate and the front-end device certificate key obtained when the decryption is successful in the first certificate key management module.

[0016] In one implementation, the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device perform protocol intercommunication based on the upper-level platform private key, the upper-level platform public key, the symmetric encryption key, the front-end device private key, and the front-end device public key, including:

[0017] The second GB28181 protocol module of the front-end device reads the upper-level platform public key and the upper-level platform private key from the second certificate key management module, and the first GB28181 protocol module of the upper-level platform reads the front-end device public key and the upper-level platform private key from the first certificate key management module;

[0018] The first GB28181 protocol module of the upper platform reads the symmetric encryption key from the first key management module for the first time;

[0019] The second GB28181 protocol module of the front-end device and the first GB28181 protocol module of the upper-level platform perform two-way authentication based on the upper-level platform public key and the front-end device private key read by the second GB28181 protocol module, and the front-end device public key, the upper-level platform private key, and the symmetric encryption key read by the first GB28181 protocol module. If the authentication is successful, the second GB28181 protocol module of the front-end device successfully registers with the upper-level platform, and the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device are interoperable;

[0020] The second GB28181 protocol module of the front-end device stores the symmetric encryption key transmitted by the upper-level platform in the second certificate key management module.

[0021] In one implementation, the second GB28181 protocol module of the front-end device and the first GB28181 protocol module of the upper-level platform perform two-way authentication based on the other party's public key, their own private key and the symmetric encryption key, including:

[0022] The second GB28181 protocol module of the front-end device encrypts the first authentication information using the public key of the upper-level platform, carries it in the SIP registration message, and sends a two-way authentication request to the upper-level platform through the SIP registration message, wherein the first authentication information includes a random number and an upper-level platform ID;

[0023] The first GB28181 protocol module of the upper platform uses the upper platform private key to decrypt the first authentication information encrypted in the SIP registration message. If the decryption is successful, the random number contained in the first authentication information is obtained, and a SIP registration success notification message is sent to the second GB28181 protocol module of the front-end device, wherein the SIP registration success notification message carries the second authentication information encrypted by the public key of the front-end device, and the second authentication information includes the random number, the front-end device ID and the symmetric encryption key, and the symmetric encryption key is obtained by the first GB28181 protocol module from the first certificate key management module;

[0024] The second GB28181 protocol module of the front-end device uses the public key of the front-end device to decrypt the encrypted second authentication information in the SIP registration success notification message. If the decryption is successful, the second GB28181 protocol module of the front-end device obtains the symmetric encryption key in the second authentication information.

[0025] In one embodiment, the method further includes: the first certificate key management module of the upper platform periodically updates the stored symmetric encryption key, and transmits the updated symmetric encryption key to the first ONVIF protocol module and the first GB28181 protocol module;

[0026] When the symmetric encryption key is updated, when the first GB28181 protocol module of the upper platform sends a SIP registration success notification message to the second GB28181 protocol module of the front-end device, the SIP registration success notification message is encrypted using the original symmetric encryption key, and the encrypted SIP registration success notification message carries the new symmetric encryption key encrypted by the public key of the front-end device.

[0027] In one embodiment, the method also includes: the second GB28181 protocol module of the front-end device stores the new symmetric encryption key carried in the SIP registration success notification message in the second certificate key management module, and the second certificate key management module of the front-end device initiates a symmetric encryption key change notification to the second ONVIF protocol module and the second media module, and passes the changed symmetric encryption key to the second ONVIF protocol module and the second media module, so that after receiving the changed symmetric encryption key, the second ONVIF protocol module and the second media module discard the original symmetric encryption key and use the changed symmetric encryption key for current and subsequent ONVIF protocol interconnection interactions and media stream encryption transmission.

[0028] In one embodiment, the method also includes: when the second ONVIF protocol module and the second GB28181 protocol module of the front-end device are successfully registered with the upper-level platform, the second ONVIF protocol module of the front-end device uses a symmetric encryption key to symmetrically encrypt subsequent ONVIF functional service messages and then interacts with the first ONVIF protocol module of the upper-level platform, and the second GB28181 protocol module of the front-end device uses a symmetric encryption key to symmetrically encrypt subsequent SIP functional service messages and then interacts with the first GB28181 protocol module of the upper-level platform.

[0029] In one implementation, the upper-level platform further includes a first media module, the front-end device further includes a second media module, and the method further includes media transmission, specifically:

[0030] The second ONVIF protocol module or the second GB28181 protocol module of the front-end device transmits the negotiated first media transmission information to the second media module, where the first media transmission information includes the IP port, media type, and resolution of the upper-level platform, and the second media module prepares to transmit the media stream to the upper-level platform according to the media transmission information; the first ONVIF protocol module or the first GB28181 protocol module of the upper-level platform transmits the negotiated second media information to the first media module, where the second media information includes the IP port, media type, and resolution of the front-end device, and the first media module prepares to receive the media stream from the front-end device;

[0031] The second media module of the front-end device encrypts the media stream to be sent to the upper-level platform according to the security level of the current device using the symmetric encryption key obtained from the second certificate key management module, and then transmits it to the upper-level platform; the first media module of the upper-level platform decrypts the received media stream according to the security level of the current device. If the decryption process is unsuccessful, the media frames in the current media stream are discarded. If the decryption process is successful, the media frames of the current media stream are received normally.

[0032] Based on the same inventive concept, the second aspect of the present invention provides a protocol intercommunication device based on the protocol intercommunication method described in the first aspect, comprising:

[0033] A first intercommunication device, used to implement protocol intercommunication between a first ONVIF protocol module of an upper-level platform and a second ONVIF protocol module of a front-end device based on an upper-level platform private key, an upper-level platform public key, an upper-level platform certificate, an upper-level platform certificate key, a front-end device private key, a front-end device public key, a front-end device certificate key, and a front-end device certificate;

[0034] The second intercommunication device is used to realize protocol intercommunication between the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device based on the upper-level platform private key, the upper-level platform public key, the symmetric encryption key, the front-end device private key and the front-end device public key.

[0035] Based on the same inventive concept, the third aspect of the present invention provides a video surveillance system, including an upper-level platform, a front-end device and the protocol intercommunication device described in the second aspect.

[0036] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0037] A protocol intercommunication method provided by the present invention integrates only the general interconnection protocol (ONVIF protocol and GB28181 protocol), and realizes the intercommunication between the first ONVIF protocol module of the upper-level platform and the second ONVIF protocol module of the front-end device by sending ONVIF detection messages and parsing the detection messages, and at the same time using the key stored in the certificate key management module. The second GB28181 protocol module of the front-end device and the first GB28181 protocol module of the upper-level platform perform two-way authentication based on the public key of the other party, their own private key and the symmetric encryption key, so as to realize the intercommunication between the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device. With the support of the certificate key management module, the transmission security of the general interconnection protocol is guaranteed at the same time. Compared with the solution of integrating the private interconnection protocol and the general interconnection protocol at the same time, the system resources are effectively saved and the hardware implementation cost is reduced. Compared with the solution that only integrates the general interconnection protocol and adopts the native security rules of the general interconnection protocol, the technical solution is more resistant to external attacks and more secure in terms of transmission security through the security linkage between the general interconnection protocol modules (between the first ONVIF protocol module and the second ONVIF protocol module, and between the first GB28181 protocol module and the second GB28181 protocol module). Moreover, since the ONVIF protocol is based on the HTTP protocol, remote transmission of certificates and keys can be achieved, which saves the manual import of certificates on the device and saves manpower (because if the GB28181 protocol needs to use the GB35114 protocol to ensure security, it is necessary to manually import certificates on the device);

[0038] Furthermore, the first certificate key management module of the upper-level platform periodically updates the stored symmetric encryption key and transmits the updated symmetric encryption key to other modules, thereby further improving security.

[0039] Furthermore, the upper platform and front-end device of the present application share a set of security encryption systems. For example, the second ONVIF protocol module of the front-end device obtains the upper platform public key through protocol intercommunication with the first ONVIF protocol module of the upper platform, and stores it in the second certificate key management module; the second GB28181 protocol module of the front-end device can obtain the symmetric encryption key through protocol intercommunication with the first GB28181 protocol module of the upper platform, and store it in the second certificate key management module. In addition, the front-end device can obtain its own public key and private key from the second certificate key management module, and the upper platform can obtain its own public key and private key from the first certificate key management module to achieve intercommunication. Compared with the original security rules adopted by the ONVIF protocol and the GB28181 protocol in the prior art, this solution achieves a security defense capability of 1+1>2 through the security linkage of two general interconnected protocol modules without increasing system resource consumption.

[0040] Furthermore, the present invention also provides an interaction method based on the protocol intercommunication method. When the second ONVIF protocol module and the second GB28181 protocol module of the front-end device are successfully registered on the upper-level platform, the upper-level platform considers that the front-end device is in a remotely operable state at this time, and then performs subsequent functional message interaction. If the second ONVIF protocol module or the second GB28181 protocol module is disconnected for some reason, the upper-level platform considers that the front-end device is not in a remotely operable state at this time, and will wait until the front-end device uses ONVIF and GB28181 to register on the platform before interacting with it through functional messages.

[0041] Furthermore, the present invention also provides a media transmission method based on a protocol intercommunication method, in which dynamic security levels are set for external access devices (such as front-end devices) on an upper-level platform, so that real-time adjustments can be made according to actual usage scenarios. On the one hand, when the video surveillance system accesses external front-end devices from other manufacturers outside the system, the security level of the device can be set on the upper-level platform to be unencrypted, thereby avoiding the problem of inability to interconnect. On the other hand, when the transmission security required by the usage scenario is not high, the security level of the upper-level platform and the front-end device can be lowered, thereby effectively saving system resources (if the transmission security required by subsequent usage scenarios is no longer changed, the hardware requirements can be reduced in this way, thereby reducing the hardware implementation cost). BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 It is a schematic diagram of the interaction between the upper platform and the front-end device in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a technical solution to ensure the secure transmission of the universal interconnection protocol in the video surveillance system through the linkage between the universal interconnection protocol modules. Compared with the solution of directly using only the universal interconnection protocol in the video surveillance system, the solution can ensure the reliability of its secure transmission, and compared with the solution of integrating both the private interconnection protocol and the universal interconnection protocol in the device, the solution can effectively reduce the consumption of device system resources, thereby reducing the hardware implementation cost.

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Embodiment 1

[0047] The embodiment of the present invention provides a protocol intercommunication method, which is applied to a superior platform and a front-end device in video monitoring.

[0048] The upper platform includes a first ONVIF protocol module, a first GB28181 protocol module and a first certificate key management module, the first certificate key management module pre-stores the upper platform private key, the upper platform certificate, the upper platform certificate key and the symmetric encryption key, the front-end device includes a second ONVIF protocol module, a second GB28181 protocol module and a second certificate key management module, the second certificate key management module pre-stores the front-end device private key, the front-end device certificate key, the front-end device certificate and the upper platform certificate key, and the first certificate key management module can use the front-end device certificate key to obtain the front-end device public key from the front-end certificate, the second certificate key management module can use the upper platform certificate key to obtain the upper platform public key from the upper platform certificate, and the protocol intercommunication method includes:

[0049] The first ONVIF protocol module of the upper platform and the second ONVIF protocol module of the front-end device perform protocol intercommunication based on the upper platform private key, the upper platform public key, the upper platform certificate, the upper platform certificate key, the front-end device private key, the front-end device public key, the front-end device certificate key and the front-end device certificate;

[0050] The first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device communicate with each other based on the upper-level platform private key, the upper-level platform public key, the symmetric encryption key, the front-end device private key, and the front-end device public key.

[0051] In the specific implementation process, the upper platform and the front-end device can refer to different devices according to different application scenarios. For example, when the intermediate access device communicates with the front-end camera through protocol, the intermediate access device is the upper platform and the front-end camera is the front-end device. When the intermediate access device interacts with the back-end, the intermediate access device is the front-end device and the back-end is the upper platform.

[0052] The protocol intercommunication method of the present invention mainly refers to the protocol intercommunication between the upper platform and the front-end device, including the intercommunication between the first ONVIF protocol module of the upper platform and the second ONVIF protocol module of the front-end device (ONVIF protocol intercommunication), and the intercommunication between the first GB28181 protocol module of the upper platform and the second GB28181 protocol module of the front-end device (GB28181 protocol intercommunication).

[0053] In one embodiment, the first ONVIF protocol module of the upper platform and the second ONVIF protocol module of the front-end device perform protocol intercommunication based on the upper platform private key, the upper platform public key, the upper platform certificate, the upper platform certificate key, the front-end device private key, the front-end device public key, the front-end device certificate key and the front-end device certificate, including:

[0054] The first ONVIF protocol module of the upper-level platform sends an ONVIF detection message to the front-end device, wherein the ONVIF detection message carries the upper-level platform certificate, and the upper-level platform certificate includes the upper-level platform public key;

[0055] The second ONVIF protocol module of the front-end device parses the received ONVIF detection message to obtain the upper-level platform certificate, and stores the upper-level platform certificate obtained by parsing in the second certificate key management module;

[0056] The certificate key management module of the front-end device decrypts the upper-level platform certificate using the pre-stored upper-level platform certificate key to obtain the upper-level platform public key, and passes the upper-level platform public key, the front-end device certificate, and the front-end device certificate key to the second ONVIF protocol module;

[0057] The second ONVIF protocol module of the front-end device sends an ONVIF handshake request to the superior platform, and the ONVIF handshake request carries the front-end device certificate and the front-end device certificate key encrypted by the public key of the superior platform;

[0058] The first ONVIF protocol module of the upper-level platform parses the received ONVIF handshake request to obtain the front-end device certificate and the front-end device certificate key encrypted with the upper-level platform public key, and then reads the upper-level platform private key from the first certificate key management module, and uses the upper-level platform private key to decrypt the front-end device certificate and the front-end device certificate key encrypted with the upper-level platform public key. If the decryption is successful, it means that the second ONVIF protocol module of the front-end device has successfully registered with the upper-level platform, and the first ONVIF protocol module of the upper-level platform and the second ONVIF protocol module of the front-end device are interoperable;

[0059] The first ONVIF protocol module of the upper platform stores the front-end device certificate and the front-end device certificate key obtained when the decryption is successful in the first certificate key management module. Specifically, the above intercommunication is the protocol intercommunication between ONVIF protocol modules.

[0060] ONVIF protocol intercommunication is achieved by the first ONVIF protocol module of the upper-level platform sending an ONVIF detection message to the front-end device, and the front-end device parsing the detection message. If the parsing is successful, it indicates that the second ONVIF protocol module of the front-end device has successfully registered with the upper-level platform, and the two are intercommunication. Through this process, the first ONVIF protocol module of the upper-level platform can obtain the front-end device certificate and certificate key, and store them in the first certificate key management module. The second ONVIF protocol module of the front-end device can obtain the upper-level platform public key from the second certificate key management module for subsequent two-way authentication.

[0061] The first ONVIF protocol module stores the front-end device certificate and certificate key obtained by successful decryption in the first certificate key management module to facilitate subsequent reading and use.

[0062] In one implementation, when the upper-level platform private key fails to decrypt the front-end device certificate and the front-end device public key encrypted with the upper-level platform public key, the method further includes the upper-level platform waiting for the subsequent front-end device to send a new ONVIF handshake request message.

[0063] That is to say, when the upper-level platform uses the upper-level platform private key to decrypt the front-end device certificate and the front-end device public key encrypted with the upper-level platform public key, if the decryption is unsuccessful, no subsequent operations are performed, but the front-end device is waited for to send a new ONVIF handshake request message.

[0064] In one implementation, the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device perform protocol intercommunication based on the upper-level platform private key, the upper-level platform public key, the symmetric encryption key, the front-end device private key, and the front-end device public key, including:

[0065] The second GB28181 protocol module of the front-end device reads the upper-level platform public key and the upper-level platform private key from the second certificate key management module, and the first GB28181 protocol module of the upper-level platform reads the front-end device public key and the upper-level platform private key from the first certificate key management module;

[0066] The first GB28181 protocol module of the upper platform reads the symmetric encryption key from the first key management module for the first time;

[0067] The second GB28181 protocol module of the front-end device and the first GB28181 protocol module of the upper-level platform perform two-way authentication based on the upper-level platform public key and the front-end device private key read by the second GB28181 protocol module, and the front-end device public key, the upper-level platform private key, and the symmetric encryption key read by the first GB28181 protocol module. If the authentication is successful, the second GB28181 protocol module of the front-end device successfully registers with the upper-level platform, and the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device are interoperable;

[0068] The second GB28181 protocol module of the front-end device stores the symmetric encryption key transmitted by the upper-level platform in the second certificate key management module.

[0069] Specifically, the above intercommunication is the protocol intercommunication between GB28181 protocol modules.

[0070] It should be noted that the encryption process is completed by each protocol module itself (for example, the encryption content in the ONVIF message is completed by the corresponding ONVIF protocol module, and the encryption content in the GB28181 message is completed by the corresponding GB28181 protocol module). The encryption method is to call the system's encryption algorithm library interface (that is, pass in the content and key to be encrypted, and then return the encryption result), and it is completed when the message to be sent is assembled. The symmetric encryption key is generated by the certificate key management module calling the system's symmetric encryption algorithm library interface, and it will be generated for the first time when the certificate key management module is started for the first time (only the first certificate key management module of the upper platform will automatically generate it, and it will be changed regularly afterwards).

[0071] GB28181 protocol intercommunication is achieved by the front-end device and the upper-level platform using each other's public key to asymmetrically encrypt the authentication information. This is a two-way authentication process. The other party's public key is obtained through the ONVIF protocol intercommunication mentioned above. In the two-way authentication process, the upper-level platform uses the public key of the front-end device to encrypt the symmetric encryption key and carries it in the reverse authentication (SIP registration success notification message) sent by the upper-level platform to the front-end device. If both parties pass the authentication of the other party, the front-end device will be able to obtain the symmetric encryption key decrypted using the private key of the front-end device.

[0072] Regarding key transfer, each module of this application shares a set of key management mechanisms. When the second ONVIF protocol module of the front-end device obtains the certificate of the upper platform, it will be passed to the certificate key management module of the same device (the second certificate key management module of the front-end device), and the second certificate key management module will update the upper platform certificate currently saved by itself (if the certificate has not been saved, it will be saved for the first time, if it has been saved, it will be updated); when the first ONVIF protocol module of the upper platform receives the front-end device certificate and certificate key, it will be passed to the certificate key management module of the same device (the first certificate key management module), and the first certificate key management module will update the front-end device certificate and certificate key currently saved by itself (if it is the first time, it will be saved for the first time); when the second GB28181 protocol module of the front-end device receives a new symmetric key from the upper platform, it will be passed to the certificate key management module of the same device, and the second certificate key management module will update the symmetric key currently saved by itself (the front-end device will disable the symmetric key automatic update function of the certificate key management module, and only the upper platform will enable this function).

[0073] In one implementation, the second GB28181 protocol module of the front-end device and the first GB28181 protocol module of the upper-level platform perform two-way authentication based on the other party's public key, their own private key, and the symmetric encryption key, including:

[0074] The second GB28181 protocol module of the front-end device encrypts the first authentication information using the public key of the upper-level platform, carries it in the SIP registration message, and sends a two-way authentication request to the upper-level platform through the SIP registration message, wherein the first authentication information includes a random number and an upper-level platform ID;

[0075] The first GB28181 protocol module of the upper platform uses the upper platform private key to decrypt the first authentication information encrypted in the SIP registration message. If the decryption is successful, the random number contained in the first authentication information is obtained, and a SIP registration success notification message (i.e., a reverse authentication request) is sent to the second GB28181 protocol module of the front-end device, wherein the SIP registration success notification message carries the second authentication information encrypted by the public key of the front-end device, and the second authentication information includes a random number, a front-end device ID, and a symmetric encryption key, and the symmetric encryption key is obtained by the first GB28181 protocol module from the first certificate key management module;

[0076] The second GB28181 protocol module of the front-end device uses the public key of the front-end device to decrypt the encrypted second authentication information in the SIP registration success notification message. If the decryption is successful, the second GB28181 protocol module of the front-end device obtains the symmetric encryption key in the second authentication information.

[0077] Specifically, when both parties are successfully authenticated, that is, the first GB28181 protocol module of the upper platform successfully decrypts the encrypted first authentication information in the SIP registration message sent by the front-end device, and the second GB28181 protocol module of the front-end device uses the public key of the front-end device to successfully decrypt the encrypted second authentication information in the SIP registration success notification message, it indicates that the authentication is successful, and the second GB28181 protocol module of the front-end device obtains the symmetric encryption key in the second authentication information.

[0078] In one implementation, when the second GB28181 protocol module of the front-end device fails to decrypt the encrypted second authentication information in the SIP registration success notification message using the front-end device public key, the message is discarded, and a new SIP registration message is sent to the first GB28181 protocol module of the superior platform again after a period of time.

[0079] In one embodiment, after the second GB28181 protocol module of the front-end device obtains the symmetric encryption key in the second authentication information, the method further includes: the second GB28181 protocol module of the front-end device stores the obtained symmetric encryption key in the second certificate key management module.

[0080] The second GB28181 protocol module of the front-end device stores the acquired symmetric encryption key in the second certificate key management module for subsequent reading.

[0081] In one embodiment, the method further includes: the first certificate key management module of the upper-level platform periodically updates the stored symmetric encryption key, and transmits the updated symmetric encryption key to the first ONVIF protocol module and the first GB28181 protocol module.

[0082] Since the symmetric encryption key may be stolen if it is not updated, the present invention updates it regularly to improve security.

[0083] In addition, when asymmetric encryption keys are asymmetrically encrypted, they can be combined with any other fields before encryption, which can further improve security; during the periodic update of the symmetric encryption key by the first certificate key management module of the upper-level platform, a time tolerance is set (that is, taking into account network delays and the time taken by the front-end device to update the symmetric encryption key). Within this time tolerance, the upper-level platform will try to use the old symmetric encryption key to decrypt the received protocol messages and media frames encrypted with the old symmetric encryption key if decryption using the new symmetric encryption key is unsuccessful, so as to ensure reliability and efficiency.

[0084] When the symmetric encryption key is updated, the method also includes: when the GB28181 protocol module of the upper platform sends a SIP registration success notification message to the second GB28181 protocol module of the front-end device, the SIP registration success notification message is encrypted using the original symmetric encryption key, and the encrypted SIP registration success notification message carries a new symmetric encryption key encrypted by the public key of the front-end device.

[0085] In the above manner, through two-way authentication, the upper platform can pass the new symmetric encryption key to the second GB28181 protocol module of the front-end device.

[0086] In one embodiment, the method also includes: when the second GB28181 protocol module of the front-end device successfully decrypts the encrypted second authentication information in the SIP registration success notification message, a new symmetric encryption key is obtained and stored in the second certificate key management module; the second certificate key management module of the front-end device initiates a symmetric encryption key change notification to the second ONVIF protocol module and the second media module, and passes the new symmetric encryption key to the second ONVIF protocol module.

[0087] Therefore, after receiving the new symmetric encryption key, the second ONVIF protocol module will immediately discard the old symmetric encryption key and use the new symmetric encryption key for current and subsequent ONVIF protocol interconnection interactions and media stream encryption transmission.

[0088] In one embodiment, the method also includes: when the second ONVIF protocol module and the second GB28181 protocol module of the front-end device are successfully registered with the upper-level platform, the second ONVIF protocol module of the front-end device uses a symmetric encryption key to symmetrically encrypt subsequent ONVIF functional service messages and then interacts with the first ONVIF protocol module of the upper-level platform, and the second GB28181 protocol module of the front-end device uses a symmetric encryption key to symmetrically encrypt subsequent SIP functional service messages and then interacts with the first GB28181 protocol module of the upper-level platform.

[0089] Specifically, after confirming that the second ONVIF protocol module and the second GB28181 protocol module have passed the registration verification of the upper-level platform (because it is a two-way authentication process, at this time, it indicates that the first ONVIF protocol module and the first GB28181 protocol module of the upper-level platform can also pass the reverse authentication of the front-end device), the second ONVIF protocol module of the front-end device can use the symmetric encryption key to symmetrically encrypt subsequent ONVIF functional service messages and then interact with the first ONVIF protocol module of the upper-level platform; the second GB28181 protocol module of the front-end device can use the symmetric encryption key to symmetrically encrypt subsequent SIP functional service messages and then interact with the first GB28181 protocol module of the upper-level platform. Similarly, during the message interaction process, after confirming that the ONVIF protocol and GB28181 protocol of the front-end device have passed the verification of the upper-level platform, the first ONVIF protocol module of the upper-level platform uses the symmetric encryption key to decrypt and reply the ONVIF functional service message sent by the front-end device, and the reply message is also encrypted by the symmetric encryption key; the first GB28181 protocol module of the upper-level platform uses the symmetric encryption key to decrypt and reply the ONVIF functional service message sent by the front-end device, and the reply message is also encrypted by the symmetric encryption key.

[0090] In one implementation, the upper-level platform further includes a first media module, the front-end device further includes a second media module, and the method further includes media transmission, specifically:

[0091] The second ONVIF protocol module or the second GB28181 protocol module of the front-end device transmits the negotiated first media transmission information to the second media module, where the first media transmission information includes the IP port, media type, and resolution of the upper-level platform, and the second media module prepares to transmit the media stream to the upper-level platform according to the media transmission information; the first ONVIF protocol module or the first GB28181 protocol module of the upper-level platform transmits the negotiated second media information to the first media module, where the second media information includes the IP port, media type, and resolution of the front-end device, and the first media module prepares to receive the media stream from the front-end device;

[0092] The second media module of the front-end device encrypts the media stream to be sent to the upper-level platform according to the security level of the current device using the symmetric encryption key obtained from the second certificate key management module, and then transmits it to the upper-level platform; the first media module of the upper-level platform decrypts the received media stream according to the security level of the current device. If the decryption process is unsuccessful, the media frames in the current media stream are discarded. If the decryption process is successful, the media frames of the current media stream are received normally.

[0093] Specifically, the second media module of the front-end device uses the symmetric encryption key obtained from the second certificate key management module to encrypt the media stream to be sent to the upper-level platform according to the security level of the current device, including the following three methods: the first is no encryption, the second is symmetric encryption of the video stream message header, and the third is symmetric encryption of the entire video stream). The first media module of the upper-level platform decrypts the received media stream according to the security level of the current device, including two situations. The first is that if the security level of the current-end device is consistent with that of the platform, decryption is performed according to the security level. The second is that if the security level of the current-end device is consistent with that of the platform but inconsistent with that of the platform, the security level of the upper-level platform shall prevail. If the security level is lower than that of the upper-level platform, the upper-level platform will fail the decryption verification and will not receive the video stream.

[0094] The following is an introduction to the protocol intercommunication method in the embodiment of the present invention through a detailed example. Figure 1 .

[0095] S1. Transferring the upper-level platform certificate, specifically: the first ONVIF protocol module of the upper-level platform sends an ONVIF detection message, and carries the upper-level platform certificate in plain text in the message.

[0096] S2, storing the upper-level platform certificate, specifically: the second ONVIF protocol module of the front-end device receives the ONVIF detection message broadcasted by the upper-level platform, parses it to obtain the upper-level platform certificate, and stores the upper-level platform certificate in the second certificate key management module.

[0097] S3. Read the superior platform public key, front-end device certificate, and front-end device certificate key. Specifically, the second certificate key management module of the front-end device uses the superior platform certificate key preloaded therein to parse the superior platform certificate to obtain the superior platform public key, and pass the superior platform public key, front-end device certificate, and certificate key to the second ONVIF protocol module.

[0098] S4, transmitting the front-end device certificate and the front-end device certificate key, specifically: the second ONVIF protocol module of the front-end device sends an ONVIF handshake request message, and carries the front-end device certificate and certificate key encrypted by the public key of the upper platform in the message.

[0099] S5. Read the private key of the upper-level platform, specifically: after the first ONVIF protocol module of the upper-level platform receives the ONVIF handshake request message sent by the front-end device, it parses to obtain the encrypted front-end device certificate and certificate key, reads the upper-level platform private key from the first certificate key management module, and uses the upper-level platform private key to decrypt the encrypted front-end device certificate and certificate key. If the decryption is successful, a handshake success message is replied to the front-end device. If the decryption is unsuccessful, no reply is given.

[0100] S6. Storing the front-end device certificate and the front-end device certificate key, specifically: the first ONVIF protocol module of the upper-level platform stores the front-end device certificate and the certificate key obtained by successful decryption into the first certificate key management module.

[0101] S7. Read the public key of the superior platform and the private key of the front-end device. Specifically, the second GB28181 protocol module of the front-end device reads the public key of the superior platform and the private key of the front-end device from the second certificate key management module, and the first GB28181 protocol module of the superior platform reads the public key of the front-end device and the private key of the superior platform from the first certificate key management module.

[0102] S8. Reading the symmetric encryption key, specifically, the first ONVIF protocol module of the upper-level platform reads the symmetric encryption key from the first certificate key management module for the first time.

[0103] S9, two-way authentication and transmission of symmetric encryption keys, specifically: the second GB28181 protocol module of the front-end device initiates two-way authentication to the first GB28181 protocol module of the superior platform (an asymmetric encryption and decryption authentication method in which the front-end device and the superior platform use each other's public keys to asymmetrically encrypt the authentication information), the symmetric encryption key is encrypted using the public key of the front-end device, and is carried in the reverse authentication sent from the superior platform to the front-end device. If both parties pass the other party's authentication, the front-end device will be able to obtain the symmetric encryption key decrypted using the private key of the front-end device.

[0104] S10, storing the symmetric encryption key, specifically: the second GB28181 protocol module of the front-end device stores the symmetric encryption key transmitted by the upper platform in the second certificate key management module.

[0105] S11, reading the symmetric encryption key, specifically: the second certificate key management module of the front-end device transmits the symmetric encryption key to the second ONVIF protocol module and the second media module.

[0106] S12, protocol ONVIF interconnection, specifically: after the second ONVIF protocol module of the front-end device confirms that the second ONVIF protocol module and the second GB28181 protocol module have passed the registration verification of the upper-level platform, it uses the symmetric encryption key to symmetrically encrypt the subsequent ONVIF functional service message and then interacts with the first ONVIF protocol module of the upper-level platform; after the second GB28181 protocol module of the front-end device confirms that the second GB28181 protocol module and the second ONVIF protocol module have passed the registration verification of the upper-level platform, it uses the symmetric encryption key to symmetrically encrypt the subsequent SIP functional service message and then interacts with the first GB28181 protocol module of the upper-level platform The 8181 protocol module exchanges messages with the upper-level platform; the first ONVIF protocol module of the upper-level platform confirms that the ONVIF protocol and GB28181 protocol of the front-end device have passed the verification of the upper-level platform before using the symmetric encryption key to decrypt and reply the ONVIF functional service message sent by the front-end device, and the reply message is also encrypted with the symmetric encryption key; the first GB28181 protocol module of the upper-level platform confirms that the ONVIF protocol and GB28181 protocol of the front-end device have passed the verification of the upper-level platform before using the symmetric encryption key to decrypt and reply the ONVIF functional service message sent by the front-end device, and the reply message is also encrypted with the symmetric encryption key.

[0107] S13, transmitting media transmission information, specifically: when it comes to media transmission, the second ONVIF protocol module and the second GB28181 protocol module of the front-end device transmit the negotiated media transmission information such as the IP port, media type, and resolution of the upper-level platform to the second media module, and the second media module prepares to transmit the media stream to the upper-level platform according to the media transmission information; the first ONVIF protocol module and the first GB28181 protocol module of the upper-level platform transmit the negotiated media transmission information such as the IP port, media type, and resolution of the front-end device to the first media module, and the media module prepares to receive the media stream from the front-end device.

[0108] S14, media stream transmission, specifically: the second media module of the front-end device encrypts the media stream to be sent to the upper-level platform according to the security level of the current device (no encryption / symmetrical encryption of the video stream message header / symmetrical encryption of the entire video stream), and then transmits the media stream to the upper-level platform; the first media module of the upper-level platform decrypts the received media stream according to the security level of the current device (generally, the security level of the front-end device is consistent with the platform. If not, the security level of the upper-level platform shall prevail. If the security level is lower than that of the upper-level platform, the upper-level platform will cause the decryption verification to fail and the video stream will not be received). If the decryption process is unsuccessful, the current media frame is discarded. If the decryption process is successful, the current media frame is received normally.

[0109] S15, changing the symmetric encryption key, specifically: the first certificate key management module of the upper platform regularly changes the symmetric encryption key, and transmits the changed symmetric encryption key to the first ONVIF protocol module, the first GB28181 protocol module and the first media module.

[0110] S16, symmetric encryption key change notification and delivery, specifically: the first GB28181 protocol module of the upper platform uses the public key of the front-end device to encrypt the new symmetric encryption key, and carries it in the SIP message after the old symmetric encryption key, and passes it to the second GB28181 protocol module of the front-end device.

[0111] S17, symmetric encryption key update, specifically: the second GB28181 protocol module of the front-end device stores the new symmetric encryption key in the second certificate key management module.

[0112] S18, symmetric encryption key update, specifically: the second certificate key management module of the front-end device initiates a symmetric encryption key change notification to the second ONVIF protocol module and the second media module, and passes the new symmetric encryption key to the second ONVIF protocol module and the second media module. After receiving the new symmetric encryption key, the second ONVIF protocol module and the second media module immediately discard the old symmetric encryption key and use the new symmetric encryption key for current and subsequent ONVIF protocol interconnection interactions and media stream encryption transmission.

[0113] Among them, S1~S6 are mainly for the intercommunication between the first and second ONVIF protocol modules, S7~S11 are mainly for the intercommunication between the first and second GB28181 protocol modules, S12 is the interaction between each module, S13 and S14 are the transmission of media streams, and S15~S18 are the updates of symmetric encryption keys.

[0114] Embodiment 2

[0115] Based on the same inventive concept, this embodiment provides a protocol intercommunication device, including:

[0116] A first intercommunication device, used to implement protocol intercommunication between a first ONVIF protocol module of an upper-level platform and a second ONVIF protocol module of a front-end device based on an asymmetric encryption key of the upper-level platform stored in a first certificate key management module, an upper-level platform certificate, an upper-level platform certificate key, and an asymmetric encryption key, a front-end device certificate key, a front-end device certificate, and an upper-level platform certificate key stored in a second certificate key management module;

[0117] The second intercommunication device is used to realize protocol intercommunication between the first GB28181 protocol module of the upper platform and the second GB28181 protocol module of the front-end device based on the asymmetric encryption key of the upper platform stored in the first certificate key management module, the symmetric encryption key and the asymmetric encryption key stored in the second certificate key management module.

[0118] Since the device introduced in the second embodiment of the present invention is a device used to implement a protocol intercommunication method of the embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the device, so it is not repeated here. All devices used to implement the method introduced in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0119] Embodiment 3

[0120] Based on the same inventive concept, this embodiment provides a video surveillance system, including an upper-level platform, a front-end device, and the protocol intercommunication device described in the second embodiment.

[0121] The following is an introduction to the modules included in the upper-level platform and front-end devices.

[0122] 1.ONVIF protocol module: The upper-level platform transmits the upper-level platform certificate in plain text to the front-end device through the ONVIF protocol message (based on the HTTP protocol) (the upper-level platform certificate key is preloaded in the front-end device system, because there will be great security risks if the messages transmitting the upper-level platform certificate and key are stolen). The front-end device transmits the front-end device certificate and certificate key encrypted by the upper-level platform public key to the upper-level platform. After confirming that the ONVIF protocol (module) and GB28181 protocol (module) of the same external device have passed the verification of this device, the symmetrically encrypted ONVIF protocol message is subsequently used to interconnect and interact with the verified external device (taking the second ONVIF protocol module of the front-end device as an example, after confirming that the first ONVIF protocol module and the first GB28181 protocol module of the upper-level platform have passed the authentication of the front-end device, the symmetrically encrypted ONVIF protocol message is used to interconnect and interact with the verified upper-level platform).

[0123] 2. GB28181 protocol module: Bidirectional authentication is performed between the front-end device and the upper-level platform through SIP protocol messages (an asymmetric encryption authentication method), and after passing the bidirectional authentication, the upper-level platform transmits the symmetric encryption key encrypted by the public key of the front-end device for subsequent symmetric encryption to the front-end device (the symmetric encryption key is updated regularly, and the symmetric encryption key encrypted by the public key of the front-end device is transmitted through the SIP protocol message during the update). After confirming that the ONVIF protocol and GB28181 protocol of the same external device have passed the verification of this device, the symmetrically encrypted SIP protocol message is subsequently used to interconnect and interact with the verified external device.

[0124] 3. Certificate key management module: preload the asymmetric private key of this device, receive the storage and update of certificates, certificate keys, and symmetric encryption keys from external modules, parse the public key in the certificate through the certificate key and store it, provide the external module with the reading of private keys, public keys, and symmetric keys (writing of private keys is not allowed), and can periodically update the stored symmetric encryption keys and notify the corresponding external modules that need the keys to re-acquire them (the first certificate key management module of the upper platform has this function, and the second certificate key management module of the front-end device does not have this function). The external modules refer to the ONVIF protocol module and GB28181 protocol module in the same device.

[0125] 4. Media module: Receives media transmission information such as IP port, media format, resolution, etc. required for media stream transmission from ONVIF protocol module and GB28181 protocol module, and transmits and receives media streams based on the media transmission information. The degree of encryption for the media stream can be determined according to the set security level (no encryption / symmetric encryption of the video stream message header / symmetric encryption of the entire video stream). When a notification of a change in the symmetric encryption key is received during media stream transmission, the media stream transmission will not be interrupted, and a new symmetric encryption key will be obtained again, and the media stream will continue to be encrypted using the new symmetric encryption key (if the security level is no encryption, this action will not be performed).

[0126] Since the video surveillance system introduced in the third embodiment of the present invention is a system including the protocol intercommunication device in the second embodiment of the present invention, based on the device introduced in the third embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the system, so it is not repeated here. Any system including the device introduced in the second embodiment of the present invention belongs to the scope of protection of the present invention.

[0127] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0128] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0129] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A protocol intercommunication method, characterized in that: The upper platform and front-end device used in video surveillance, the upper platform includes a first ONVIF protocol module, a first GB28181 protocol module and a first certificate key management module, the first certificate key management module pre-stores the upper platform private key, the upper platform certificate, the upper platform certificate key and the symmetric encryption key, the front-end device includes a second ONVIF protocol module, a second GB28181 protocol module and a second certificate key management module, the second certificate key management module pre-stores the front-end device private key, the front-end device certificate key, the front-end device certificate and the upper platform certificate key, and the first certificate key management module can use the front-end device certificate key to obtain the front-end device public key from the front-end certificate, the second certificate key management module can use the upper platform certificate key to obtain the upper platform public key from the upper platform certificate, and the protocol intercommunication method includes: The first ONVIF protocol module of the upper platform and the second ONVIF protocol module of the front-end device perform protocol intercommunication based on the upper platform private key, the upper platform public key, the upper platform certificate, the upper platform certificate key, the front-end device private key, the front-end device public key, the front-end device certificate key and the front-end device certificate; The first GB28181 protocol module of the upper platform and the second GB28181 protocol module of the front-end device communicate with each other based on the upper platform private key, the upper platform public key, the symmetric encryption key, the front-end device private key, and the front-end device public key; The first ONVIF protocol module of the upper-level platform and the second ONVIF protocol module of the front-end device perform protocol intercommunication based on the upper-level platform private key, the upper-level platform public key, the upper-level platform certificate, the upper-level platform certificate key, the front-end device private key, the front-end device public key, the front-end device certificate key and the front-end device certificate, including: The first ONVIF protocol module of the upper-level platform sends an ONVIF detection message to the front-end device, wherein the ONVIF detection message carries the upper-level platform certificate, and the upper-level platform certificate includes the upper-level platform public key; The second ONVIF protocol module of the front-end device parses the received ONVIF detection message to obtain the upper-level platform certificate, and stores the upper-level platform certificate obtained by parsing in the second certificate key management module; The certificate key management module of the front-end device decrypts the upper-level platform certificate using the pre-stored upper-level platform certificate key to obtain the upper-level platform public key, and passes the upper-level platform public key, the front-end device certificate, and the front-end device certificate key to the second ONVIF protocol module; The second ONVIF protocol module of the front-end device sends an ONVIF handshake request to the superior platform, and the ONVIF handshake request carries the front-end device certificate and the front-end device certificate key encrypted by the public key of the superior platform; The first ONVIF protocol module of the upper-level platform parses the received ONVIF handshake request to obtain the front-end device certificate and the front-end device certificate key encrypted with the upper-level platform public key, and then reads the upper-level platform private key from the first certificate key management module, and uses the upper-level platform private key to decrypt the front-end device certificate and the front-end device certificate key encrypted with the upper-level platform public key. If the decryption is successful, it means that the second ONVIF protocol module of the front-end device has successfully registered with the upper-level platform, and the first ONVIF protocol module of the upper-level platform and the second ONVIF protocol module of the front-end device are interoperable; The first ONVIF protocol module of the upper platform stores the front-end device certificate and the front-end device certificate key obtained when the decryption is successful in the first certificate key management module; The first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device perform protocol intercommunication based on the upper-level platform private key, the upper-level platform public key, the symmetric encryption key, the front-end device private key, and the front-end device public key, including: The second GB28181 protocol module of the front-end device reads the upper-level platform public key and the upper-level platform private key from the second certificate key management module, and the first GB28181 protocol module of the upper-level platform reads the front-end device public key and the upper-level platform private key from the first certificate key management module; The first GB28181 protocol module of the upper platform reads the symmetric encryption key from the first key management module for the first time; The second GB28181 protocol module of the front-end device and the first GB28181 protocol module of the upper-level platform perform two-way authentication based on the upper-level platform public key and the front-end device private key read by the second GB28181 protocol module, and the front-end device public key, the upper-level platform private key, and the symmetric encryption key read by the first GB28181 protocol module. If the authentication is successful, the second GB28181 protocol module of the front-end device successfully registers with the upper-level platform, and the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device are interoperable; The second GB28181 protocol module of the front-end device stores the symmetric encryption key transmitted by the upper-level platform in the second certificate key management module.

2. The protocol intercommunication method according to claim 1, characterized in that: The second GB28181 protocol module of the front-end device and the first GB28181 protocol module of the upper-level platform perform two-way authentication based on the other party's public key, its own private key and the symmetric encryption key, including: The second GB28181 protocol module of the front-end device encrypts the first authentication information using the public key of the upper-level platform, carries it in the SIP registration message, and sends a two-way authentication request to the upper-level platform through the SIP registration message, wherein the first authentication information includes a random number and an upper-level platform ID; The first GB28181 protocol module of the upper platform uses the upper platform private key to decrypt the first authentication information encrypted in the SIP registration message. If the decryption is successful, the random number contained in the first authentication information is obtained, and a SIP registration success notification message is sent to the second GB28181 protocol module of the front-end device, wherein the SIP registration success notification message carries the second authentication information encrypted by the public key of the front-end device, and the second authentication information includes the random number, the front-end device ID and the symmetric encryption key, and the symmetric encryption key is obtained by the first GB28181 protocol module from the first certificate key management module; The second GB28181 protocol module of the front-end device uses the public key of the front-end device to decrypt the encrypted second authentication information in the SIP registration success notification message. If the decryption is successful, the second GB28181 protocol module of the front-end device obtains the symmetric encryption key in the second authentication information.

3. The protocol intercommunication method according to claim 1, characterized in that: The protocol intercommunication method according to claim 1, characterized in that the method further comprises: the first certificate key management module of the upper platform periodically updates the stored symmetric encryption key, and transmits the updated symmetric encryption key to the first ONVIF protocol module and the first GB28181 protocol module; When the symmetric encryption key is updated, when the first GB28181 protocol module of the upper platform sends a SIP registration success notification message to the second GB28181 protocol module of the front-end device, the SIP registration success notification message is encrypted using the original symmetric encryption key, and the encrypted SIP registration success notification message carries the new symmetric encryption key encrypted by the public key of the front-end device.

4. The protocol intercommunication method according to claim 3, characterized in that: The method also includes: the second GB28181 protocol module of the front-end device stores the new symmetric encryption key carried in the SIP registration success notification message into the second certificate key management module, the second certificate key management module of the front-end device initiates a symmetric encryption key change notification to the second ONVIF protocol module and the second media module, and transmits the changed symmetric encryption key to the second ONVIF protocol module and the second media module, so that after receiving the changed symmetric encryption key, the second ONVIF protocol module and the second media module discard the original symmetric encryption key and use the changed symmetric encryption key for current and subsequent ONVIF protocol interconnection and media stream encryption transmission.

5. A protocol intercommunication method according to any one of claims 1 to 4, characterized in that: The method also includes: when the second ONVIF protocol module and the second GB28181 protocol module of the front-end device are successfully registered with the upper-level platform, the second ONVIF protocol module of the front-end device symmetrically encrypts subsequent ONVIF functional service messages by using a symmetric encryption key, and then exchanges messages with the first ONVIF protocol module of the upper-level platform; the second GB28181 protocol module of the front-end device symmetrically encrypts subsequent SIP functional service messages by using a symmetric encryption key, and then exchanges messages with the first GB28181 protocol module of the upper-level platform.

6. A protocol intercommunication method as claimed in claim 5, characterized in that: The upper-level platform further includes a first media module, the front-end device further includes a second media module, and the method further includes media transmission, specifically: The second ONVIF protocol module or the second GB28181 protocol module of the front-end device transmits the negotiated first media transmission information to the second media module, where the first media transmission information includes the IP port, media type, and resolution of the upper-level platform, and the second media module prepares to transmit the media stream to the upper-level platform according to the media transmission information; the first ONVIF protocol module or the first GB28181 protocol module of the upper-level platform transmits the negotiated second media information to the first media module, where the second media information includes the IP port, media type, and resolution of the front-end device, and the first media module prepares to receive the media stream from the front-end device; The second media module of the front-end device encrypts the media stream to be sent to the upper-level platform using the symmetric encryption key obtained from the second certificate key management module according to the security level of the current device, and then transmits it to the upper-level platform; The first media module of the upper platform decrypts the received media stream according to the security level of the current device. If the decryption process is unsuccessful, the media frame in the current media stream is discarded. If the decryption process is successful, the media frame of the current media stream is received normally.

7. A protocol intercommunication device based on the protocol intercommunication method according to any one of claims 1 to 6, characterized in that: include: A first intercommunication device, used to implement protocol intercommunication between a first ONVIF protocol module of an upper-level platform and a second ONVIF protocol module of a front-end device based on an upper-level platform private key, an upper-level platform public key, an upper-level platform certificate, an upper-level platform certificate key, a front-end device private key, a front-end device public key, a front-end device certificate key, and a front-end device certificate; The second intercommunication device is used to realize protocol intercommunication between the first GB28181 protocol module of the upper-level platform and the second GB28181 protocol module of the front-end device based on the upper-level platform private key, the upper-level platform public key, the symmetric encryption key, the front-end device private key and the front-end device public key.

8. A video surveillance system, characterized in that: It comprises an upper-level platform, a front-end device and the protocol intercommunication device described in claim 7.

Images