Methods, apparatus, and computer program products for providing and verifying digital signatures

Abstract

Verification of signatures for layered encoded video streams is disclosed. Specifically, techniques for providing digital signatures to layered encoded video streams are provided. Each layer consists of encoded image frames. A digital signature for layer k=0 is provided by generating signature data for layer k=0 and generating a digital signature for layer k=0. A corresponding digital signature for each layer k=1, ..., k-1 is provided by generating signature data for each layer k=1, ..., k-1 and generating a digital signature for layer k by encrypting the signature data of layer k or its hash using the private key in the public-private key pair. The digital signatures of all layers are then provided to the video stream.

Description

Technical Field

[0001] The embodiments presented herein relate to methods, transmitters, computer programs, and computer program products for providing digital signatures to layered encoded video streams. The embodiments presented herein also relate to methods, receivers, computer programs, and computer program products for verifying digital signatures on layered encoded video streams. Background Technology

[0002] The increasing use of video surveillance brings with it challenges related to the storage of encoded video streams. Even when encoded using efficient compression schemes, decent-quality video streams consume storage space, both in local surveillance cameras and in centralized storage (e.g., cloud storage). Storage space is always associated with cost. Encoded video streams typically need to be stored until: 1) they have been inspected and deemed unimportant, or 2) the relevant time period has passed. For some equipment, the time period in question can be defined by legislation. A common rule is to store encoded video streams for as long as possible and apply some form of trimming once no more storage is available. Trimming, as discussed here, refers to the process of removing video frames or sequences from an encoded video stream to reduce file size; in some technical descriptions, this is called thinning. Inevitably, removing video frames or sequences from an encoded video stream can lead to the stream being considered tampered with. The removal of video frames or sequences can also be unintentional. Another example is adversary trimming or other types of malicious tampering of the encoded video stream. The purpose of such malicious tampering may be to remove video frames or video sequences containing information detrimental to the adversary. Therefore, trimming is an example of tampering with encoded video streams.

[0003] Therefore, the ability to accurately identify tampered encoded frames, or the location where encoded frames have been removed, is important not only in the case of pruning, but also for identifying other types of tampering.

[0004] Various video security systems implement watermarking in various forms at the source; however, these watermarking techniques are easily bypassed. As noted in US2014 / 0010366A1, without comprehensive video security systems, fraudulent videos become widespread, posing serious challenges to security personnel, network administrators, and company managers. Protocols should be developed to verify that videos have not been tampered with since their creation at their source.

[0005] Therefore, US2014 / 0010366A1 discloses a system and method for providing encrypted video verification. Two documents are generated. The first document includes hashes of all frames from one or more Groups of Pictures (GOPs). The second document includes hashes of only I-frames from one GOP. Each document can be signed with the camera's private key before being transmitted over the network. The second document can be used to verify I-frames when the video is refined / trimmed by removing P-frames and B-frames.

[0006] However, once a P-frame or B-frame is trimmed, only the second document is relevant. This means that only the I-frame can be trusted and should be rendered. If the GOP length is, for example, 2 seconds, and all P-frames or B-frames are trimmed, this means an I-frame is sent every 2 seconds, and therefore the frame rate drops to 0.5 frames per second. With 2 seconds between trimmed frames for rendering, various pieces of information in the video sequence may be lost. One possible remedy for this information loss is to change the GOP format used, so that I-frames are encoded more frequently and thus sent more frequently. However, this significantly increases the bitrate. Therefore, improved encrypted video verification is needed. Summary of the Invention

[0007] One objective of this embodiment is to verify layered encoded video streams.

[0008] According to the first aspect, a method is proposed for providing digital signatures to a video stream that is layered and encoded in layers k = 0, ..., K-1. Each of the K layers consists of encoded image frames. The method is performed by a transmitter. The transmitter has access to a public-private key pair. The method includes providing a digital signature for layer k = 0 by generating signature data for layer k = 0 by hashing the encoded image frames of layer k = 0, and generating a digital signature for layer k = 0 by encrypting the signature data of layer k = 0 or its hash using the private key in the public-private key pair. The method includes: for each layer k = 1, ..., K-1, providing a corresponding digital signature for each layer k = 1, ..., K-1 by the following steps: generating signature data for layer k by hashing the encoded image frames of layer k and the links to any layer k = 0 to layer k-1 that layer k depends on, and generating a digital signature for layer k by encrypting the signature data of layer k or its hash using the private key in the public-private key pair. The method includes providing digital signatures for all K layers to the video stream.

[0009] According to the second aspect, a transmitter is provided for providing digital signatures to video streams encoded in layers k = 0, ..., K-1. Each of the K layers consists of encoded image frames. The transmitter has access to a public-private key pair. The transmitter includes processing circuitry. This processing circuitry is configured to generate signature data for layer k = 0 by hashing the encoded image frame (220a) of layer k = 0, and to generate a digital signature for layer k = 0 by encrypting the signature data of layer k = 0 or its hash using the private key in the public-private key pair, thereby enabling the transmitter to provide digital signatures for layer k = 0. The processing circuitry is configured to generate signature data for each layer k = 1, ..., K-1 by hashing the encoded image frame of layer k and the links to any layer from k = 0 to k-1 that layer k depends on, thereby enabling the transmitter to provide a corresponding digital signature for each layer k = 1, ..., K-1. The processing circuitry is configured to enable the transmitter to generate a digital signature for layer k by encrypting the signature data or its hash using the private key from the public-private key pair. The processing circuitry is also configured to enable the transmitter to provide digital signatures for all K layers to the video stream.

[0010] According to the third aspect, a computer program is provided for providing a digital signature to a layered encoded video stream, the computer program including computer program code that, when run on the processing circuitry of a transmitter, causes the transmitter to perform the method according to the first aspect.

[0011] According to the fourth aspect, a method for verifying digital signatures of video streams layered and encoded in layers k = 0, ..., K-1 is proposed. Each of the K layers consists of encoded image frames. The method is performed by a receiver. The receiver has access to the public key in the transmitter's public-private key pair. The method includes verifying the digital signature of layer k = 0 by matching the signature data of the encoded image frame of layer k = 0 with the decrypted digital signature of layer k = 0. The decrypted digital signature of layer k = 0 is decrypted from the digital signature of layer k = 0 using the public key. The method also includes verifying the corresponding digital signatures of layers k = 1, ..., K-1 by matching the signature data of the encoded image frame of layer k and the link to any layer k = 0 to k-1 that layer k depends on with the decrypted digital signature of layer k. The decrypted digital signature of layer k = 0 is decrypted from the digital signature of layer k using the public key.

[0012] According to the fifth aspect, a receiver is provided for verifying the digital signature of a video stream layered and encoded in layers k = 0, ..., K-1. Each of the K layers consists of encoded image frames. The receiver has access to the public key in the transmitter's public-private key pair. The receiver includes processing circuitry. The processing circuitry is configured to enable the receiver to verify the digital signature of layer k = 0 by verifying that the signature data of the encoded image frame of layer k = 0 matches the decrypted digital signature of layer k = 0. The decrypted digital signature of layer k = 0 is decrypted from the digital signature of layer k = 0 using the public key. The processing circuitry is also configured to enable the receiver to verify the corresponding digital signature of layer k = 1, ..., K-1 by verifying that the signature data of the encoded image frame of layer k and the link to any layer k = 0 to k-1 that layer k depends on matches the decrypted digital signature of layer k. The decrypted digital signature of layer k is decrypted from the digital signature of layer k using the public key.

[0013] According to the sixth aspect, a computer program for verifying digital signatures of layered encoded video streams is provided, the computer program including computer program code that, when run on the processing circuitry of a receiver, causes the receiver to perform the method according to the fourth aspect.

[0014] According to the seventh aspect, a computer program product is provided, including a computer program according to at least one of the third and sixth aspects, and a computer-readable storage medium storing the computer program. The computer-readable storage medium may be a non-transitory computer-readable storage medium.

[0015] Advantageously, these aspects enable the verification of layered encoded video streams.

[0016] Advantageously, these aspects enable a video stream consisting of several layers to be verified by the receiver, regardless of the number of layers received by the receiver.

[0017] Advantageously, these features allow for the continuous removal of different layers from a video stream while still enabling verification of the layers that are retained.

[0018] Other objects, features and advantages of the appended embodiments will become apparent from the following detailed disclosure, the appended dependent claims and the accompanying drawings.

[0019] Generally, all terms used in the claims should be interpreted according to their ordinary meaning in the technical field, unless otherwise expressly defined herein. All references to “a / the element, device, component, means, module, step, etc.” should be interpreted as referring to at least one instance of an element, device, component, means, module, step, etc., unless otherwise expressly stated. The steps of any method disclosed herein are not necessarily performed in the exact order disclosed, unless expressly stated. Attached Figure Description

[0020] The concept of the invention will now be described by way of example with reference to the accompanying drawings, in which:

[0021] Figure 1 The system according to the embodiment is illustrated schematically;

[0022] Figure 2 This is a schematic diagram of a sequence of encoded image frames in a video stream according to an embodiment;

[0023] Figure 3 This is a block diagram of the transmitter according to an embodiment;

[0024] Figure 4 and Figure 6 This is a flowchart of the method according to an embodiment;

[0025] Figure 5 This is a block diagram of a receiver according to an embodiment;

[0026] Figure 7 This is a schematic diagram of the functional units of the transmitter / receiver device according to an embodiment; and Figure 8 An example of a computer program product including a computer-readable device according to an embodiment is shown. Detailed Implementation

[0027] The present invention will now be described more fully with reference to the accompanying drawings, which illustrate specific embodiments of the invention. However, the concept of the invention can be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Throughout the description, the same reference numerals refer to the same elements. Any step or feature shown by dashed lines should be considered optional.

[0028] Figure 1 This is a schematic diagram illustrating a system 100 to which the embodiments presented herein may be applied. System 100 includes a transmitter 110 and a receiver 130 operatively connected to each other via a network 120. Network 120 may be wired, wireless, or partially wired and partially wireless.

[0029] The transmitter 110 is described below in various aspects. The transmitter 110 includes a camera device 112. The camera device 112 is configured to capture image frames. In some examples, the camera device 112 is a digital camera device and / or capable of panning, tilting, and zooming (PTZ), and therefore can be considered a (digital) PTZ camera device. Furthermore, the transmitter 110 is configured to encode the images so that they can be decoded using any known video coding standard, such as any of the following: High Efficiency Video Coding (HEVC), also known as H.265 and MPEG-H Part 2; Advanced Video Coding (AVC), also known as H.264 and MPEG-4 Part 10; Universal Video Coding (VVC), also known as H.266, MPEG-I Part 3, and Future Video Coding (FVC); VP9, ​​VP10, and AOMedia Video1 (AV1), to name just a few. In this respect, encoding can be performed directly in conjunction with the camera device 112 that captures image frames, or it can be performed in another entity, such as the first video processing unit 116, and then stored, at least temporarily, in the database 122. The first video processing unit 116 is configured to provide a digital signature to the video stream, which will be further disclosed below. The camera device 112 and the video processing unit 116 are operatively connected to the network 120 via a first interface entity 114.

[0030] The receiver 130 will now be disclosed in detail. The receiver 130 includes a second video processing unit 134. The second video processing unit 134 is configured to verify the digital signature of the video stream, which will be further disclosed below. The second video processing unit 134 is operatively connected to the network 120 via a second interface entity 132. Furthermore, the receiver 130 is operatively connected to a user interface device 140 via the second interface entity 132, with which a user 150 can interact. In some examples, the user interface device 140 is a display device, such as a computer monitor or screen, or a television device. In other examples, the user interface device 140 is a handheld portable device, such as a laptop computer, tablet computer, or mobile phone (also referred to as a user device).

[0031] Suppose that the video stream generated by camera device 112 will be transmitted from transmitter 110 to receiver 130 for display on user interface device 140. In some cases, it may be advantageous to enable receiver 130 to verify the authenticity of the video stream. One way to achieve this is to implement a signature process at transmitter 110.

[0032] An example of the signing process will be shown below.

[0033] Assume that transmitter 110 has already generated encoded image frames I0 and P 00 P 01 P02 I1, P 10 P 11 P 12 A video stream consisting of I0, I1, ..., where I0, I1, and I2 are so-called I-frames, and where P... 00 P 01 P 02 P 10 P 11 P 12 These are called P-frames. I0, P 00 P 01 and P 02 This represents the first GOP, and I1 and P... 10 P 11 and P 12 This represents the second GOP. The signing process can then be implemented by performing the following operations on each GOP.

[0034] First, each encoded image frame is hashed. Generally speaking, hashing an encoded image frame, or any data segment, involves transforming the encoded image frame into another value, typically using a hash function. In this respect, a hash function is any function that can be used to map data of arbitrary size to values ​​of fixed size. The value returned by a hash function is called a hash value, hash code, digest, or simply a hash. These values ​​are typically used to index a fixed-size table called a hash table. Non-limiting examples of hash functions are SHA, such as SHA265 and MD5. The individual hashes of the encoded image frames in the GOP are then collected in the GOPi hash list HL. i In this context, the hash h(x) of some data x is used to represent it. Therefore, the hash list HL1 of the first GOP is formed as follows:

[0035] HL1=h(I0), h(P00), h(P01), h(P02)

[0036] Similarly, the hash list HL2 of the second GOP is formed as follows:

[0037] HL2=h(I1), h(P10), h(P11), h(P12)

[0038] Optionally, the hash of the next upcoming I-frame is also included in the hash list. That is, hash h(I1) may also be included in HL1. In this respect, the hash of the next upcoming I-frame is not needed to detect whether the encoded image frame has been modified, but it can be used to detect whether the entire GOP has been moved or even removed.

[0039] Optionally, each hash list HL i Replace it with its own hash. That is, it can be replaced with h(HL).i Then, the hash list HL i Or hash h(HL) i This information can be added to, for example, a Supplemental Information Unit (SIU) of GOPi. In this disclosure, an SIU should be understood as a unit or message configured to contain supplemental information about or relating to the encoded video sequence. For example, an SIU could be a Supplemental Enhancement Information (SEI) message in H.26x encoding format, or a Metadata Open Bitstream Unit (OBU) in AV1 encoding format.

[0040] Then the hash list HL i Or hash h(HL) i The GOP's metadata, along with other possible metadata, is encrypted to form a digital signature. Therefore, one digital signature is generated for each GOP. The GOPi's digital signature is then added to the GOPi's SEI frame.

[0041] The aforementioned signature process applies only to video streams consisting of a single layer (and is therefore considered a layerless video stream). However, some of the aforementioned video codecs, such as H.265, can generate scalable video streams. This means that camera device 112 is configured to generate full-scale video streams divided into two or more layers, and is also configured to select how many of these layers will be transmitted. Therefore, if the video stream is processed according to the process in the example above, only the full-scale video stream (i.e., the video stream with all layers generated by camera device 112) can be verified by receiver 130.

[0042] Figure 2 A video stream 200 according to an embodiment is illustrated schematically. The video stream 200 is encoded in K layers, from layer k = 0 to layer K-1. Each of the K layers consists of encoded image frames, where three layers are identified using reference numerals 220a, 220b, and 220c. Figure 2 In the illustrative example, video stream 200 consists of two GOPs 210a and 210b. The first GOP 210a consists of layered encoded image frames I0 and I1. 0-1 I 0-2 P 00 P 00-1 P 00-2 P 01 P 01-1 P 01-2 P 02 P 02-1 P 02-2 Composition. The second GOP 210b consists of encoded image frames I1, I... 1-1 I 1-2 P 10 P 10-1 P 10-2 P11 P 11-1 P 11-2 P 12 P 12-1 P 12-2 composition.

[0043] In this regard, the encoded image frames I0 and P 00 P 01 P 02 I1, P 10 P 11 P 12 Represents a layer, encoding image frame I 0-1 P 00-1 P 01-1 P 02-1 I 1-1 P 10-1 P 11-1 P 12-1 This represents another layer, encoding image frame I. 0-2 P 00-2 P 01-2 P 01-2 P 02-2 I 1-2 P 10-2 P 11-2 P 12-2 This indicates another layer. Generally speaking, a video stream 200 can be encoded across K layers, from layer k=0 to layer k=K-1. Therefore, in Figure 2 In the illustrative example, K = 3. Encoded image frame 220a represents an encoded image frame at layer k = 0, encoded image frame 220b represents an encoded image frame at layer k = 1, and encoded image frame 220c represents an encoded image frame at layer k = 2.

[0044] In some non-restrictive examples, layer k = 0 is the base layer, and each layer k = 1, ..., K-1 is a corresponding enhancement layer. An enhancement layer may depend only on the base layer or on intermediate enhancement layers. That is, if there are K = 3 layers, then layer k = 2 may depend on the base layer (i.e., on layer k = 0) or the first enhancement layer (i.e., on layer k = 1).

[0045] In various applications, based on a single encoded instance, scalable video can be used to distribute the same content to multiple users 150 with different requirements and conditions. A typical example is a broadcast scenario, where the user interface devices 140 among the different users 150 may be of different types.

[0046] In this scenario, camera device 112 can generate multi-layer video streams, where, for example, a relay device in network 120 manages which layers are transmitted to which user interface devices 140. Without loss of generality, it will be assumed below that transmitter 110 knows which layers receiver 130 receives.

[0047] One objective is to enable a video stream consisting of multiple layers to be verified by the receiver 130, regardless of how many layers the receiver 130 receives. Another objective is to enable a video stream consisting of multiple layers to be verified by the receiver 130 even when different layers in the video stream are successively removed over time.

[0048] Now we will refer to Figure 3 and Figure 4 The method of providing a digital signature 340 to a video stream 200, performed by a transmitter 110, is disclosed. Figure 3 The block diagram of transmitter 110 is shown in the image. Figure 4 The document provides a flowchart of the method executed by transmitter 110. For example... Figure 2 As shown, video stream 200 is encoded in layers k = 0, ..., K-1. Each of the K layers consists of encoded image frames 220a, 220b, and 220c.

[0049] In step S102, a digital signature for layer k=0 is provided.

[0050] S102: Transmitter 110 provides a digital signature for layer k=0. Transmitter 110 first generates signature data 320 for layer k=0. Then, signature data 320 is generated by transmitter 110 hashing the encoded image frame 220a for layer k=0. For Figure 2 In the example, the signature data SD0 of the GOPi layer. i Therefore, based on the encoded image frames I0 and P 00 P 01 P 02 And I1. In Figure 3 In this process, signature data 320 is generated by hash generator 310. Other aspects of signature data 320 will be disclosed below. Then, transmitter 110 generates digital signature 340 for layer k=0 by encrypting signature data 320 or its hash using the private key in the public-private key pair. That is, signature data 320 or its hash is encrypted using the private key in the public-private key pair. In order to generate digital signature 340, transmitter 110 therefore has access to the public-private key pair. Therefore, the digital signature S0 of layer 0 GOPi. i It will be S0 i =(SD0) i ) e Or S0 i =(h(SD0)i )) e , where (y) e This indicates that the data y has been encrypted using the private key in the public-private key pair.

[0051] The digital signatures for the remaining layers k=1, ...,K-1 are shown in step S104.

[0052] S104: The transmitter 110 first generates signature data 320 for layer k by hashing the encoded image frames 220b and 220c of layer k and the links to any layer from k=0 to k-1 that layer k depends on. That is, the encoded image frames 220b and 220c of layer k and the links to any layer from k=0 to k-1 that layer k depends on are hashed. For Figure 2 The example in the example is the signature data SDK of GOPi for layer k. i Therefore, the links will be based on the encoded image frames I0-k, P00-k, P01-k, P02-k, and I1-k, as well as any layers from k=0 to k-1 that layer k depends on. One example of how to include the links is to first hash the digital signature of the layer that layer k depends on, and then add that hash to the hash list of layer k.

[0053] Then, transmitter 110 generates digital signature 340 of layer k by encrypting the signature data 320 of layer k or its hash using the private key from the public-private key pair. That is, the signature data 320 of layer k or its hash is encrypted using the private key from the public-private key pair. Therefore, the digital signature Sk of layer GOPi... i It could be Sk i =(SDk) i ) e Or Sk i =(h(SDk) i )) e .

[0054] Therefore, step S104 is performed for the remaining layers k = 1, ..., K-1. Generally, the digital signatures of layers k = 1, ..., K-1 include links to layers k = 0 or any other previous layer that layer k depends on. In this respect, different links may exist from layer k to any previous layer k = 0 to layer k-1. In some embodiments, the link to any layer from k = 0 to k-1 is any of the following: (i) the digital signature 340 of any layer from k = 0 to k-1, (ii) the signature data 320 of any layer from k = 0 to k-1, (iii) the hash of the digital signature 340 of any layer from k = 0 to k-1, and (iv) the hash of the signature data 320 of any layer from k = 0 to k-1.

[0055] exist Figure 3 In this process, all digital signatures 340 (i.e., one digital signature 340 for each of the K layers) are generated by digital signature generator 330.

[0056] S106: Transmitter 110 provides digital signatures 340 for all K layers to video stream 200.

[0057] In some embodiments, for each GOP 210a, 210b, a digital signature 340 is generated for each of the K layers. Therefore, Figure 2 The aforementioned video stream 200 can be schematically represented as follows:

[0058] I0 I 0-1 I 0-2 P 00 P 00-1 P 00-2 P 01 P 01-1 P 01-2 P 02 P 02-1 P 02-2 S0 S 0-1 S 0-2 I0 I 1-1 I 1-2 P 10 P 10-1 P 10-2 P 11 P 11-1 P 11-2 P 12 P 12-1 P 12-2 S1 S 1-1 S 1-2 I2 I 2-1 I 2-2 P 20 P 20-1 P 20-2 P 21 P 21-1 P 21-2 P 22 P 22-1 P 22-2 S2 S 2-1 S 2-2 I3 I 3-1 I 3-2 .

[0059] exist Figure 3In the illustrative example, digital signatures 340 for all K layers are provided in at least one SIU 350 of video stream 200. However, digital signatures 340 may also be provided to video stream 200 in another manner. For example, in some embodiments, all K digital signatures 340 are provided in a digital signature packet for layer k=0.

[0060] In some examples, signature data 320 is also provided to video stream 200. Signature data 320 may be provided to video stream 200 together with digital signature 340.

[0061] As described above, the signature data 320 for layer k=0 is generated by the transmitter 110 hashing the encoded image frame 220a of layer k=0, and the signature data 320 for layer k is generated by hashing the encoded image frames 220b, 220c of layer k and linking to any layer from k=0 to k-1 that layer k depends on. Different examples may exist, according to which the signature data 320 is represented. For example, the signature data 320 for layers k=0, ..., K-1 may be a hash list of all hashed encoded image frames 220a, 220b, 220c of layer k, or a hash of all hashed encoded image frames 220a, 220b, 220c of layer k.

[0062] In some embodiments, each digital signature 340 is provided to its own layer in the video stream 200. Thus, in some embodiments, when the digital signatures 340 of all K layers are provided to the video stream 200, the signature data 320 of layer k is provided to layer k = 0, ..., K-1 in the video stream 200.

[0063] In some examples, encoded image frames 220a, 220b, and 220c are provided in the video substream. Each of the K layers may have one such video substream.

[0064] The encoded image frames 220a, 220b, and 220c of each of the K layers are then transmitted along with their digital signatures 340. Specifically, in some embodiments, the transmitter 110 is configured to perform (optionally) step S108:

[0065] S108: Transmitter 110 transmits the encoded image frame 220a of layer k=0 and the digital signature 340 of layer k=0 in the video substream k=0.

[0066] Therefore, transmitting only the basic layer (i.e., layer k = 0) is equivalent to transmitting:

[0067] I0 P 00 P 01 P 02 S0 I1 P 10 P 11 P12 S1 I2 P 20 P 21 P 22 S2 I3.

[0068] Furthermore, encoded image frames 220b, 220c from any layer k = 1, ..., K-1 can also be transmitted in the video substream digital signature 340. Therefore, in some embodiments, the transmitter 110 is configured to perform (optionally) step S110:

[0069] S110: Transmitter 110 transmits coded image frames 220b, 220c of any layer in layer k = 1, ..., K-1 and digital signature 340 of layer k in video substream k.

[0070] For example, transmitting the first enhancement layer (i.e., layer k=1) can be equivalent to transmitting:

[0071] I 0-1 P 00-1 P 01-1 P 02-1 S 0-1 I 1-1 P 10-1 P 11-1 P 12-1 S 1-1 I 2-1 P 20-1 P 21-1 P 22-1 S 2-1 I 3-1 .

[0072] Now we will refer to Figure 5 and Figure 6 The method for verifying the digital signature 340 of video stream 200, performed by receiver 130, is disclosed. Figure 5 A block diagram of receiver 130 is shown. Figure 6 A flowchart of the method performed by receiver 130 is provided. It is assumed that digital signature 340 has been provided to video stream 200 by transmitter 110, as referenced above. Figure 3 and Figure 4 As disclosed above, video stream 200 is encoded in layers k = 0, ..., K-1. Each of the K layers consists of encoded image frames 220a, 220b, and 220c.

[0073] In some embodiments, all K digital signatures 340 are provided in a digital signature packet at layer k=0. Then, before the digital signatures 340 can be verified, the digital signatures 340 at layers k=0, 1, ..., K-1 are extracted from the digital signature packet. Therefore, in some embodiments, the receiver 130 is configured to perform step S202 (optionally).

[0074] S202: Receiver 130 extracts the digital signatures 340 of layer k = 0, 1, ..., K-1 from the digital signature packet.

[0075] In step S204, receiver 130 verifies the digital signature 340 for layer k=0. In this regard, for layer k=0, the following encoded image frames are of interest:

[0076] I0 P 00 P 01 P 02 S0 I1 P 10 P 11 P 12 S1 I2 P 20 P 21 P 22 S2 I3.

[0077] S204: Receiver 130 verifies the digital signature 340 of layer k=0 by matching the signature data 520 of the encoded image frame 220a of layer k=0 with the decrypted digital signature 540 of layer k=0. Figure 5 In the data signature verifier 550, verification is performed. Therefore, the digital signature 540 is first decrypted (as in the digital signature decryptor 530), and then the decrypted digital signature 540 is compared with the signature data 520 generated by the receiver 130 (as in the hash generator 510). The decrypted digital signature 540 is successfully verified only if the comparison shows that the decrypted digital signature 540 equals the signature data 520. Generally, if the verification of the decrypted digital signature fails, especially if the signature data is a hash list (not a hash of a hash list), the signature data 520 can be used. The digital signature 520 can then be verified against the received signature data. If the verification succeeds, one or more errors can be identified by comparing the hashes in the hash list. Other aspects of the signature data 520 will be disclosed below. Using the public key from the public-private key pair of the transmitter 110, the decrypted digital signature 540 at layer k=0 is decrypted from the digital signature 340 at layer k=0. Therefore, the receiver 130 has access to this public key.

[0078] In step S206, receiver 130 verifies the digital signature 340 for layers k = 1, ..., K-1. For example, for layer k = 1, the following encoded image frames are of interest:

[0079] I 0-1 P 00-1 P 01-1 P 02-1 S0 S 0-1 I 1-1 P 10-1 P 11-1 P 12-1 S1 S 1-1 I 2-1 P 20-1 P 21-1 P 22-1 S2S 2-1 I 3-1 .

[0080] S206: Receiver 130 verifies the corresponding digital signature 340 of layer k = 1, ..., K-1 by matching the signature data 520 of the encoded image frames 220b, 220c of layer k and the link to any layer k = 0 to k-1 that layer k depends on with the decrypted digital signature 540 of layer k. Figure 5 In this process, verification is performed in the data signature verifier 550. Therefore, the digital signature 540 for layers k = 1, ..., K-1 is first decrypted (as in the digital signature decryptor 530), and then the decrypted digital signature 540 for layers k = 1, ..., K-1 is compared with the signature data 520 generated by the receiver 130 for layers k = 1, ..., K-1 (as in the hash generator 510). The decrypted digital signature 540 is successfully verified only when the comparison of layers k = 1, ..., K-1 yields that the decrypted digital signature 540 equals the signature data 520.

[0081] In the same manner as described above, the signature data 520 for layer k=0 is generated by the receiver 130 hashing the encoded image frame 220a of layer k=0, and the signature data 520 for layer k is generated by hashing the encoded image frames 220b, 220c of layer k and linking to any layer from k=0 to k-1 that layer k depends on. Different examples may exist, according to which the signature data 520 is represented, in the same manner as disclosed above. For example, the signature data 520 for layers k=0, ..., K-1 may be a hash list of all hashed encoded image frames 220a, 220b, 220c of layer k, or a hash of all hashed encoded image frames 220a, 220b, 220c of layer k.

[0082] As described above, there may be different links from layer k to any previous layer k = 0 to layer k-1. In some embodiments, and in accordance with the above references Figure 3 and Figure 4The publicly disclosed content, the link to any layer from layer k=0 to layer k-1 is any of the following: (i) digital signature 340 of any layer from layer k=0 to layer k-1, (ii) signature data 320 of encoded image frames 220a and 220b of any layer from layer k=0 to layer k-1 generated by transmitter 110, (iii) signature data 320 of digital signature of any layer from layer k=0 to layer k-1 generated by transmitter 110, (iv) hash of signature data 320 of any layer from layer k=0 to layer k-1 generated by transmitter 110.

[0083] Use the public key to decrypt the decrypted digital signature 540 of layer k from the digital signature 340 of layer k.

[0084] Step S206 only needs to be performed on the layers of interest. Therefore, if there are K=3 layers, but only layers k=0 and 1 are of interest, then step S206 does not need to be performed on layer k=2.

[0085] As mentioned above, in some examples, the digital signatures 340 of all K layers are provided in at least one SIU350 of the video stream 200.

[0086] Figure 7 The illustration schematically depicts components of multiple functional units in transmitter / receiver devices 110, 130 according to embodiments. Transmitter / receiver devices 110, 130 implement the function of transmitter 110 only, receiver 130 only, or both transmitter 110 and receiver 130. They utilize components capable of executing computer programs stored in products 810a, 810b (such as…). Figure 8 The processing circuit 710 may be provided by any combination of one or more suitable central processing units (CPUs), multiprocessors, microcontrollers, digital signal processors (DSPs), etc., of the software instructions (e.g., in the form of storage medium 730). The processing circuit 710 may also be provided as at least one application-specific integrated circuit (ASIC) or field-programmable gate array (FPGA).

[0087] Specifically, the processing circuit 710 is configured to cause the transmitter / receiver devices 110, 130 to perform a set of operations or steps, as described above. For example, the storage medium 730 may store the set of operations, and the processing circuit 710 may be configured to retrieve the set of operations from the storage medium 730 to cause the transmitter / receiver devices 110, 130 to perform the set of operations. The set of operations may be provided as a set of executable instructions. Therefore, the processing circuit 710 is thus arranged to perform the methods disclosed herein.

[0088] The storage medium 730 may also include permanent memory, such as any one or a combination of magnetic memory, optical memory, solid-state memory, or even remotely mounted memory.

[0089] Transmitter / receiver devices 110, 130 may further include a communication interface 720 for communicating with other entities, functions, nodes, and devices, such as Figure 1 As shown. Thus, the communication interface 720 may include one or more transmitters and receivers, including analog and digital components.

[0090] Processing circuitry 710 controls the general operation of transmitter / receiver devices 110 and 130, for example, by sending data and control signals to communication interface 720 and storage medium 730, by receiving data and reports from communication interface 720, and by retrieving data and instructions from storage medium 730. Other components and related functions of transmitter / receiver devices 110 and 130 are omitted to avoid obscuring the concepts presented herein.

[0091] Transmitter / receiver devices 110, 130 may be provided as standalone devices or as part of at least one other device. Therefore, a first portion of the instructions executed by transmitter / receiver devices 110, 130 may be executed in a first device, while a second portion of the instructions executed by transmitter / receiver devices 110, 130 may be executed in a second device; the embodiments disclosed herein are not limited to any particular number of devices on which the instructions executed by transmitter / receiver devices 110, 130 can be executed. Therefore, the methods according to the embodiments disclosed herein are applicable to execution by transmitter / receiver devices 110, 130 residing in a cloud computing environment. Therefore, although... Figure 7 A single processing circuit 710 is shown, but the processing circuit 710 can be distributed across multiple devices or nodes. This also applies to… Figure 8 Computer programs 820a and 820.

[0092] Figure 8 An example of a computer program product 810a, 810b including a computer-readable device 830 is shown. On this computer-readable device 830, computer programs 820a, 820b may be stored, which may cause processing circuitry 710 and entities and means operatively coupled thereto (e.g., communication interface 720 and storage medium 730) to perform the methods according to the embodiments described herein. Therefore, computer programs 820a, 820b and / or computer program products 810a, 810b can provide means for performing any steps of the transmitter / receiver devices 110, 130 disclosed herein.

[0093] exist Figure 8 In the examples, computer program products 810a and 810b are illustrated as optical discs, such as CDs (compressed optical discs), DVDs (digital versatile optical discs), or Blu-ray discs. Computer program products 810a and 810b may also be implemented as memory, such as random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or electrically erasable programmable read-only memory (EEPROM), and more specifically, as non-volatile storage media of devices in external memory, such as USB (Universal Serial Bus) memory or flash memory, such as flash memory chips. Therefore, although computer programs 820a and 820b are schematically shown herein as tracks on the described optical disc, computer programs 820a and 820b may be stored in any manner suitable for computer program products 810a and 810b.

[0094] The foregoing description primarily refers to several embodiments to illustrate the concept of the invention. However, as will be readily understood by those skilled in the art, other embodiments besides those disclosed above may also fall within the scope of the concept of the invention as defined by the appended claims.

Claims

1. A method for providing digital signatures to video streams that are hierarchically encoded in layers k = 0, ..., K-1, wherein, Each of the K layers consists of encoded image frames, wherein the method is performed by a transmitter, wherein the transmitter has access to a public-private key pair, and wherein the method includes: A digital signature for base layer k=0 is provided by the following steps: generating signature data for base layer k=0 by hashing the encoded image frame of base layer k=0; and generating the digital signature for base layer k=0 by encrypting the signature data for base layer k=0 or its hash using the private key in the public-private key pair. For each enhancement layer k = 1, ..., K-1, a corresponding digital signature is provided for each enhancement layer k = 1, ..., K-1 through the following steps, characterized by: generating signature data for the enhancement layer k by hashing the encoded image frame of the enhancement layer k and a link to the base layer k = 0 or any other previous layers 1 to k-1 to which the enhancement layer k depends, wherein the link is the digital signature of the base layer k = 0 or any other previous layers 1 to k-1; and generating the digital signature of the enhancement layer k by encrypting the signature data of the enhancement layer k or its hash using the private key in the public-private key pair; and The corresponding digital signature of each layer k = 0, ..., K-1 is provided to its own layer k = 0, ..., K-1 in the video stream.

2. The method according to claim 1, wherein, The signature data for layer k = 0, ..., K-1 is either a hash list of all hash-coded image frames in layer k, or a hash of all hash-coded image frames in layer k.

3. The method according to claim 1, wherein, The video stream consists of at least one group of pictures (GOP), and for each GOP, a digital signature is generated for each of the K layers.

4. The method according to claim 1, wherein, The method further includes: transmitting the encoded image frame of base layer k=0 and the digital signature of base layer k=0 in the video substream of base layer k=0.

5. A method for verifying digital signatures of video streams hierarchically encoded in layers k = 0, ..., K-1, wherein, Each of the K layers consists of encoded image frames, wherein the method is performed by a receiver, wherein the receiver has access to the public key in the transmitter's public-private key pair, and wherein the method includes: The digital signature of base layer k=0 is verified by matching the signature data of the encoded image frame of base layer k=0 with the decrypted digital signature of base layer k=0, wherein the decrypted digital signature of base layer k=0 is decrypted from the digital signature of base layer k=0 using the public key; and For enhancement layers k = 1, ..., K-1, the corresponding digital signature of the enhancement layers k = 1, ..., K-1 is verified by the following steps, characterized in that: the signature data of the encoded image frame of the enhancement layer k and the link to the base layer k = 0 or any other previous layer 1 to k-1 on which the enhancement layer k depends are verified to match the decrypted digital signature of the enhancement layer k, the decrypted digital signature of the enhancement layer k being decrypted from the digital signature of the enhancement layer k using the public key, wherein the link is the digital signature of the base layer k = 0 or the other previous layer 1 to k-1, and wherein the corresponding digital signature of each layer k = 0, ..., K-1 is provided to its own layer k = 0, ..., K-1 in the video stream.

6. A transmitter for providing digital signatures to video streams that are layered and encoded in layers k = 0, ..., K-1, wherein, Each of the K layers consists of encoded image frames, wherein the transmitter has access to a public-private key pair, and the transmitter includes processing circuitry configured to cause the transmitter to: A digital signature for base layer k=0 is provided by the following steps: generating signature data for base layer k=0 by hashing the encoded image frame of base layer k=0; and generating the digital signature for base layer k=0 by encrypting the signature data for base layer k=0 or its hash using the private key in the public-private key pair. For each enhancement layer k = 1, ..., K-1, a corresponding digital signature is provided for each enhancement layer k = 1, ..., K-1 through the following steps, characterized by: generating signature data for the enhancement layer k by hashing the encoded image frame of the enhancement layer k and a link to the base layer k = 0 or any other previous layers 1 to k-1 to which the enhancement layer k depends, wherein the link is the digital signature of the base layer k = 0 or any other previous layers 1 to k-1; and generating the digital signature of the enhancement layer k by encrypting the signature data of the enhancement layer k or its hash using the private key in the public-private key pair; and The corresponding digital signature of each layer k = 0, ..., K-1 is provided to its own layer k = 0, ..., K-1 in the video stream.

7. A receiver for verifying digital signatures of video streams hierarchically encoded in layers k = 0, ..., K-1, wherein, Each of the K layers consists of encoded image frames, wherein the receiver has access to the public key in the transmitter's public-private key pair, and the receiver includes processing circuitry configured to cause the receiver to: The digital signature of base layer k=0 is verified by matching the signature data of the encoded image frame of base layer k=0 with the decrypted digital signature of base layer k=0, wherein the decrypted digital signature of base layer k=0 is decrypted from the digital signature of base layer k=0 using the public key; and For enhancement layers k = 1, ..., K-1, the corresponding digital signature of the enhancement layers k = 1, ..., K-1 is verified by the following steps, characterized in that: the signature data of the encoded image frame of the enhancement layer k and the link to the base layer k = 0 or any other previous layer 1 to k-1 on which the enhancement layer k depends are verified to match the decrypted digital signature of the enhancement layer k, the decrypted digital signature of the enhancement layer k being decrypted from the digital signature of the enhancement layer k using the public key, wherein the link is the digital signature of the base layer k = 0 or the other previous layer 1 to k-1, and wherein the corresponding digital signature of each layer k = 0, ..., K-1 is provided to its own layer k = 0, ..., K-1 in the video stream.

8. A computer program product for providing digital signatures to video streams encoded in layers k = 0, ..., K-1, wherein, Each of the K layers consists of encoded image frames, and the computer program product includes computer code that, when run on the processing circuitry of a transmitter with access to a public-private key pair, causes the transmitter to: A digital signature for base layer k=0 is provided by the following steps: generating signature data for base layer k=0 by hashing the encoded image frame of base layer k=0; And the digital signature of the base layer k=0 is generated by encrypting the signature data of the base layer k=0 or its hash using the private key in the public-private key pair; For each enhancement layer k = 1, ..., K-1, a corresponding digital signature is provided for each enhancement layer k = 1, ..., K-1 through the following steps, characterized by: generating signature data for the enhancement layer k by hashing the encoded image frame of the enhancement layer k and a link to the base layer k = 0 or any other previous layers 1 to k-1 to which the enhancement layer k depends, wherein the link is the digital signature of the base layer k = 0 or any other previous layers 1 to k-1; and generating the digital signature of the enhancement layer k by encrypting the signature data of the enhancement layer k or its hash using the private key in the public-private key pair; and The corresponding digital signature of each layer k = 0, ..., K-1 is provided to its own layer k = 0, ..., K-1 in the video stream.

9. A computer program product for verifying digital signatures of video streams layered and encoded in layers k = 0, ..., K-1, wherein, Each of the K layers consists of coded image frames, and the computer program product includes computer code that, when run on the processing circuitry of a receiver having access to the public key of the transmitter's public-private key pair, causes the receiver to: The digital signature of the base layer k=0 is verified by verifying that the signature data of the encoded image frame of the base layer k=0 matches the decrypted digital signature of the base layer k=0, wherein the decrypted digital signature of the base layer k=0 is decrypted from the digital signature of the base layer k=0 using the public key. as well as For enhancement layers k = 1, ..., K-1, the corresponding digital signature of the enhancement layers k = 1, ..., K-1 is verified by the following steps, characterized in that: the signature data of the encoded image frame of the enhancement layer k and the link to the base layer k = 0 or any other previous layer 1 to k-1 on which the enhancement layer k depends is verified to match the decrypted digital signature of the enhancement layer k, the decrypted digital signature of the enhancement layer k being decrypted from the digital signature of the enhancement layer k using the public key, wherein the link is the digital signature of the base layer k = 0 or the other previous layer 1 to k-1, and wherein the corresponding digital signature of each layer k = 0, ..., K-1 is provided to its own layer k = 0, ..., K-1 in the video stream.

Images