Monitoring video security transmission system, method and device based on isolated transmission equipment

Abstract

The present invention proposes a surveillance video security transmission system, method and device based on isolated transmission equipment, which belongs to the field of data transmission technology. The system includes: a task management subsystem and an audio and video proxy subsystem respectively deployed in an untrusted network domain and a trusted network domain, a physically isolated data exchange system arranged between the untrusted network domain and the trusted network domain, and used for cross-domain data interaction; a task management subsystem for proxy channel configuration, policy configuration issuance and log management; an audio and video proxy subsystem for receiving, processing and forwarding signaling messages and streaming media data according to the issued policy configuration; an audio and video proxy subsystem deployed in an untrusted network domain is connected to an IP camera, a hard disk recorder and a video access platform; an audio and video proxy subsystem deployed in a trusted network domain is connected to a video access platform. The present invention uses isolated transmission equipment and audio and video protocol proxy technology to achieve cross-network transmission of surveillance traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and more particularly to a monitoring video security transmission system, method and device based on isolated transmission equipment. Background Art

[0002] With the vigorous development of Internet applications, the evolution of image compression coding and streaming media technology, and the substantial improvement of system image processing capabilities, network video surveillance services have developed rapidly. The implementation of various video surveillance projects has pushed the importance of public security video surveillance to an unprecedented level. Since the monitoring network and the office network are usually two physically isolated networks, it is urgent to develop technical means and equipment that support cross-network transmission of audio and video to meet the needs of the office network to call and control monitoring images in real time.

[0003] Currently, the existing audio and video cross-domain transmission technologies mainly include the following three methods:

[0004] 1. Transparent transmission. The video transmission protocol based on IP and port transmits the external network video stream to the internal network through the port allocated at the network boundary. Among them, the video transmission protocols based on IP and port include: RTMP, RTSP, UDP, TC, RTP, HTTP-FLV, HLS, DASH, etc. Among them, the video transmission protocols based on IP and port are divided into real-time transmission such as RTSP, RTMP, UDP, etc., and segmented video transmission such as HLS, DASH, HTTP-FLV, etc. Although the transparent transmission technology solution can realize cross-network transmission of audio and video traffic, port transparent transmission is not allowed in the scenario where there is physical isolation at the network boundary, resulting in the real-time video stream being unable to pass through the network boundary, resulting in the inability of the internal network and the external network to realize the function of cross-border video stream transmission.

[0005] 2. Use NAT penetration solution to achieve cross-network transmission of video surveillance. NAT penetration solution can achieve cross-network transmission of audio and video traffic in network boundaries without physical isolation, but it cannot achieve cross-network transmission of audio and video traffic in scenarios with physical isolation.

[0006] 3. Data ferrying. RS232 commands are used to control the ferrying of analog video data and the forwarding of control commands between the user's internal network and the video surveillance business network. The main disadvantage of the data ferrying solution is that the image needs to be sampled and encoded twice from the front-end acquisition to the user's internal use, resulting in a large loss of quality and a considerable gap compared to the original analog signal. Summary of the invention

[0007] In view of the above problems, the purpose of the present invention is to provide a surveillance video security transmission system, method and device based on isolated transmission equipment, which adopts isolated transmission equipment and audio and video protocol proxy technology to realize cross-network transmission of surveillance traffic.

[0008] To achieve the above-mentioned purpose, the present invention is implemented through the following technical solutions: a monitoring video security transmission system based on isolated transmission equipment, including a task management subsystem, an audio and video proxy subsystem and a physical isolation data exchange system, the task management subsystem is data connected with the audio and video proxy subsystem; the task management subsystem and the audio and video proxy subsystem are respectively deployed in an untrusted network domain and a trusted network domain; the physical isolation data exchange system is arranged between the untrusted network domain and the trusted network domain, and is used for data interaction between the audio and video proxy subsystem in the untrusted network domain and the audio and video proxy subsystem in the trusted network domain; the task management subsystem is used for proxy channel configuration, policy configuration issuance and log management; the audio and video proxy subsystem is used for receiving, processing and forwarding signaling messages and streaming media data according to the issued policy configuration; the audio and video proxy subsystem deployed in the untrusted network domain is connected to an IP camera, a hard disk recorder and a video access platform; the audio and video proxy subsystem deployed in the trusted network domain is connected to a video access platform.

[0009] Furthermore, the audio and video proxy subsystem includes: a signaling proxy module, a streaming media proxy module and a traffic forwarding module: the traffic forwarding module is used to perform cross-network signaling transmission and cross-network streaming media transmission between untrusted network domains and trusted network domains through a physically isolated data exchange system; the signaling proxy module is used to receive, process and forward signaling data for video on demand and control based on the cross-network transmission process of audio and video signaling; the streaming media proxy module is used to receive, process and forward streaming media data based on the cross-network transmission process of audio and video media streams.

[0010] Furthermore, the physically isolated data exchange system adopts a network gate, and utilizes a built-in solid-state switch read-write medium to respectively connect data with the audio and video proxy subsystems in the untrusted network domain and the trusted network domain.

[0011] Correspondingly, the present invention also discloses a monitoring video security transmission method based on an isolation transmission device, comprising:

[0012] Execute the management configuration process through the task management subsystem to complete access configuration, task configuration, IP camera control policy configuration, and audio and video format blacklist and whitelist configuration;

[0013] The audio and video proxy subsystem executes the cross-network transmission process of audio and video signaling to control IP cameras across network domains;

[0014] The audio and video proxy subsystem is used to execute the cross-network transmission process of audio and video media streams, and video on demand is performed across network domains.

[0015] Further, the management configuration process includes:

[0016] Configure the IP information of devices in the untrusted domain that are allowed to access;

[0017] Configure the task in the task management subsystem and configure the target IP address and port information of the trusted domain;

[0018] According to the requirements, the control signaling of the IP camera is filtered for each task configuration; the control signaling includes: on-demand signaling, mobile signaling or video playback signaling;

[0019] According to the needs, configure the blacklist and whitelist of audio and video formats for each task to filter out illegal data.

[0020] Furthermore, the cross-network transmission process of audio and video signaling includes:

[0021] Perform server registration configuration for IP cameras and hard disk recorders, and set their registration server address to the IP address of the signaling proxy server in the untrusted domain;

[0022] In the untrusted network domain, the registration information is received through the signaling proxy module and the corresponding signaling analysis is performed, and the signaling modification processing is performed according to the task configuration;

[0023] After the signaling is modified, the signaling proxy module forwards the signaling to the physically isolated data exchange system through the traffic forwarding module, and completes the cross-domain transmission of the signaling data through the physically isolated data exchange system;

[0024] In the trusted network domain, the traffic forwarding module receives the signaling data from the physically isolated data exchange system and sends it to the signaling proxy module; the signaling proxy module formulates a routing strategy according to the configuration task and forwards the signaling to the video access platform according to the routing strategy;

[0025] The video access platform receives the signaling and completes the terminal registration;

[0026] Initiate a video-on-demand request through the video access platform;

[0027] Receive and process on-demand requests through the signaling proxy module;

[0028] Generate on-demand signaling data from the on-demand request and send it to the non-trusted network domain through a physically isolated data exchange system;

[0029] In the untrusted network domain, after receiving the on-demand signaling data, the signaling proxy module parses and modifies the media information in the SDP in the on-demand signaling, and changes the receiving address in the media information to the streaming media server address of the untrusted network domain;

[0030] Receive on-demand signaling through IP cameras and push the stream.

[0031] Furthermore, the cross-network transmission process of audio and video media streams includes:

[0032] A streaming proxy module that pushes streams to untrusted domains through IP cameras;

[0033] Receive and process media streams through the streaming agent module;

[0034] The media stream data is sent to the streaming media proxy module of the trusted network domain through the traffic forwarding module and the physically isolated data exchange system using a ring-shaped lock-free queue;

[0035] The streaming media proxy module of the trusted network domain receives the media stream data, and pushes the media stream according to the media stream receiving address and port sent by the signaling proxy module;

[0036] Receive and play media streams through the video access platform.

[0037] Further, the receiving and processing of the on-demand request by the signaling proxy module includes:

[0038] The signaling proxy module receives the on-demand request, parses the corresponding and extracts the media information in the SDP;

[0039] The receiving address and port of the video access platform are sent to the streaming agent module of the trusted network domain. Further, the media stream is received and processed by the streaming agent module, including:

[0040] Receive real-time video streaming data through a streaming agent module in an untrusted domain, and parse and separate audio and video data by parsing the streaming data;

[0041] Decoding, encoding and converting the video frames by the streaming agent module;

[0042] The video stream data format is filtered based on the black and white lists of audio and video data formats issued by the task management subsystem.

[0043] Accordingly, the present invention discloses a surveillance video security transmission device based on an isolation transmission device, comprising:

[0044] A memory, used for storing a surveillance video security transmission program based on an isolated transmission device;

[0045] A processor is used to implement the steps of the method for secure transmission of surveillance video based on an isolated transmission device as described in any one of the above items when executing the program for secure transmission of surveillance video based on an isolated transmission device.

[0046] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention provides a surveillance video security transmission system, method and device based on isolated transmission equipment, which realizes cross-domain video on demand, camera control, policy filtering and other functions through the cooperation of the task management subsystem, the audio and video proxy subsystem and the physically isolated data exchange system. By applying technologies such as lock-free circular queues and data packet sending to the streaming media proxy module, the transmission performance is improved; by applying multi-process programming technology, shared memory pool technology, etc. to the signaling proxy module, the concurrent processing capability of signaling processing is improved. The present invention can realize the secure transmission of video surveillance traffic in different network domains, and is particularly suitable for physically isolated network boundaries.

[0047] It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0049] Figure 1 It is a system structure diagram of a specific implementation mode of the present invention.

[0050] Figure 2 It is a method flow chart of a specific implementation mode of the present invention.

[0051] Figure 3 It is a schematic diagram of the management configuration process of a specific implementation mode of the present invention.

[0052] Figure 4 It is a schematic diagram of the cross-network transmission process of audio and video signaling according to a specific implementation mode of the present invention.

[0053] Figure 5 It is a schematic diagram of the cross-network transmission process of audio and video media streams according to a specific implementation manner of the present invention. DETAILED DESCRIPTION

[0054] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0055] See also Figure 1 As shown, this embodiment provides a surveillance video security transmission system based on an isolated transmission device, which is applied to the cross-network transmission of surveillance video between an untrusted network domain and a trusted network domain. In the figure, the bidirectional arrows are audio and video signaling flows, and the unidirectional arrows are audio and video data flows.

[0056] The system includes: a task management subsystem 1, an audio and video proxy subsystem 2 and a physical isolation data exchange system 3, and the task management subsystem 1 is data-connected with the audio and video proxy subsystem 2. The task management subsystem 1 and the audio and video proxy subsystem 2 are respectively deployed in an untrusted network domain and a trusted network domain, and the physical isolation data exchange system 3 is arranged between the untrusted network domain and the trusted network domain, and is used for data interaction between the audio and video proxy subsystem 2 in the untrusted network domain and the audio and video proxy subsystem 2 in the trusted network domain.

[0057] Task management subsystem 1 is used for proxy channel configuration, policy configuration delivery and log management.

[0058] The audio and video proxy subsystem 2 is used to receive, process, and forward signaling messages and streaming media data according to the issued policy configuration. The audio and video proxy subsystem 2 deployed in the untrusted network domain is connected to the IP camera 4, the hard disk recorder 5, and the video access platform 6; the audio and video proxy subsystem 2 deployed in the trusted network domain is connected to the video access platform 6.

[0059] In a specific implementation, the audio and video proxy subsystem 2 includes: a signaling proxy module 21 , a streaming media proxy module 22 and a traffic forwarding module 23 .

[0060] The traffic forwarding module 23 is used to perform cross-network transmission of signaling and cross-network transmission of streaming media between the untrusted network domain and the trusted network domain through the physically isolated data exchange system.

[0061] The signaling proxy module 21 is used to receive, process and forward signaling data for video on demand and control based on the cross-network transmission process of audio and video signaling.

[0062] The streaming media proxy module 22 is used to receive, process and forward streaming media data based on the cross-network transmission process of audio and video media streams.

[0063] The physical isolation data exchange system 3 adopts a network gate and uses a built-in solid-state switch read-write medium to respectively connect the data with the audio and video proxy subsystems in the untrusted network domain and the trusted network domain.

[0064] The physical isolation data exchange system 3 is an information security device that uses a solid-state switch read-write medium with multiple control functions to connect two independent host systems. Since there is no physical connection and logical connection for communication between the two independent host systems connected by the physical isolation data exchange system 3, there is no information packet forwarding based on the protocol, and there is only the protocol-free "ferrying" of data files. Therefore, the physical isolation data exchange system 3 is physically isolated, which solves the problem that NAT and transparent transmission technology solutions cannot penetrate the physically isolated network. At the same time, the video stream transmitted by this system is a digital signal rather than an analog signal, and there is no problem of serious video quality loss.

[0065] When in use, the audio and video proxy subsystem 2 deployed in the trusted network domain can receive the signaling data of video on demand and control, and forward it to the physically isolated data exchange system 3 through the traffic forwarding module 23. Finally, the physically isolated data exchange system 3 forwards the signaling data such as video on demand to the IP camera 4 or video access platform 6 in the untrusted network domain. After receiving the on-demand signaling, the IP camera 4 or video access platform 6 in the untrusted network domain starts to push the video stream to the audio and video proxy subsystem 2 deployed in the untrusted network domain. After receiving the audio and video data traffic, the audio and video proxy subsystem 2 deployed in the untrusted network domain forwards it to the physically isolated data exchange system 3 and finally forwards it to the video access platform 6 in the trusted network domain for video playback.

[0066] Based on the above system architecture, see Figure 2 As shown, the present invention also discloses a monitoring video security transmission method based on an isolation transmission device, comprising the following steps:

[0067] S1: Execute the management configuration process through the task management subsystem to complete the access configuration, task configuration, IP camera control policy configuration, and audio and video format blacklist and whitelist configuration.

[0068] S2: The audio and video proxy subsystem executes the cross-network transmission process of audio and video signaling to control IP cameras across network domains.

[0069] S3: The audio and video proxy subsystem executes the cross-network transmission process of audio and video media streams to perform cross-domain video on demand.

[0070] In a specific embodiment, Figure 3 As shown in the figure, the specific steps of the management configuration process are as follows:

[0071] S101: Configure IP information of devices in the untrusted domain that are allowed to access.

[0072] As an example, the purpose of this step is to implement access configuration. Configure the IP information of devices in the non-trusted domain that are allowed to access, and the traffic of unauthorized devices will not be transmitted across the network.

[0073] S102: Perform task configuration in the task management subsystem, and configure the target IP address and port information of the trusted network domain.

[0074] As an example, the task management subsystems on both sides of the network are used to configure tasks, mainly configuring the target IP address, port and other information of the trusted network domain. Unlike ordinary TCP and other protocol proxies, this system does not establish a unique channel between the client IP and the server IP. This system forwards audio and video traffic across the network based on the IP address of the video platform in the trusted network domain. When there are multiple cameras and video access platforms in the untrusted network domain, there is no need to configure multiple tasks.

[0075] S103: Filter the control signaling of the IP camera for each task configuration according to the requirements.

[0076] The control signaling includes: on-demand signaling, mobile signaling or video playback signaling.

[0077] As an example, whether to filter the control signaling can be configured for each task, such as on-demand, mobile, video playback, etc., and different policy controls can be performed according to the authority of the administrator.

[0078] S104: According to the requirements, configure the blacklist and whitelist of audio and video formats for each task to filter out illegal data.

[0079] As an example, a blacklist and whitelist of audio and video formats can be configured for each task, allowing only audio and video traffic in a specific format to be transmitted across the network, thereby filtering out illegal data.

[0080] In a specific embodiment, Figure 4 As shown in the figure, the specific steps of the cross-network transmission process of audio and video signaling are as follows:

[0081] S201: Perform server registration configuration for the IP camera and the hard disk video recorder, and set the registration server address thereof to the IP address of the signaling proxy server of the non-trusted network domain.

[0082] S202: In the untrusted network domain, the registration information is received through the signaling proxy module, and corresponding signaling analysis is performed, and signaling modification processing is performed according to the task configuration.

[0083] As an example, the signaling proxy module is one of the core systems of this system. The signaling proxy module of the non-trusted network domain only opens specific ports to receive and forward signaling data according to the configuration of the task management subsystem. After receiving the registration message, the signaling proxy module will parse the signaling and discard non-standard protocols. After the signaling parsing is completed, the signaling will be modified according to the task configuration issued by the front end, such as adding a return route.

[0084] S203: After the signaling is modified, the signaling proxy module forwards the signaling to the physically isolated data exchange system through the traffic forwarding module, and completes the cross-domain transmission of the signaling data through the physically isolated data exchange system.

[0085] S204: In the trusted network domain, the signaling data received from the physically isolated data exchange system is sent to the signaling proxy module through the traffic forwarding module; the signaling proxy module formulates a routing strategy according to the configuration task and forwards the signaling to the video access platform according to the routing strategy.

[0086] As an example, the traffic forwarding module of the trusted network domain will receive the signaling data from the physically isolated data exchange system and send it to the signaling proxy module of the trusted network domain. After receiving the registration signaling, the signaling proxy module will formulate a routing strategy according to the task configured by the task management subsystem and forward the signaling to the video access platform according to the routing strategy.

[0087] S205: The video access platform receives the signaling and completes terminal registration.

[0088] As an example, when the video access platform in the trusted network domain needs to verify the registration signaling sent by the terminal, it will send a verification request to the terminal, and the terminal will re-initiate the registration signaling containing the authentication information to complete the registration.

[0089] S206: Initiate a video-on-demand request through the video access platform.

[0090] As an example, the video access platform in the trusted network domain can initiate various operation signals such as on-demand video and IP camera control.

[0091] S207: Receive and process the on-demand request through the signaling proxy module.

[0092] As an example, after receiving the on-demand request, the signaling proxy module will parse the signaling and extract the media information in the SDP, and send the receiving address, port and other media information of the video access platform to the audio and video streaming agent in the trusted network domain.

[0093] S208: Generate on-demand signaling data from the on-demand request and send it to the non-trusted network domain through the physically isolated data exchange system.

[0094] As an example, after the signaling proxy module completes the on-demand signaling processing, it will forward the signaling to the physically isolated data exchange system through the traffic forwarding module, and complete the cross-domain transmission of the on-demand signaling data through the physically isolated data exchange system.

[0095] S209: In the untrusted network domain, after receiving the on-demand signaling data, the signaling proxy module parses and modifies the media information in the SDP in the on-demand signaling, and changes the receiving address in the media information to the streaming media server address of the untrusted network domain.

[0096] As an example, the traffic forwarding module of the untrusted network domain receives the signaling data from the gateway and sends it to the signaling proxy module of the untrusted network domain. After receiving the on-demand signaling, the signaling proxy module parses and modifies the media information in the SDP in the on-demand signaling, and changes the receiving address in the media information to the streaming media server address of the untrusted network domain.

[0097] S210: Receive on-demand signaling through the IP camera and push the stream.

[0098] Specifically, after receiving the on-demand signaling, the IP camera starts streaming according to the media description information in the signaling.

[0099] In a specific embodiment, Figure 5 As shown in the figure, the specific steps of the cross-network transmission process of audio and video media streams are as follows:

[0100] S301: Push the stream to the streaming media proxy module of the untrusted domain through the IP camera.

[0101] As an example, after receiving the on-demand signaling, the IP camera pushes the stream to the streaming media corresponding to the IP address according to the media description information in the signaling. During the on-demand signaling transmission process, the signaling proxy module has changed the IP address to the IP of the audio and video streaming media proxy, so the media stream will be directly pushed to the streaming media proxy in the untrusted domain.

[0102] S302: Receive and process media streams through the streaming agent module.

[0103] As an example, after receiving the real-time video streaming data, the streaming agent module of the untrusted domain will parse the streaming data, parse and separate the audio and video data. The streaming agent module can decode, encode, convert, etc. the video frames, and the black and white lists of the audio and video data formats issued by the task management subsystem can implement data format filtering, only allowing the data in the video format to be transmitted, and discarding the illegal data, further improving data security.

[0104] S303: The media stream data is sent to the streaming media proxy module of the trusted network domain through the traffic forwarding module and the physically isolated data exchange system using a ring-shaped lock-free queue.

[0105] As an example, the streaming proxy module of the untrusted network domain sends legitimate data to the physically isolated data exchange system through the traffic forwarding module. Due to the huge amount of media stream data, in order to improve the transmission efficiency and transmission performance, the traffic forwarding module uses a ring-shaped lock-free queue and performs a small amount of packet grouping, that is, several data packets are grouped and sent together, rather than sending a data packet without a data packet.

[0106] S304: The streaming media proxy module in the trusted network domain receives the media stream data, and pushes the media stream according to the media stream receiving address and port sent by the signaling proxy module.

[0107] As an example, the streaming media proxy module of the trusted network domain receives the media stream pushed by the IP camera through the traffic forwarding module, and pushes the media stream according to the media stream receiving address and port sent by the signaling proxy module.

[0108] S305: Receive and play the media stream through the video access platform.

[0109] The present invention discloses a surveillance video security transmission method based on an isolated transmission device, which realizes functions such as video on demand, camera control, and policy filtering across network domains. By applying technologies such as lock-free circular queues and data packet transmission to the streaming media proxy module, the transmission performance is improved; by applying multi-process programming technology, shared memory pool technology, etc. to the signaling proxy module, the concurrent processing capability of signaling processing is improved.

[0110] The present invention also discloses a surveillance video security transmission device based on an isolated transmission device, comprising a processor and a memory; wherein, when the processor executes a surveillance video security transmission program based on an isolated transmission device stored in the memory, the steps of the surveillance video security transmission method based on an isolated transmission device as described in any one of the above items are implemented.

[0111] Furthermore, the surveillance video security transmission device based on the isolation transmission device in this embodiment may also include:

[0112] The input interface is used to obtain the surveillance video security transmission program based on the isolated transmission device imported from the outside, and save the obtained surveillance video security transmission program based on the isolated transmission device to the memory. It can also be used to obtain various instructions and parameters transmitted by the external terminal device and transmit them to the processor so that the processor can use the above various instructions and parameters to carry out corresponding processing. In this embodiment, the input interface can specifically include but is not limited to a USB interface, a serial interface, a voice input interface, a fingerprint input interface, a hard disk reading interface, etc.

[0113] The output interface is used to output various data generated by the processor to the terminal device connected thereto, so that other terminal devices connected to the output interface can obtain various data generated by the processor. In this embodiment, the output interface may specifically include but is not limited to a USB interface, a serial interface, etc.

[0114] The communication unit is used to establish a remote communication connection between the surveillance video security transmission device based on the isolation transmission device and the external server, so that the surveillance video security transmission device based on the isolation transmission device can mount the image file to the external server. In this embodiment, the communication unit may specifically include but is not limited to a remote communication unit based on wireless communication technology or wired communication technology.

[0115] The keyboard is used to obtain various parameter data or instructions input by the user by tapping the keycaps in real time.

[0116] The display is used to display in real time the relevant information of the monitoring video security transmission process based on the isolation transmission equipment.

[0117] The mouse can be used to assist users in inputting data and simplify user operations.

[0118] In summary, the present invention uses isolation transmission equipment and audio and video protocol proxy technology to achieve cross-network transmission of monitoring traffic.

[0119] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. As for the method disclosed in the embodiment, since it corresponds to the system disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0120] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0121] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0122] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0123] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0124] The above is a detailed introduction to the surveillance video security transmission system, method and device based on the isolated transmission equipment provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A surveillance video security transmission method based on an isolated transmission device, characterized in that: The method adopts a surveillance video security transmission system based on an isolated transmission device, the system includes a task management subsystem, an audio and video proxy subsystem and a physical isolation data exchange system, and the task management subsystem is data-connected with the audio and video proxy subsystem; The task management subsystem and the audio and video proxy subsystem are deployed in the untrusted network domain and the trusted network domain respectively; The physically isolated data exchange system is arranged between the untrusted network domain and the trusted network domain, and is used for data interaction between the audio and video proxy subsystem in the untrusted network domain and the audio and video proxy subsystem in the trusted network domain; The task management subsystem is used for proxy channel configuration, policy configuration issuance and log management; The audio and video proxy subsystem is used to receive, process and forward signaling messages and streaming media data according to the issued policy configuration; The audio and video proxy subsystem deployed in the untrusted network domain is connected to an IP camera, a hard disk recorder and a video access platform; The audio and video proxy subsystem deployed in the trusted network domain is connected to the video access platform; The audio and video proxy subsystem includes: a signaling proxy module, a streaming media proxy module and a traffic forwarding module: The traffic forwarding module is used to perform cross-network transmission of signaling and cross-network transmission of streaming media between the untrusted network domain and the trusted network domain through the physically isolated data exchange system; The signaling proxy module is used to receive, process and forward signaling data for video on demand and control based on the cross-network transmission process of audio and video signaling; The streaming media proxy module is used to receive, process and forward streaming media data based on the cross-network transmission process of audio and video media streams; The physically isolated data exchange system adopts a network gate, and utilizes a built-in solid-state switch read-write medium to respectively connect data with the audio and video proxy subsystems in the untrusted network domain and the trusted network domain; The method comprises: Execute the management configuration process through the task management subsystem to complete access configuration, task configuration, IP camera control policy configuration, and audio and video format blacklist and whitelist configuration; The audio and video proxy subsystem executes the cross-network transmission process of audio and video signaling to control IP cameras across network domains; The audio and video proxy subsystem executes the cross-network transmission process of audio and video media streams to perform cross-domain video on demand; The management configuration process includes: Configure the IP information of devices in the untrusted domain that are allowed to access; Configure the task in the task management subsystem and configure the target IP address and port information of the trusted domain; According to the requirements, the control signaling of the IP camera is filtered for each task configuration; the control signaling includes: on-demand signaling, mobile signaling or video playback signaling; According to the needs, configure the blacklist and whitelist of audio and video formats for each task to filter illegal data; The cross-network transmission process of audio and video signaling includes: Perform server registration configuration for IP cameras and hard disk recorders, and set their registration server address to the IP address of the signaling proxy server in the untrusted domain; In the untrusted network domain, the registration information is received through the signaling proxy module and the corresponding signaling analysis is performed, and the signaling modification processing is performed according to the task configuration; After the signaling is modified, the signaling proxy module forwards the signaling to the physically isolated data exchange system through the traffic forwarding module, and completes the cross-domain transmission of the signaling data through the physically isolated data exchange system; In the trusted network domain, the traffic forwarding module receives the signaling data from the physically isolated data exchange system and sends it to the signaling proxy module; the signaling proxy module formulates a routing strategy according to the configuration task and forwards the signaling to the video access platform according to the routing strategy; The video access platform receives the signaling and completes the terminal registration; Initiate a video-on-demand request through the video access platform; Receive and process on-demand requests through the signaling proxy module; Generate on-demand signaling data from the on-demand request and send it to the non-trusted network domain through a physically isolated data exchange system; In the untrusted network domain, after receiving the on-demand signaling data, the signaling proxy module parses and modifies the media information in the SDP in the on-demand signaling, and changes the receiving address in the media information to the streaming media server address of the untrusted network domain; Receive on-demand signaling through IP cameras and push the stream; The cross-network transmission process of the audio and video media stream includes: A streaming proxy module that pushes streams to untrusted domains through IP cameras; Receive and process media streams through the streaming agent module; The media stream data is sent to the streaming media proxy module of the trusted network domain through the traffic forwarding module and the physically isolated data exchange system using a ring-shaped lock-free queue; The streaming media proxy module of the trusted network domain receives the media stream data, and pushes the media stream according to the media stream receiving address and port sent by the signaling proxy module; Receive and play media streams through the video access platform.

2. The method for securely transmitting surveillance video based on an isolated transmission device according to claim 1, characterized in that: The receiving and processing of the on-demand request by the signaling proxy module includes: The signaling proxy module receives the on-demand request, parses the corresponding and extracts the media information in the SDP; The receiving address and port of the video access platform are sent to the streaming agent module in the trusted network domain.

3. The method for securely transmitting surveillance video based on an isolated transmission device according to claim 1, characterized in that: Receiving and processing the media stream through the streaming agent module includes: Receive real-time video streaming data through a streaming agent module in an untrusted domain, and parse and separate audio and video data by parsing the streaming data; Decoding, encoding and converting the video frames by the streaming agent module; The video stream data format is filtered based on the black and white lists of audio and video data formats issued by the task management subsystem.

4. A surveillance video security transmission device based on an isolated transmission device, characterized in that: include: A memory, used for storing a surveillance video security transmission program based on an isolated transmission device; A processor is used to implement the steps of the surveillance video security transmission method based on the isolation transmission device as described in any one of claims 1 to 3 when executing the surveillance video security transmission program based on the isolation transmission device.

Images