Method, device and system for transmitting audio and video stream

Abstract

The embodiment of the present application provides a kind of transmission method, device and system of audio and video stream, it is related to media technical field, can promote the security of audio and video stream transmission.The method comprises: the first content key is generated by sending end, the first content key is used to encrypt audio and video stream in unicast scene;And generate the first encryption description message, the first encryption description message includes at least one of the following: the identifier of first content key, the identifier of sending end, encryption algorithm and mode, first counter information;First counter information is the high 64 of first counter;Further, sending end is based on the encryption algorithm and mode, using first content key and first counter, the first audio and video message of first audio and video stream is encrypted, and first encrypted audio and video message is obtained;And first encrypted audio and video stream containing first encrypted audio and video message and first encrypted description message is sent to first receiving end.

Description

[0001] This application is a divisional application. The original application has the application number 202380014459.4 and the original application date is March 29, 2023. The entire contents of the original application are incorporated herein by reference.

[0002] This application claims priority to the patent application filed on November 14, 2022, with application number PCT / CN2022 / 131787 and entitled "Method and Apparatus for Transmitting Audio and Video Streams", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of media technology, and in particular to a method, apparatus and system for transmitting audio and video streams. Background Technology

[0004] With the development of technology, audio and video are becoming increasingly popular, and the transmission of audio and video streams is becoming more and more frequent. During the transmission of audio and video streams, audio and video content manufacturers, audio and video service providers, broadcasting operators, IPTV operators, and terminal manufacturers all have high requirements for transmission security.

[0005] Currently, the protection standard used for audio and video stream transmission is the High-bandwidth Digital Content Protection (HDCP) standard. Based on this HDCP standard, the sending end sends the encrypted audio and video stream to the intermediate downstream device (such as an HDCP repeater). After the intermediate downstream device decrypts the audio and video stream, it re-encrypts the audio and video stream and then sends the encrypted audio and video stream to the receiving end.

[0006] In the above-mentioned audio and video stream transmission method, since intermediate downstream devices are required to encrypt and decrypt the audio and video streams, attacks on the audio and video streams may occur on these intermediate downstream devices, posing a security risk to the transmission of audio and video streams. Summary of the Invention

[0007] This application provides a method, apparatus, and system for transmitting audio and video streams, which can improve the security of audio and video stream transmission.

[0008] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0009] In a first aspect, embodiments of this application provide a method for transmitting audio and video streams, applied at a sending end. The method includes: generating a first content key, which is used to encrypt the audio and video stream in a unicast scenario; and generating a first encrypted description message, which includes an encryption algorithm and mode, and / or first counter information; the first counter information is the high 64 bits of a first counter; then, based on the encryption algorithm and mode, encrypting a first audio and video message using the first content key and the first counter to obtain a first encrypted audio and video message; the first audio and video message is a message of a first audio and video stream; and sending a first encrypted audio and video stream containing the first encrypted audio and video message and the first encrypted description message to a first receiving end.

[0010] In the audio and video stream transmission method provided in this application embodiment, after the sending end sends out the encrypted audio and video stream, other devices (such as routing devices) between the sending end and the receiving end do not decrypt and re-encrypt the encrypted audio and video stream. Compared with the prior art, the possibility of attacking the audio and video stream in intermediate downstream devices can be eliminated, thus improving the security of audio and video stream transmission.

[0011] Furthermore, in this embodiment, a content key can be generated for a specific audio / video stream. Different content keys can be used to encrypt different audio / video streams, realizing stream-based encryption and decryption. Compared with the existing end-to-end encryption and decryption mechanisms, this further improves the security of audio / video stream transmission.

[0012] In one possible implementation, the first encrypted description message further includes an identifier of the first content key and / or an identifier of the sender; the generation of the first content key includes: deriving the first content key based on the shared master key between the sender and the first receiver, the identifier of the first content key, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver.

[0013] The derivation formula for the first content key is as follows:

[0014] CK1=KDF(K m , Random_A||Random_B||ID_A||ID_B||CKId, "Unicast ContentKey", 128)

[0015] Where CK1 represents the first content key, K mTo share the master key, Random_A is a random number generated by the sender (i.e., the first random number mentioned above), Random_B is a random number generated by the receiver (i.e., the second random number mentioned above), ID_A is the sender's identifier, ID_B is the receiver's identifier (the sender obtains this identifier from the receiver's certificate), CKId is the identifier of the first content key (the sender can randomly generate a unique identifier as the identifier of the first content key), and 128 indicates that the first content key is 128 bits. The KDF algorithm is the KDF-SM3 algorithm.

[0016] In one possible implementation, sending the first encrypted audio / video message and the first encrypted description message to the first receiving end includes: carrying the first encrypted description message in the vertical blanking region of the first encrypted audio / video message to obtain the first encrypted audio / video stream, and sending the first encrypted audio / video stream to the first receiving end.

[0017] Understandably, taking a video frame in an audio / video stream as an example, a video frame includes a vertical blanking region, a horizontal blanking region, and a valid video area. Each video frame's vertical blanking region has a vertical blanking region header identifier, indicating the start of the vertical blanking region. The video frame's horizontal blanking region has a horizontal blanking region header identifier, indicating the start of the horizontal blanking region.

[0018] The aforementioned first encrypted description message can be transmitted in the vertical blanking zone. The first encrypted description message can be transmitted after the vertical blanking zone message header and before the first horizontal blanking zone message header, so as to realize frame-level content protection control of audio and video stream messages.

[0019] The transmitting adapter at the sending end can package the valid video data of video frames into valid video packets and transmit these valid video packets within the valid video area. Optionally, a content protection flag can be added to encrypted valid video packets and set to 1, while the content protection flag for unencrypted valid video packets can be set to 0.

[0020] Audio data from video and audio streams, along with configuration data related to video and audio services, can be packaged into audio data packets and transmitted within blanking zones (vertical blanking zones and / or horizontal blanking zones). Optionally, encrypted audio packets can have a content protection flag added and set to 1, while the content protection flag for unencrypted audio packets can be set to 0.

[0021] In one possible implementation, before generating the first content key, the audio / video stream transmission method provided in this application embodiment further includes: initiating an authentication and key negotiation process to the first receiving end to obtain a shared master key and a random number generated by the first receiving end.

[0022] In one possible implementation, before encrypting the first audio-visual stream with the first content key to obtain the first encrypted audio-visual stream, the audio-visual stream transmission method provided in this application embodiment further includes: authorizing the first receiving end based on the authorization control policy of the first audio-visual stream.

[0023] In this embodiment of the application, the authorization of the receiving end by the sending end specifically includes: the sending end verifies the protocol version, security level and number of receiving ends of the receiving end according to the authorization control policy, and the sending end successfully authorizes the receiving end when the following conditions 1 to 3 are met.

[0024] Condition 1: The protocol version number in the authorization control policy is greater than or equal to the protocol version number negotiated by the two parties during the authentication process.

[0025] Condition 2: The security level in the authorization control policy is less than or equal to the security level of the receiving end.

[0026] Condition 3: The upper limit of the number of receivers in the authorization control policy is less than or equal to the number of existing receivers.

[0027] In one possible implementation, the audio / video stream transmission method provided in this application further includes: randomly generating a second content key, which is used to encrypt the audio / video stream in a multicast scenario; generating a second encrypted description message, which includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter; encrypting the second audio / video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain a second encrypted audio / video message, which is a message of the first audio / video stream; then generating a key distribution message, which includes a third counter and / or a first encrypted content key, the first encrypted content key being a key obtained by encrypting the second content key based on the encryption algorithm and mode, using a first target key and the third counter; and sending the second encrypted audio / video stream, the second encrypted description message, and the key distribution message to the first receiving end and the second receiving end, respectively. This application supports unicast to multicast switching, realizing the switching of encryption mechanisms during scenario switching.

[0028] In one possible implementation, the first target key is generated based on the shared master key between the sender and the first receiver, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver; the second target key is generated based on the shared master key between the sender and the second receiver, a random number generated by the sender, a random number generated by the second receiver, the identifier of the sender, and the identifier of the second receiver.

[0029] The method for generating the first or second target key is detailed in the following formula:

[0030] CKEK=KDF(K m , Random_A||Random_B||ID_A||ID_B, "Content Key EncryptionKey", 128)

[0031] Where CKEK represents the target key, K m It is the shared master key between the sender and receiver. Random_A is the random number generated by the sender, Random_B is the random number generated by the receiver, ID_A is the identifier of the sender, and ID_B is the identifier of the receiver.

[0032] Secondly, embodiments of this application provide a method for transmitting audio and video streams, applied at a receiving end. The method includes: parsing a first encrypted audio and video stream to obtain a first encrypted audio and video message and a first encrypted description message, wherein the first encrypted description message includes an encryption algorithm and mode, and / or first counter information, wherein the first counter information is the high 64 bits of the first counter; generating a first content key based on the first encrypted description message, wherein the first content key is used to encrypt the audio and video stream in a unicast scenario; and decrypting the first encrypted audio and video message using the first content key and the first counter based on the encryption algorithm and mode to obtain a first audio and video message, wherein the first audio and video message is a message of the first audio and video stream.

[0033] In one possible implementation, the first encrypted description message further includes an identifier of the first content key and / or an identifier of the sending end; the generation of the first content key based on the first encrypted description message includes: deriving the first content key based on the shared master key between the sending end and the receiving end, the identifier of the first content key, a random number generated by the sending end, a random number generated by the receiving end, the identifier of the sending end, and the identifier of the receiving end.

[0034] In one possible implementation, the audio / video stream transmission method provided in this application further includes: performing an authentication and key negotiation process with the sending end to obtain a shared master key, the sender's identifier, and a random number generated by the sender. Specifically, the sending end performs authentication and key negotiation with the first receiving end to obtain a first shared master key, and the sending end performs authentication and key negotiation with the second receiving end to obtain a second shared master key.

[0035] In one possible implementation, the audio / video stream transmission method provided in this application further includes: a first receiving end parsing a second encrypted audio / video stream to obtain a second encrypted audio / video message, a second encrypted description message, and a first key distribution message; wherein the second encrypted description message includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter; the first key distribution message includes a third counter and / or a first encrypted content key, the first encrypted content key being a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode; and decrypting the first encrypted content key using the first target key and the third counter in the first key distribution message based on the encryption algorithm and mode to obtain a second content key; the second content key is used to encrypt the audio / video stream in a multicast scenario; and decrypting the second encrypted audio / video message using the second content key and the second counter based on the encryption algorithm and mode to obtain a second audio / video message, the second audio / video message being a message of the first audio / video stream.

[0036] In one possible implementation, the first target key is generated based on a first shared master key between the sender and the first receiver, a random number generated by the sender, a random number generated by the first receiver, an identifier of the sender, and an identifier of the first receiver. The second target key is generated based on a second shared master key between the sender and the second receiver, a random number generated by the sender, a random number generated by the second receiver, an identifier of the sender, and an identifier of the second receiver.

[0037] The technical effects of the second aspect and its various possible implementations can be referenced from the technical effects achieved by the first aspect and its possible implementations, and will not be elaborated here.

[0038] Thirdly, this application provides an embodiment of a method for transmitting audio and video streams, applied at a sending end. The method includes: randomly generating a second content key, which is used to encrypt the audio and video stream in a multicast scenario; generating an encryption description message, which includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of a second counter; encrypting a second audio and video stream based on the encryption algorithm and mode, using the second content key and the second counter, to obtain a second encrypted audio and video stream; and then generating a first key distribution message and a second key distribution message, the first key distribution message being... The message includes a third counter and / or a first encrypted content key, the first encrypted content key being a key obtained by encrypting a second content key using a first target key and a third counter based on an encryption algorithm and mode; the second key distribution message includes a fourth counter and / or a second encrypted content key, the second encrypted content key being a key obtained by encrypting a second content key using a second target key and a fourth counter based on an encryption algorithm and mode; and sends a second encrypted audio / video message containing a second encrypted audio / video message, an encrypted description message, a first key distribution message, and a second key distribution message to the first receiving end and the second receiving end respectively.

[0039] In the audio and video stream transmission method provided in this application embodiment, after the sending end sends out the encrypted audio and video stream, other devices (such as routing devices) between the sending end and the receiving end do not decrypt and re-encrypt the encrypted audio and video stream. Compared with the prior art, the possibility of attacking the audio and video stream in intermediate downstream devices can be eliminated, thus improving the security of audio and video stream transmission.

[0040] Furthermore, in this embodiment, a content key can be generated for a specific audio / video stream. Different content keys can be used to encrypt different audio / video streams, realizing stream-based encryption and decryption. Compared with the existing end-to-end encryption and decryption mechanisms, this further improves the security of audio / video stream transmission.

[0041] In one possible implementation, sending the second encrypted audio / video message, the encrypted description message, the first key distribution message, and the second key distribution message to the first receiving end and the second sending end respectively includes: carrying the encrypted description message, the first key distribution message, and the second key distribution message in the vertical blanking region of the second encrypted audio / video message to obtain the second encrypted audio / video stream, and sending the second encrypted audio / video stream to the first receiving end and the second receiving end.

[0042] In one possible implementation, before randomly generating the second content key, the audio / video stream transmission method provided in this application embodiment further includes: initiating an authentication and key negotiation process to the first receiving end to obtain a first shared master key, the identifier of the first receiving end, and a random number generated by the first receiving end; and initiating an authentication and key negotiation process to the second receiving end to obtain a second shared master key, the identifier of the second receiving end, and a random number generated by the second receiving end.

[0043] In one possible implementation, the audio / video stream transmission method provided in this application embodiment further includes: authorizing the first receiving end and the second receiving end based on the authorization control strategy of the second audio / video stream.

[0044] In one possible implementation, the first target key is generated based on the first shared master key, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver; the second target key is generated based on the second shared master key, a random number generated by the sender, a random number generated by the second receiver, the identifier of the sender, and the identifier of the second receiver.

[0045] Fourthly, embodiments of this application provide a method for transmitting audio and video streams, applied at a receiving end. The method includes: parsing a second encrypted audio and video stream to obtain a second encrypted audio and video message, an encrypted description message, and a first key distribution message; wherein the encrypted description message includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter; the first key distribution message includes a third counter and / or a first encrypted content key, the first encrypted content key being a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode; and decrypting the first encrypted content key using the first target key and the third counter in the first key distribution message based on the encryption algorithm and mode to obtain a second content key; the second content key is used to encrypt the audio and video stream in a multicast scenario; and decrypting the second encrypted audio and video message using the second content key and the second counter based on the encryption algorithm and mode to obtain the second audio and video message. The second receiving end acquires a second encrypted audio / video message, an encrypted description message, and a second key distribution message. The second key distribution message includes a fourth counter and / or a second encrypted content key. The second encrypted content key is a key obtained by encrypting the second content key using a second target key and a fourth counter based on an encryption algorithm and mode. Furthermore, based on the encryption algorithm and mode, the second encrypted content key is decrypted using the second target key and the fourth counter in the second key distribution message to obtain the second content key. The second content key is used to encrypt audio / video streams in multicast scenarios. The second receiving end also decrypts the second encrypted audio / video message using the second content key and the second counter based on the encryption algorithm and mode to obtain the second audio / video message.

[0046] In one possible implementation, the audio / video stream transmission method provided in this application embodiment further includes: a first receiving end performing an authentication and key negotiation process with a sending end to obtain a first shared master key between the sending end and the receiving end, an identifier of the first receiving end, and a random number generated by the first receiving end.

[0047] In one possible implementation, the target key is generated based on a shared master key, a random number generated by the sender, a random number generated by the receiver, the sender's identifier, and the receiver's identifier.

[0048] The technical effects of the third and fourth aspects and their various possible implementations can be referenced from the technical effects achieved by the first aspect and its possible implementations, and will not be elaborated here.

[0049] Fifthly, embodiments of this application provide a sending end, including a key management module, an encryption module, and a sending module. The key management module generates a first content key, which is used to encrypt audio / video streams in unicast scenarios; and generates a first encrypted description message, which includes an encryption algorithm and mode, and / or first counter information; the first counter information is the high 64 bits of a first counter. The encryption module encrypts a first audio / video message based on the encryption algorithm and mode, using the first content key and the first counter, to obtain a first encrypted audio / video message; the first audio / video message is a message of a first audio / video stream. The sending module is used by a first receiving end to send a first encrypted audio / video stream containing the first encrypted audio / video message and the first encrypted description message.

[0050] In one possible implementation, the first encrypted description message further includes an identifier of the first content key and / or an identifier of the sender; the key management module is specifically used to derive the first content key based on the shared master key between the sender and the first receiver, the identifier of the first content key, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver.

[0051] In one possible implementation, the sending module is specifically used to carry the first encrypted description message in the vertical blanking region of the first encrypted audio / video message to obtain the first encrypted audio / video stream, and send the first encrypted audio / video stream to the first receiving end.

[0052] In one possible implementation, the sending end provided in this application embodiment further includes an authentication module, which is used to initiate an authentication and key negotiation process to the first receiving end to obtain a shared master key and a random number generated by the first receiving end.

[0053] In one possible implementation, the sending end provided in this application embodiment further includes an authorization module, which is used to authorize the first receiving end based on the authorization control policy of the first audio and video stream.

[0054] In one possible implementation, the key management module is further configured to randomly generate a second content key, which is used to encrypt the audio and video streams in multicast scenarios; and to generate a second encryption description message, which includes an encryption algorithm and mode, and / or second counter information, wherein the second counter information is the high 64 bits of the second counter. The encryption module is further configured to encrypt the second audio and video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain a second encrypted audio and video message, which is a message of the first audio and video stream. The key management module is further configured to generate a first key distribution message and a second key distribution message. The first key distribution message includes a third counter and / or a first encrypted content key, which is a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode; the second key distribution message includes a fourth counter and / or a second encrypted content key, which is a key obtained by encrypting the second content key using a second target key and a fourth counter based on the encryption algorithm and mode. The sending module is also used to send a second encrypted audio-visual stream containing a second encrypted audio-visual message, a second encrypted description message, a first key distribution message, and a second key distribution message to the first receiving end and the second receiving end, respectively.

[0055] In one possible implementation, the first target key is generated based on the shared master key between the sender and the first receiver, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver; the second target key is generated based on the shared master key between the sender and the second receiver, a random number generated by the sender, a random number generated by the second receiver, the identifier of the sender, and the identifier of the second receiver.

[0056] Sixthly, embodiments of this application provide a receiving end, including an acquisition module, a key management module, and a decryption module. The acquisition module is used to parse a first encrypted audio / video stream to acquire a first encrypted audio / video message and a first encrypted description message. The first encrypted description message includes an encryption algorithm and mode, and / or first counter information, where the first counter information is the high 64 bits of the first counter. The key management module is used to generate a first content key based on the first encrypted description message. The first content key is used to encrypt the audio / video stream in a unicast scenario. The decryption module is used to decrypt the first encrypted audio / video message based on the encryption algorithm and mode, using the first content key and the first counter, to obtain the first audio / video message, which is the message of the first audio / video stream.

[0057] In one possible implementation, the first encrypted description message further includes an identifier of the first content key and / or an identifier of the sender; the key management module is specifically used to derive the first content key based on the shared master key between the sender and the receiver, the identifier of the first content key, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the receiver.

[0058] In one possible implementation, the receiving end provided in this application embodiment further includes an authentication module. This authentication module is used to perform an authentication and key negotiation process with the sending end to obtain a shared master key and a random number generated by the sending end. Specifically, the authentication module performs authentication and key negotiation with the first receiving end to obtain a first shared master key, and the authentication module performs authentication and key negotiation with the second receiving end to obtain a second shared master key.

[0059] In one possible implementation, the acquisition module of the first receiving end is further configured to parse the second encrypted audio / video stream to acquire a second encrypted audio / video message, a second encrypted description message, and a first key distribution message. The second encrypted description message includes an encryption algorithm and mode, and / or second counter information, where the second counter information is the high 64 bits of the second counter. The first key distribution message includes a third counter and / or a first encrypted content key, where the first encrypted content key is a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode. The key management module of the first receiving end is further configured to decrypt the first encrypted content key using the first target key and the third counter in the first key distribution message, based on the encryption algorithm and mode, to obtain a second content key. The second content key is used to encrypt the audio / video stream in a multicast scenario. The decryption module of the first receiving end is further configured to decrypt the second encrypted audio / video message using the second content key and the second counter, based on the encryption algorithm and mode, to obtain a second audio / video message, which is a message of the first audio / video stream.

[0060] In one possible implementation, the first target key is generated based on a first shared master key between the sender and the first receiver, a random number generated by the sender, a random number generated by the first receiver, an identifier of the sender, and an identifier of the first receiver. The second target key is generated based on a second shared master key between the sender and the second receiver, a random number generated by the sender, a random number generated by the second receiver, an identifier of the sender, and an identifier of the second receiver.

[0061] In a seventh aspect, embodiments of this application provide a sending end, including a key management module, an encryption module, and a sending module. The key management module is used to randomly generate a second content key, which is used to encrypt audio and video streams in multicast scenarios; and to generate an encryption description message, which includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter. The encryption module is used to encrypt a second audio and video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain a second encrypted audio and video message. The key management module is also used to generate a first key distribution message and a second key distribution message. The first key distribution message includes a third counter and / or a first encrypted content key, which is a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode; the second key distribution message includes a fourth counter and / or a second encrypted content key, which is a key obtained by encrypting the second content key using a second target key and a fourth counter based on the encryption algorithm and mode. The sending module is used to send a second encrypted audio-visual message containing a second encrypted audio-visual message, an encrypted description message, a first key distribution message, and a second key distribution message to the first receiving end and the second receiving end, respectively.

[0062] In one possible implementation, the sending module is specifically used to carry the encrypted description message, the first key distribution message, and the second key distribution message in the vertical blanking region of the second encrypted audio / video message to obtain the second encrypted audio / video stream, and send the second encrypted audio / video stream to the first receiving end and the second receiving end.

[0063] In one possible implementation, the sending end provided in this application embodiment further includes an authentication module, which is used to initiate an authentication and key negotiation process to the first receiving end to obtain a first shared master key and a random number generated by the first receiving end; and to initiate an authentication and key negotiation process to the second receiving end to obtain a second shared master key and a random number generated by the second receiving end.

[0064] In one possible implementation, the sending end provided in this application embodiment further includes an authorization module, which is used to authorize the first receiving end and the second receiving end based on the authorization control policy of the second audio and video stream.

[0065] In one possible implementation, the first target key is generated based on the first shared master key, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver; the second target key is generated based on the second shared master key, a random number generated by the sender, a random number generated by the second receiver, the identifier of the sender, and the identifier of the second receiver.

[0066] Eighthly, embodiments of this application provide a first receiving end, including an acquisition module, a key management module, and a decryption module. The acquisition module is used to parse a second encrypted audio / video stream to acquire a second encrypted audio / video message, an encrypted description message, and a key distribution message. The encrypted description message includes an encryption algorithm and mode, and / or second counter information, where the second counter information is the high 64 bits of the second counter. The key distribution message includes a third counter and / or a first encrypted content key, where the first encrypted content key is a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode. The key management module is used to decrypt the first encrypted content key using the first target key and the third counter in the first key distribution message, based on the encryption algorithm and mode, to obtain a second content key. The second content key is used to encrypt the audio / video stream in a multicast scenario. The decryption module is used to decrypt the second encrypted audio / video message using the second content key and the second counter, based on the encryption algorithm and mode, to obtain the second audio / video message.

[0067] This application embodiment also provides a second receiving end, including an acquisition module, a key management module, and a decryption module. The acquisition module is used to parse the second encrypted audio / video stream, acquiring a second encrypted audio / video message, an encrypted description message, and a second key distribution message. The second key distribution message includes a fourth counter and / or a second encrypted content key. The second encrypted content key is a key obtained by encrypting the second content key using a second target key and a fourth counter based on an encryption algorithm and mode. The key management module is used to decrypt the second encrypted content key using the second target key and the fourth counter in the second key distribution message, based on the encryption algorithm and mode, to obtain the second content key. The second content key is used to encrypt the audio / video stream in multicast scenarios. The decryption module is used to decrypt the second encrypted audio / video message using the second content key and a second counter, based on the encryption algorithm and mode, to obtain the second audio / video message.

[0068] In one possible implementation, the receiving end provided in this application embodiment further includes an authentication module, which is used to perform an authentication and key negotiation process with the sending end to obtain the shared master key between the sending end and the receiving end and the random number generated by the sending end.

[0069] In one possible implementation, the target key is generated based on a shared master key, a random number generated by the sender, a random number generated by the receiver, the sender's identifier, and the receiver's identifier.

[0070] Ninthly, embodiments of this application provide a transmitting end, including a memory and at least one processor connected to the memory. The memory is used to store computer program code, which includes computer instructions. When the computer instructions are executed by the at least one processor, the transmitting end performs the method described in any one of the first aspect, the third aspect, and their possible implementations.

[0071] In a tenth aspect, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed on a computer, perform the methods described in the first aspect, the third aspect, and their possible implementations.

[0072] Eleventhly, embodiments of this application provide a computer program product comprising computer instructions that, when executed on a computer, perform the method described in any one of the first aspect, the third aspect, and their possible implementations.

[0073] In a twelfth aspect, embodiments of this application provide a chip including a memory and a processor. The memory is used to store computer instructions, and the processor is used to call and execute the computer instructions from the memory to perform the methods described in any one of the first aspect, the third aspect, and their possible implementations.

[0074] In a thirteenth aspect, embodiments of this application provide a receiving end, including a memory and at least one processor connected to the memory. The memory is used to store computer program code, which includes computer instructions. When the computer instructions are executed by the at least one processor, the receiving end performs the method described in any one of the second aspect, the fourth aspect, and their possible implementations.

[0075] In a fourteenth aspect, embodiments of this application provide a computer-readable storage medium storing computer instructions that, when executed on a computer, perform the methods described in any one of the second aspect, the fourth aspect, and their possible implementations.

[0076] In a fifteenth aspect, embodiments of this application provide a computer program product comprising computer instructions that, when executed on a computer, perform the methods described in any one of the second aspect, the fourth aspect, and their possible implementations.

[0077] In a sixteenth aspect, embodiments of this application provide a chip including a memory and a processor. The memory is used to store computer instructions, and the processor is used to call and execute the computer instructions from the memory to perform the methods described in any one of the second aspect, the fourth aspect, and their possible implementations.

[0078] In a seventeenth aspect, embodiments of this application provide an audio / video streaming system, including a transmitting end as described in any one of the fifth, seventh, and ninth aspects and their possible implementations, and a receiving end as described in any one of the sixth, eighth, and thirteenth aspects and their possible implementations.

[0079] It should be understood that the beneficial effects of the technical solutions of the fifth to seventeenth aspects of this application and the corresponding possible implementations can be referred to the above-described technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0080] Figure 1 A schematic diagram of the framework of an audio / video streaming system based on the HDCP standard is provided for embodiments of this application;

[0081] Figure 2 One of the schematic diagrams of a video and audio streaming transmission system provided in this application embodiment;

[0082] Figure 3 A schematic diagram illustrating an authentication and key negotiation process provided for an embodiment of this application;

[0083] Figure 4 One of the schematic diagrams of an audio / video stream transmission method provided in this application embodiment;

[0084] Figure 5 A second schematic diagram of the framework of an audio / video streaming system provided in this application embodiment;

[0085] Figure 6 A second schematic diagram illustrating a method for transmitting audio and video streams provided in an embodiment of this application;

[0086] Figure 7 A third schematic diagram of the framework of an audio / video streaming system provided in this application embodiment;

[0087] Figure 8 The third schematic diagram illustrates a method for transmitting audio and video streams according to an embodiment of this application.

[0088] Figure 9 This is one of the structural schematic diagrams of a transmitting end provided in an embodiment of this application;

[0089] Figure 10 This is a second schematic diagram of the structure of a transmitter provided in an embodiment of this application;

[0090] Figure 11 This is one of the schematic diagrams of a receiving end provided in an embodiment of this application;

[0091] Figure 12This is a second schematic diagram of a receiving end provided in an embodiment of this application. Detailed Implementation

[0092] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0093] The terms "first" and "second," etc., used in the specification and claims of this application are used to distinguish different objects, rather than to describe a specific order of objects.

[0094] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0095] In the description of the embodiments in this application, unless otherwise stated, "multiple" means two or more. For example, multiple audio / video receivers refer to two or more audio / video receivers; multiple audio / video streams refer to two or more audio / video streams.

[0096] First, some concepts involved in the audio and video stream transmission method, apparatus and system provided in the embodiments of this application will be explained.

[0097] Unicast: This means that the audio / video stream sender sends the audio / video stream to a separate audio / video stream receiver.

[0098] Multicast: This refers to the sending end of an audio / video stream sending the audio / video stream to multiple audio / video stream receivers.

[0099] Figure 1 This example illustrates a framework diagram of an audio / video stream transmission system based on the HDCP standard. The system includes a transmitter 101, an intermediate downstream device 102, and one or more receivers 103. The intermediate downstream device 102 acts as a relay between the transmitter 101 and the receivers 103, and participates in the transmission of the audio / video stream. Figure 1As shown, during the transmission of audio and video streams based on the HDCP standard, the sending end 101 encrypts the audio and video stream using the key negotiated between the sending end 101 and the intermediate downstream device 102, and then sends the encrypted audio and video stream to the intermediate downstream device 102. The intermediate downstream device 102 decrypts the audio and video stream and encrypts the audio and video stream using the key negotiated between the intermediate downstream device 102 and the receiving end 103. Then, the intermediate downstream device 102 sends the encrypted audio and video stream to the receiving end 103, and the receiving end 103 decrypts and displays the audio and video stream.

[0100] Since the aforementioned intermediate downstream device 102 needs to decrypt and then encrypt the audio and video stream sent by the sending end 101, the audio and video stream is vulnerable to attacks during this period, such as being stolen or tampered with, which poses a security risk to the secure transmission of the audio and video stream.

[0101] Furthermore, in the aforementioned HDCP-based audio and video stream transmission method, the encryption and decryption mechanism for the audio and video streams is an end-to-end mechanism, combined with... Figure 1 In this end-to-end encryption / decryption mechanism, one end is the sending end 101, and the other end is the intermediate downstream device 102; alternatively, one end is the intermediate downstream device 102, and the other end is the receiving end 103. Regardless of whether a single audio / video stream or multiple audio / video streams are transmitted between the two ends, all audio / video streams use the same key. This poses a security risk; for example, if the key for one audio / video stream is stolen, the other audio / video streams will also be unprotected.

[0102] To address the problems existing in the background technology, embodiments of this application provide a method, apparatus, and system for transmitting audio and video streams. In a unicast scenario, during the transmission of audio and video streams between the sending end and the receiving end, the sending end can generate a content key for the audio and video stream, encrypt the audio and video stream using the content key, and generate an encrypted description message. The encrypted description message includes an encryption algorithm and mode for the audio and video stream, and / or counter information. Then, the sending end sends a first encrypted audio and video stream containing the encrypted audio and video stream and the encrypted description message to the receiving end. After receiving the first encrypted audio and video stream, the receiving end parses the first encrypted audio and video stream to obtain the encrypted audio and video stream and the encrypted description message, generates a content key based on the encrypted description message, and then uses the content key to decrypt the encrypted audio and video stream. In this method, after the sending end sends out the encrypted audio and video stream, other devices (such as routing devices) between the sending end and the receiving end do not decrypt and re-encrypt the encrypted audio and video stream. Compared with the prior art, the technical solution provided by the embodiments of this application eliminates the possibility of attacking the audio and video stream in intermediate downstream devices, thus improving the security of audio and video stream transmission.

[0103] In a multicast scenario, the sending end generates a content key for the audio / video stream, encrypts the audio / video stream using this content key, and generates an encryption description message and a key distribution message. The encryption description message includes the encryption algorithm and mode used to encrypt the audio / video stream, and / or counter information. The key distribution message includes the encrypted content key. The sending end then sends a second encrypted audio / video stream containing the encrypted audio / video stream, the encryption description message, and the key distribution message to the receiving end. After receiving the second encrypted audio / video stream, the receiving end parses the second encrypted audio / video stream to obtain the encrypted audio / video stream, the encryption description message, and the key distribution message. Based on the key distribution message, the receiving end obtains the content key, and then decrypts the encrypted audio / video stream based on the content key and the encryption algorithm and / or counter in the encryption description message. In this method, after the sending end sends out the encrypted audio and video stream, other devices (such as routing devices) between the sending end and the receiving end do not decrypt and re-encrypt the encrypted audio and video stream. Compared with the prior art, the technical solution provided by the embodiments of this application eliminates the possibility of attacking the audio and video stream in intermediate downstream devices, thus improving the security of audio and video stream transmission.

[0104] Furthermore, in this embodiment, a content key can be generated for a specific audio / video stream, and different content keys can be used to encrypt different audio / video streams. That is, this embodiment provides a stream-based encryption and decryption mechanism, which further improves the security of audio / video stream transmission compared with the existing end-to-end encryption and decryption mechanism.

[0105] The audio and video stream transmission method provided in this application embodiment can be applied to... Figure 2 The audio and video streaming system shown is as follows: Figure 2 As shown, the system includes a video / audio stream sender 201, a routing device 202, and a video / audio stream receiver 203. The sender 201 sends the video / audio stream to the receiver 203 through the routing device 202. The sender 201 is the starting point of the video / audio stream transmission, and the receiver 203 is the ending point. It should be noted that the routing device 202 is used to forward the video / audio stream but does not process it; for example, it does not decrypt and re-encrypt the video / audio stream.

[0106] The functional modules of the aforementioned transmitter 201 may include an authentication module 2011, an authorization module 2012, a key management module 2013, an audio / video input module 2014, and an encryption module 2015. Please refer to [reference needed] for the connection relationships between these modules. Figure 2The system comprises the following modules: an authentication module 2011 for authentication and key negotiation with the receiving end 203; an authorization module 2012 for authorization control of the receiving end 203 according to the authorization control policy of the audio / video stream (optionally, this authorization module 2012 can interface with an external system to obtain the authorization control policy); and a key management module 2013 for generating a content key for encrypting the audio / video stream, as well as generating an encryption description message and a key distribution message. An audio / video input module 2014 for receiving the audio / video stream, and an encryption module 2015 for obtaining the content key from the key management module 2013 and using the content key to encrypt the audio / video stream.

[0107] Optionally, the sender 201 also includes a management control adapter 2016 and a send adapter 2017. The management control adapter 2016 is used to package (i.e. encapsulate) and send data related to the authentication and key negotiation process performed by the sender 201. The send adapter 2017, which can also be called a send module, is used to package encrypted audio and video streams, encrypted description messages, and key distribution messages, and send the packaged audio and video streams to the receiver 203 through the audio and video stream transmission channel.

[0108] The functional modules of the receiving end 203 may include an authentication module 2031, a key management module 2032, a decryption module 2033, and an audio / video output module 2034. The authentication module 2031 is used to authenticate with the sending end 201 and negotiate keys; the key management module 2032 is used to obtain the content key for decrypting the encrypted audio / video stream based on one or more of the encrypted description message and key distribution message; the decryption module 2033 is used to obtain the content key from the key management module 2032 and use the content key to decrypt the audio / video stream; and the audio / video output module 2034 is used to output and display the decrypted audio / video stream.

[0109] Optionally, the receiver 203 also includes a management control adapter 2035 and a receiver adapter 2036. The management control adapter 2035 is used to package (i.e., encapsulate) and send data related to the authentication and key negotiation process performed by the receiver 203, while the receiver adapter 2036 is used to unpack (i.e., parse) the audio and video streams.

[0110] Combination Figure 2 It is understood that the audio and video stream transmission method provided in this application includes the following stages:

[0111] Phase 1: Authentication and key negotiation occur between the sender and receiver;

[0112] Phase Two: The sending end grants authorization control to the receiving end;

[0113] Phase 3: Sending and receiving audio and video streams.

[0114] The following sections will provide a detailed introduction to Phase 1, Phase 2, and Phase 3.

[0115] Phase 1: Authentication and Key Negotiation

[0116] In this embodiment, the sender and receiver of the audio / video streams interact based on the ECDHE protocol to complete authentication and key negotiation. The ECDHE protocol is a Diffie-Hellman (DH) key negotiation protocol based on an elliptic curve cryptography (EC) scheme. Through authentication and key negotiation, the sender verifies the receiver's certificate, and the sender and receiver negotiate to share a master key. It should be understood that the sender has a built-in root certificate (e.g., a CA root certificate) and a certificate revocation list (CRL), while the receiver has a built-in receiver certificate, a secondary certificate (e.g., a CA secondary certificate), and the receiver's private key (rxPriKey).

[0117] like Figure 3 As shown, the authentication and key negotiation process includes the following steps:

[0118] S301. The sending end generates a first random number, and generates a first private key and a first public key.

[0119] The first random number mentioned above can be denoted as Random_A, the first private key generated by the sender is denoted as txDHPrivate, and the first public key is denoted as txDHPublic.

[0120] Optionally, the sending end generates a first private key based on the ECDHE protocol, that is, the first private key meets the conditions specified in the ECDHE protocol. Then, the sending end calculates the first public key using the SM2 algorithm based on the first private key. The process of generating the first public key can be referred to the SM2 elliptic curve public key cryptography algorithm in GB / T32918.1-2016 Information Security Technology.

[0121] S302. The sending end sends an authentication exchange message (i.e., AKE_AUTHKEY_EXCHANGE message) to the receiving end, which carries the first random number and the first public key mentioned above.

[0122] S303. After receiving the authentication exchange message, the receiving end generates a second random number, and generates a second private key, a second public key, and a shared master key.

[0123] The second random number mentioned above can be denoted as Random_B, the second private key generated by the receiving end is denoted as rxDHPrivate, and the second public key is denoted as rxDHPublic. The generation methods for the second private key and the second public key are similar to the generation methods for the first private key and the first public key mentioned above.

[0124] Next, the receiving end generates a shared master key according to the Diffie-Hellman key negotiation algorithm, based on the following formula:

[0125] K m =txDHPublic^rxDHPrivate

[0126] Among them, K m This indicates a shared master key, where txDHPublic is the first public key and rxDHPrivate is the second private key.

[0127] S304. The receiving end generates a signature and authentication code.

[0128] The receiving end uses a signature algorithm (sign algorithm) to generate a signature, the specific formula of which is as follows:

[0129] signAuth=sign(Random_A‖Random_B‖txDHPublic‖rxDHPublic,rxPriKey)

[0130] In this signature, signAuth represents the recipient's signature, Random_A is the first random number, Random_B is the second random number, txDHPublic is the first public key, rxDHPublic is the second public key, rxPriKey is the recipient's private key, and "‖" is a concatenation symbol used to join the strings before and after it. Optionally, the signature algorithm can be the SM2 algorithm.

[0131] In this embodiment of the application, the receiving end generates an authentication code based on a hash-based message authentication code (HMAC) algorithm, and the specific formula is as follows:

[0132] HmacAuth=HMAC(signAuth, authKey)

[0133] Where HmacAuth represents the authentication code, signAuth is the generated signature, and authKey is the authentication key, which is derived from the shared master key. Optionally, the HMAC algorithm described above can be the HMAC-SM3 algorithm.

[0134] The receiving end generates the authKey based on the key derivation function (KDF), as shown in the following formula:

[0135] authKey = KDF(K m , Random_A‖Random_B, "HMACKey", 256)

[0136] Where authKey represents the authentication key, K m For sharing the master key, Random_A is the first random number, Random_B is the second random number, HMACKey is a fixed parameter of the HMAC algorithm, and 256 indicates that the authentication key is 256 bits. Optionally, the KDF algorithm can be the KDF-SM3 algorithm.

[0137] S305. The receiving end sends an authentication response message (i.e., AKE_AUTHKEY_ACK message) to the sending end. This authentication message includes the second random number (Random_B), the secondary certificate, the receiving end certificate, the second public key (rxDHPublic), the signature (signAuth), and the authentication code (HmacAuth).

[0138] S306. After receiving the authentication response message, the sending end verifies the certificate of the receiving end, and verifies the signature and authentication code.

[0139] First, the sending end verifies whether the receiving end's secondary certificate and receiving end certificate (which is a tertiary certificate) have been revoked based on the CRL. If the certificates have not been revoked, the sending end then verifies the receiving end's secondary certificate based on the root certificate built into the sending end. After the secondary certificate is successfully verified, the receiving end certificate is then verified based on the secondary certificate. For details regarding certificate verification, please refer to existing technologies; this application's embodiments do not provide a detailed description.

[0140] Secondly, after successful certificate verification, the sending end uses the following verification formula to verify the above signAuth:

[0141] Result=Verify(Random_A||Random_B||txDHPublic||rxDHPublic, signAuth, key1)

[0142] In this table, Result represents the verification result; a true result indicates successful verification, while a false result indicates verification failure. Random_A is the first random number, Random_B is the second random number, txDHPublic is the first public key, rxDHPublic is the second public key, signAuth is the signature to be verified, key1 represents the public key in the receiving certificate, and Verify represents the verification algorithm. It should be understood that the algorithm used to verify the signature is related to the algorithm used to generate the signature.

[0143] Before verifying HmacAuth, the sending end generates a shared master key according to the Diffie-Hellman key negotiation algorithm and the following formula:

[0144] K m =rxDHPublic^txDHPrivate

[0145] Among them, K m This represents the shared master key, where rxDHPublic is the second public key and txDHPrivate is the first private key. It should be noted that the shared master key generated by the sending end is the same as the shared master key generated by the receiving end in S303 above.

[0146] Next, the sending end derives the authentication key (authKey) according to the above formula, and calculates an authentication code based on the authentication key. It then compares the calculated authentication code with the authentication code in the received authentication effect message. If they match, the sending end successfully verifies the authentication code; otherwise, the verification fails.

[0147] S307. The sending end sends an authentication confirmation message (i.e., AKE_AUTHKEY_CONFIRM) to the receiving end. This authentication confirmation message includes a confirmation code.

[0148] The confirmation code can be represented as authComfirm, and its calculation formula is as follows:

[0149] authComfirm=HMAC(Random_A||Random_B||txDHPublic||rxDHPublic, authKey)

[0150] Wherein, authComfirm represents the confirmation code, Random_A is the first random number, Random_B is the second random number, txDHPublic is the first public key, rxDHPublic is the second public key, and authKey is the authentication key mentioned above.

[0151] S308. After receiving the authentication confirmation message, the receiving end verifies the confirmation code.

[0152] In this embodiment of the application, the receiving end also calculates the confirmation code according to the formula in S307 above, and compares whether the calculated confirmation code is consistent with the confirmation code in the received confirmation message. If they are consistent, the confirmation code verification is successful; otherwise, the verification is unsuccessful.

[0153] In summary, through S301-S308 described above, the sending end and the receiving end complete authentication and key negotiation. Specifically, as described above... Figure 2 The authentication modules at the sending and receiving ends interact to complete the authentication and key negotiation process. Through this process, the sending and receiving ends exchange random numbers and generate a shared master key. Specifically, the sending end obtains the shared master key, a first random number, and a second random number, and sets these values ​​in its key management module. Similarly, the receiving end obtains the shared master key, the first random number, and the second random number, and sets these values ​​in its key management module.

[0154] Phase Two: Authorization Control

[0155] After authentication and key negotiation are completed between the sending and receiving ends, the sending end needs to authorize the receiving end before sending the audio / video stream to the receiving end. Only after successful authorization does the sending end send the audio / video stream to the receiving end. Specifically, the sending end authorizes the receiving end according to the Rights Control Policy, the details of which are shown in Table 1 below.

[0156] Table 1

[0157] Fields describe Version Protocol version Security Level Security Level Count Maximum number of recipients

[0158] The protocol version indicates the version number of the protocol corresponding to the audio / video stream transmission method in this application embodiment. For example, the protocol version number can be 0x01, and more version numbers may be added as the protocol evolves. The security level indicates the security level that the receiving end should support. For example, the security level of a device can be divided into three levels, from low to high: L1, L2, and L3. A higher security level indicates better device security. The maximum number of receivers indicates the maximum number of receivers that can transmit video streams with the sending end.

[0159] In this embodiment of the application, the authorization of the receiving end by the sending end specifically includes: the sending end verifies the protocol version, security level and number of receiving ends of the receiving end according to the authorization control policy shown in Table 1 above. Under the condition that the following conditions 1 to 3 are met, the sending end successfully authorizes the receiving end.

[0160] Condition 1: The protocol version number in the authorization control policy is greater than or equal to the protocol version number negotiated by the two parties during the authentication process.

[0161] Condition 2: The security level in the authorization control policy is less than or equal to the security level of the receiving end.

[0162] Condition 3: The upper limit of the number of receivers in the authorization control policy is less than or equal to the number of existing receivers.

[0163] It should be noted that during the transmission of audio / video streams between the sending and receiving ends, if the sending end's authorization control policy changes, the sending end also needs to re-authorize the receiving end. For example, if the sending end receives a new authorization control policy for the current audio / video stream during transmission, it sequentially checks whether the receiving end of the current audio / video stream meets the new authorization control policy. If the receiving end meets the new authorization control policy, the authorization for that audio / video stream is successful; otherwise, the authorization for that receiving end fails. The failure of authorization for a receiving end does not affect the ability of a successfully authorized receiving end to receive the audio / video stream.

[0164] Phase 3: Sending and Receiving Audio and Video Streams

[0165] The audio and video stream transmission method provided in this application can be applied to unicast scenarios as well as multicast scenarios. The following embodiments describe the audio and video stream transmission method from the perspectives of unicast and multicast scenarios, respectively.

[0166] like Figure 4 As shown, in a unicast scenario, the audio / video stream transmission method provided in this application embodiment includes:

[0167] S401, The sending end generates the first content key.

[0168] The first content key is used to encrypt audio and video streams in unicast scenarios.

[0169] Specifically, the sending end derives the first content key based on the shared master key between the sending end and the first receiving end, the identifier of the first content key, a random number generated by the sending end, a random number generated by the first receiving end, the identifier of the sending end, and the identifier of the first receiving end. The derivation formula for the first content key is as follows:

[0170] CK1=KDF(K m , Random_A||Random_B||ID_A||ID_B||CKId, "Unicast ContentKey", 128)

[0171] Where CK1 represents the first content key, K mTo share the master key, Random_A is a random number generated by the sender (i.e., the first random number mentioned above), Random_B is a random number generated by the receiver (i.e., the second random number mentioned above), ID_A is the sender's identifier, ID_B is the receiver's identifier (the sender obtains this identifier from the receiver's certificate), CKId is the identifier of the first content key (the sender can randomly generate a unique identifier as the identifier of the first content key), and 128 indicates that the first content key is 128 bits. The KDF algorithm is the KDF-SM3 algorithm.

[0172] S402, The sending end generates the first encrypted description message.

[0173] The aforementioned first encryption description message is generated by the key management module of the sending end. The first encryption description message includes at least one of the following: an identifier of the first content key, an identifier of the sending end, an encryption algorithm and mode (the mode being the encryption algorithm's pattern), and first counter information. The first counter information consists of the high 64 bits of a first counter used for encrypting the audio and video stream. Therefore, the content key, encryption algorithm and mode, and counter used for encrypting the audio and video stream can be obtained from the first encryption description message.

[0174] Optionally, the encrypted description message may also include more content. Table 2 is a message format of the encrypted description message in the embodiments of this application.

[0175] Table 2

[0176] Fields Bit count illustrate Type 8 Data Message Types Version 8 Message version number Len 8 Message length CurCKId 14 Current content key identifier CurCKType 2 The type of content key currently in use NextCKId 14 Next content key identifier used NextCKType 2 The next type of content key to use ID_A 48 Sender's identifier EncAlgorithm 4 Encryption algorithms and modes CtrHigh 64 The high 64 bits of the counter used for encryption Reserved 20 reserve

[0177] The content key can be either unicast or multicast. For example, if CurCKType is 00b, it means that the content key is unicast and is used in a unicast scenario; if CurCKType is 01b, it means that the content key is multicast and is used in a multicast scenario.

[0178] It should be understood that the counter used for encrypting the audio / video stream is 128 bits. Table 2 above shows the high 64 bits of the counter, while the low 64 bits have a default value of 0. The high 64 bits of the counter used for encrypting the audio / video stream are generated by the sender using random numbers and are unique. Based on the initially generated high 64 bits of the counter, when a new encrypted description message is generated subsequently, the high 64 bits of the counter in the new encrypted description message are the high 64 bits of the counter in the previous encrypted description message plus 1. Optionally, the counter can be incremented by 1 after encrypting every 16 bytes of the audio / video stream message.

[0179] It should be noted that the CKId in the above formula for generating the first content key may be either CurCKId in the first encrypted description message or NextCKId.

[0180] In the first encrypted description message in S402 above, the content key is of unicast type, that is, the content key type is 00b.

[0181] Optionally, after the key management module generates the first content key and the first encrypted description message, it sets the first content key, the first counter, and the encryption algorithm into the encryption module; or, it sets the first content key and the first encrypted description message into the encryption module.

[0182] S403. The sending end, based on the encryption algorithm and mode, uses the first content key and the first counter to encrypt the first audio-visual message from the first audio-visual stream, and obtains the first encrypted audio-visual message.

[0183] In this embodiment, after receiving the audio and video signal of the first audio and video stream, the audio and video input module of the sending end packages the audio and video signal into an audio and video message (hereinafter referred to as the first audio and video message) and sends the first audio and video message to the encryption module. Then, the encryption module encrypts the first audio and video message using a first content key and a first counter according to the encryption algorithm set in the encryption module to obtain the first encrypted audio and video message. Alternatively, the encryption module obtains the first counter information and encryption algorithm and mode from the first encryption description message received by the key management module, and then encrypts the first audio and video message using the first content key and the first counter based on the encryption algorithm and mode to obtain the first encrypted audio and video message.

[0184] Optionally, the embodiments of this application may use the SM4-CTR algorithm to encrypt the first audio and video message. The SM4-CTR algorithm can be referred to the prior art, and will not be described in detail here.

[0185] S404. The sending end sends a first encrypted audio-visual stream containing a first encrypted audio-visual message and a first encrypted description message to the first receiving end.

[0186] Optionally, the sending adapter at the sending end carries the first encrypted description message in the vertical blanking region of the first encrypted audio / video message to obtain the first encrypted audio / video stream, and then sends the first encrypted audio / video stream to the first receiving end.

[0187] Understandably, taking a video frame in an audio / video stream as an example, a video frame includes a vertical blanking region, a horizontal blanking region, and a valid video area. Each video frame's vertical blanking region has a vertical blanking region header identifier, indicating the start of the vertical blanking region. The video frame's horizontal blanking region has a horizontal blanking region header identifier, indicating the start of the horizontal blanking region.

[0188] The aforementioned first encrypted description message can be transmitted in the vertical blanking zone. The first encrypted description message can be transmitted after the vertical blanking zone message header and before the first horizontal blanking zone message header, so as to realize frame-level content protection control of audio and video stream messages.

[0189] The transmitting adapter can package the valid video data of video frames into valid video packets and transmit these valid video packets within the valid video area. Optionally, a content protection flag can be added to encrypted valid video packets and set to 1, while the content protection flag for unencrypted valid video packets can be set to 0.

[0190] Audio data from video and audio streams, along with configuration data related to video and audio services, can be packaged into audio data packets and transmitted within blanking zones (vertical blanking zones and / or horizontal blanking zones). Optionally, encrypted audio packets can have a content protection flag added and set to 1, while the content protection flag for unencrypted audio packets can be set to 0.

[0191] S405. The first receiving end parses the first encrypted audio and video stream and obtains the first encrypted audio and video message and the first encrypted description message.

[0192] In this embodiment of the application, after the receiving adapter of the first receiving end receives the first encrypted audio and video stream from the sending end, it parses the first encrypted audio and video stream, obtains the first encrypted audio and video message and the first encrypted description message, and sends the first encrypted audio and video message and the first encrypted description message to the decryption module of the first receiving end, and sends the first encrypted description message to the key management module of the first receiving end.

[0193] S406. The first receiving end generates a first content key based on the first encrypted description message.

[0194] Specifically, the key management module of the first receiving end determines that the type of the first content key is unicast based on the type of the content key currently used in the first encrypted description message (i.e., CurCKType). Then, the key management module obtains the identifier of the content key currently used (i.e., CurCKId, the identifier of the first content key) and the identifier of the sending end from the first encrypted description message, derives the first content key according to the following formula, and sets the first content key to the decryption module of the first receiving end.

[0195] CK1=KDF(K m , Random_A||Random_B||ID_A||ID_B||CKId, "Unicast ContentKey", 128)

[0196] Among them, K mRandom_A and Random_B are obtained after the first receiving end and the sending end have completed authentication and key negotiation.

[0197] S407. The first receiving end decrypts the first encrypted audio and video message based on the encryption algorithm and mode, using the first content key and the first counter, to obtain the first audio and video message.

[0198] In this embodiment of the application, the decryption module of the first receiving end determines the encryption algorithm and mode, as well as the first counter, based on the first encrypted description message received from the receiving module. Then, based on the encryption algorithm and mode, it decrypts the first encrypted audio and video message using the first content key and the first counter received from the key management module, and outputs and displays the first audio and video message of the first audio and video stream obtained by decryption through its audio and video output module.

[0199] It should be noted that during the transmission of audio and video streams between the sending end and the first receiving end, the first content key needs to be updated in a timely manner in the following situations.

[0200] 1. For the first audio / video stream, the duration of use of the first content key exceeds a preset duration or the number of video frames encrypted using the first content key exceeds a preset number. For example, the duration of use of the first content key exceeds 24 hours, or the number of video frames encrypted using the first content key exceeds 2,592,000 frames.

[0201] 2. The scenario for audio and video streaming transmission has switched from unicast to multicast.

[0202] 3. In multicast scenarios, the authorization control strategy for the first audio and video stream changes.

[0203] 4. In multicast scenarios, some receivers that communicate with the sender may stop receiving the first audio and video stream, i.e., they may stop receiving the first audio and video stream.

[0204] In this embodiment, when the first content key needs to be updated, the sending end updates the four fields CurCKId, CurCKType, NextCKId, and NextCKType in the first encrypted description message. Thus, after receiving the first encrypted description message, the receiving end generates a new content key based on the four updated fields in the first encrypted description message. Alternatively, the sending end can update the NextCKId in the encrypted description message before updating the first content key. After receiving the encrypted description message, the receiving end can derive the updated content key in advance based on the key type NextCKType and NextCKId.

[0205] Optionally, the aforementioned sender can interact with multiple receivers to transmit audio and video streams. As an example, Figure 5 This is a schematic diagram illustrating the framework for transmitting audio and video streams between a sending end and a first and a second receiving end. The sending end can not only interact with the first receiving end to transmit a first audio and video stream, but also interact with the second receiving end to transmit a second audio and video stream. Specifically, the sending end can perform authentication, key negotiation, and authorization control with the second receiving end, and encrypt audio and video packets from the second audio and video stream before sending them to the second receiving end. The process of the sending end interacting with the second receiving end to transmit the second audio and video stream is similar to the process of transmitting the first audio and video stream described above, and will not be elaborated upon in this embodiment.

[0206] It should be noted that the sending end uses different content keys to encrypt different audio and video streams. For example, the sending end uses content key 1 to encrypt the first audio and video stream and content key 2 to encrypt the second audio and video stream.

[0207] In summary, in the audio and video stream transmission method provided in this application embodiment, after the sending end sends out the encrypted audio and video stream, other devices (such as routing devices) between the sending end and the receiving end do not decrypt and re-encrypt the encrypted audio and video stream. Compared with the prior art, this can eliminate the possibility of attacking the audio and video stream in intermediate downstream devices, thus improving the security of audio and video stream transmission.

[0208] Furthermore, in this embodiment, a content key can be generated for a specific audio / video stream. Different content keys can be used to encrypt different audio / video streams, realizing stream-based encryption and decryption. Compared with the existing end-to-end encryption and decryption mechanisms, this further improves the security of audio / video stream transmission.

[0209] like Figure 6 As shown, in a multicast scenario, the audio / video stream transmission method provided in this application embodiment includes:

[0210] S601, The sending end randomly generates a second content key.

[0211] In this embodiment of the application, in a multicast scenario, the sending end sends the same audio and video stream to multiple receiving ends. After the sending end performs authentication, key negotiation, and authorization control with multiple receiving ends respectively, the key management module of the sending end randomly generates a unique second content key. This second content key is used to encrypt the audio and video stream in the multicast scenario.

[0212] S602, The sending end generates an encrypted description message.

[0213] Specifically, the key management module at the sending end generates an encrypted description message, which includes the encryption algorithm and mode, and / or second counter information, specifically the high 64 bits of the second counter. The encrypted description message may also include other content; please refer to Table 2 above for the format of the encrypted description message, which will not be elaborated here. It should be noted that the content key in the encrypted description message is of multicast type, i.e., the content key type is 01b.

[0214] Similar to the unicast scenario, after the key management module at the sending end generates the second content key and the encrypted description message, the key management module sets the second content key, the first counter, and the encryption algorithm to the encryption module; or, it sets the second content key and the encrypted description message to the encryption module.

[0215] S603. The sending end, based on the encryption algorithm and mode, uses the second content key and the second counter to encrypt the second audio and video message, thus obtaining the second encrypted audio and video message.

[0216] The second audio / video message is a message of the second audio / video stream.

[0217] In this embodiment, after receiving the audio / video signal, the audio / video input module at the sending end packages the audio / video signal into an audio / video message (hereinafter referred to as the second audio / video message) and sends the second audio / video message to the encryption module. Then, the encryption module encrypts the first audio / video message using a second content key and a second counter according to the encryption algorithm set in the encryption module to obtain the first encrypted audio / video message. Alternatively, the encryption module obtains the second counter information and encryption algorithm and mode from the encryption description message received by the key management module, and then encrypts the second audio / video message using a second content key and a second counter based on the encryption algorithm and mode to obtain the second encrypted audio / video message.

[0218] S604. The sending end generates the first key distribution message and the second key distribution message.

[0219] Specifically, the key management module at the sending end generates a first key distribution message and a second key distribution message, wherein the first key distribution message corresponds to the first receiving end and the second key distribution message corresponds to the second receiving end.

[0220] The first key distribution message includes a third counter and / or a first encrypted content key, wherein the first encrypted content key is a key obtained by encrypting the second content key using a first target key and a third counter based on an encryption algorithm and mode.

[0221] The second key distribution message includes a fourth counter and / or a second encrypted content key, which is a key obtained by encrypting the second content key using a second target key and a fourth counter based on an encryption algorithm and mode.

[0222] As can be seen, in multicast scenarios, the second content key used to encrypt the audio and video streams is transmitted via a key distribution message, and the sending end encrypts the second content key before transmission. For different receiving ends, the sending end uses different target keys and counters to encrypt the second content key.

[0223] The target key used to encrypt the second content key (e.g., the first and second target keys mentioned above) is generated based on the shared master key between the sender and receiver, a random number generated by the sender, a random number generated by the receiver, the sender's identifier, and the receiver's identifier. See the following formula for details:

[0224] CKEK=KDF(K m , Random_A||Random_B||ID_A||ID_B, "Content Key EncryptionKey", 128)

[0225] Where CKEK represents the target key, K m It is the shared master key between the sender and receiver. Random_A is the random number generated by the sender, Random_B is the random number generated by the receiver, ID_A is the identifier of the sender, and ID_B is the identifier of the receiver.

[0226] Optionally, the key distribution message (e.g., the first key distribution message or the second key distribution message) may also include more content. Table 3 is a message format of the key distribution message in the embodiments of this application.

[0227] Table 3

[0228] Fields Bit count illustrate Type 8 Data Message Types Version 8 Message version number Len 8 Message length CKId 14 Content key identifier Reserved 2 reserve ID_B 48 Receiver identifier ECKCtr 128 Counter for encrypted content keys ECK 128 Encrypted content key Reserved 8 reserve

[0229] Specifically, the first target key is generated based on the first shared master key between the sender and the first receiver, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver. The second target key is generated based on the second shared master key between the sender and the second receiver, a random number generated by the sender, a random number generated by the second receiver, the identifier of the sender, and the identifier of the second receiver.

[0230] Referring to Table 3, the differences between the contents of the first key distribution message and the second key distribution message are as follows: ID_B in the first key description message is the identifier of the first receiver, while ID_B in the second key description message is the identifier of the second receiver; furthermore, the counter for the encrypted content key in the first key distribution message is different from the counter for the encrypted content key in the second key distribution message. Since the first target key and the second target key are different, the encrypted content key in the first key distribution message is different from the encrypted content key in the second key distribution message.

[0231] S605, the sending end sends a second encrypted audio-visual stream containing a second encrypted audio-visual message, an encrypted description message, a first key distribution message, and a second key distribution message to the first receiving end and the second receiving end.

[0232] Optionally, the sending end can carry the encrypted description message, the first key distribution message, and the second key distribution message in the vertical blanking region of the second encrypted audio / video message to obtain the second encrypted audio / video stream, and then send the second encrypted audio / video stream to the first receiving end and the second receiving end.

[0233] S606. The first receiving end parses the second encrypted audio and video stream and obtains the second encrypted audio and video message, the encrypted description message, and the first key distribution message.

[0234] In this embodiment of the application, after the receiving module of the first receiving end receives the second encrypted audio and video stream, it parses the second encrypted audio and video stream to obtain the second encrypted audio and video message, the encrypted description message, the first key distribution message, and the second key distribution message. Then, the first receiving end filters out the first key distribution message according to the identifier of the first receiving end to obtain the second encrypted audio and video message, the encrypted description message, and the first key distribution message.

[0235] It should be understood that the receiving module of the first receiving end sends the second encrypted audio / video message and the encrypted description message to the decryption module of the first receiving end, or the receiving module sends the second encrypted audio / video message to the decryption module and sets the encryption algorithm and the second counter in the decryption module; the receiving module sends the encrypted description message and the first key distribution message to the key management module of the first receiving end.

[0236] S607. The first receiving end, based on the encryption algorithm and mode, uses the first target key and the third counter in the first key distribution message to decrypt the first encrypted content key to obtain the second content key.

[0237] The key management module of the first receiving end knows that the type of the second content key is multicast based on the content key type of 01b in the encrypted description message. Then, the key management module determines the third counter used to encrypt the second content key based on the first key distribution message, and the key management module derives the first target key mentioned above. Then, it decrypts the first encrypted content key in the first key distribution message based on the first target key and the third counter to obtain the second content key, and sets the second content key to the decryption module of the first receiving end.

[0238] S608. The first receiving end, based on the encryption algorithm and mode, uses the second content key and the second counter to decrypt the second encrypted audio and video message to obtain the second audio and video message.

[0239] In this embodiment of the application, after the decryption module of the first receiving end obtains the second content key, it determines the encryption algorithm and the second counter for encrypting the second audio-visual message based on the encrypted description message received from the receiving module (or obtains the encryption algorithm and the second counter set in the decryption module). Then, the decryption module decrypts the second encrypted audio-visual message based on the second content key and the second counter to obtain the second audio-visual message.

[0240] S609, the second receiving end parses the second encrypted audio and video stream and obtains the second encrypted audio and video message, the encrypted description message, and the second key distribution message.

[0241] In this embodiment of the application, after the receiving module of the second receiving end receives the second encrypted audio and video stream, it parses the second encrypted audio and video stream to obtain the second encrypted audio and video message, the encrypted description message, the first key distribution message and the second key distribution message. Then, the second receiving end filters out the second key distribution message according to the identifier of the second receiving end to obtain the second encrypted audio and video message, the encrypted description message and the second key distribution message.

[0242] It should be understood that the receiving module of the second receiving end sends the second encrypted audio / video message and the encrypted description message to the decryption module of the second receiving end, or the receiving module sends the second encrypted audio / video message to the decryption module; the receiving module sends the encrypted description message and the second key distribution message to the key management module of the second receiving end. Optionally, after the key management module obtains the encryption algorithm and the second counter from the encrypted description message, the key management module can set the encryption algorithm and the second counter in the decryption module.

[0243] S610, the second receiving end, based on the encryption algorithm and mode, uses the second target key and the fourth counter in the second key distribution message to decrypt the second encrypted content key to obtain the second content key.

[0244] The key management module of the second receiving end knows that the type of the second content key is multicast based on the type 01b of the content key in the encryption description message. Then, the key management module determines the fourth counter used to encrypt the second content key based on the second key distribution message, and the key management module derives the aforementioned second target key. Then, it decrypts the second encrypted content key in the second key distribution message based on the second target key and the fourth counter to obtain the second content key, and sets the second content key to the decryption module of the second receiving end.

[0245] S611, the second receiving end decrypts the second encrypted audio and video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain the second audio and video message.

[0246] In this embodiment of the application, after the decryption module of the second receiving end obtains the second content key, it determines the encryption algorithm and the second counter for encrypting the second audio-visual message based on the encrypted description message received from the receiving module (or obtains the encryption algorithm and the second counter set in the decryption module). Then, the decryption module decrypts the second encrypted audio-visual message based on the second content key and the second counter to obtain the second audio-visual message.

[0247] In one possible implementation, in a multicast scenario, the receiver's key management module can store one or more decrypted content keys and their identifiers in a corresponding relationship into the receiver's decryption module. Thus, when the second content key needs updating, the sender can update the identifier of the next content key to be used in the encrypted description message. After receiving the new encrypted description message, the receiver's decryption module can obtain the updated content key identifier from the encrypted description message. Then, the decryption module determines the updated content key based on the updated content key identifier and decrypts the received audio / video messages based on the updated content key.

[0248] For other relevant information regarding S601-S611, please refer to the descriptions of S401-S407 above; they will not be repeated here.

[0249] Figure 7 This is a schematic diagram of a framework for transmitting audio and video streams between a transmitter and a first receiver and a second receiver. The transmitter can communicate directly with the first receiver and the second receiver, meaning there is no routing device between the transmitter and the first and second receivers. The transmitter communicates with the first receiver and the second receiver through different downlink ports.

[0250] In summary, in the audio and video stream transmission method provided in this application embodiment, after the sending end sends out the encrypted audio and video stream, other devices (such as routing devices) between the sending end and the receiving end do not decrypt and re-encrypt the encrypted audio and video stream. Compared with the prior art, this can eliminate the possibility of attacking the audio and video stream in intermediate downstream devices, thus improving the security of audio and video stream transmission.

[0251] Furthermore, in this embodiment, a content key can be generated for a specific audio / video stream. Different content keys can be used to encrypt different audio / video streams, realizing stream-based encryption and decryption. Compared with the existing end-to-end encryption and decryption mechanisms, this further improves the security of audio / video stream transmission.

[0252] Furthermore, the audio and video stream transmission method provided in this application embodiment can also be applied in scenarios where unicast is switched to multicast, such as... Figure 8 As shown, the method for transmitting the audio / video stream may include:

[0253] S801, The sending end generates the first content key.

[0254] The first content key is used to encrypt audio and video streams in unicast scenarios. The first content key is derived from the sending end. For details, please refer to the process of generating the first content key in S401 above.

[0255] S802, The sending end generates the first encrypted description message.

[0256] The first encryption description message includes at least one of the following: an identifier of the first content key, an identifier of the sender, an encryption algorithm and mode, and first counter information. The first encryption description message may indicate the first content key, and the first counter information is the high 64 bits of a first counter used for encrypting audio and video streams.

[0257] S803. The sending end, based on the encryption algorithm and mode, uses the first content key and the first counter to encrypt the first audio-visual message from the first audio-visual stream, and obtains the first encrypted audio-visual message.

[0258] S804. The sending end sends a first encrypted audio-visual stream containing a first encrypted audio-visual message and a first encrypted description message to the first receiving end.

[0259] S805, The first receiving end parses the first encrypted audio and video stream and obtains the first encrypted audio and video message and the first encrypted description message.

[0260] S806. The first receiving end generates a first content key based on the first encrypted description message.

[0261] S807. The first receiving end decrypts the first encrypted audio and video message based on the encryption algorithm and mode, using the first content key and the first counter, to obtain the first audio and video message.

[0262] It should be understood that the sending end sending the first audio / video message to the first receiving end is a unicast scenario. Afterwards, the sending end switches to a multicast scenario, for example, the sending end sending the second audio / video message to the first and second receiving ends. It should be noted that the first and second audio / video messages come from the same audio / video stream (e.g., the first audio / video stream).

[0263] S809. The sending end randomly generates a second content key.

[0264] The second content key is used to encrypt audio and video streams in multicast scenarios.

[0265] S810, The sending end generates a second encrypted description message.

[0266] The second encrypted description message includes an encryption algorithm and mode, and / or second counter information, which is the high 64 bits of the second counter.

[0267] S811. The sending end, based on the encryption algorithm and mode, uses the second content key and the second counter to encrypt the second audio-visual message from the first audio-visual stream, thereby obtaining the second encrypted audio-visual message.

[0268] S812, The sending end generates the first key distribution message and the second key distribution message.

[0269] The first key distribution message includes a third counter and / or a first encrypted content key, wherein the first encrypted content key is a key obtained by encrypting a second content key using a first target key and a third counter based on an encryption algorithm and mode. The second key distribution message includes a fourth counter and / or a second encrypted content key, wherein the second encrypted content key is a key obtained by encrypting a second content key using a second target key and a fourth counter based on an encryption algorithm and mode.

[0270] S813. The sending end sends a second encrypted audio-visual stream containing a second encrypted audio-visual message, a second encrypted description message, a key distribution message, and a second key distribution message to the first receiving end and the second receiving end, respectively.

[0271] S814. The first receiving end parses the second encrypted audio and video stream and obtains the second encrypted audio and video message, the second encrypted description message, and the first key distribution message.

[0272] S815. The first receiving end, based on the encryption algorithm and mode, uses the first target key and the third counter in the first key distribution message to decrypt the first encrypted content key to obtain the second content key.

[0273] Specifically, the first receiving end determines that the type of the second content key is multicast based on the type of the content key in the second encrypted description message. Then, the first receiving end derives the first target key and determines the third counter for encrypting the second content key and the first encrypted content key from the first key distribution message. The first encrypted content key is then decrypted based on the target key and the third counter.

[0274] S816. The first receiving end decrypts the second encrypted audio and video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain the second audio and video message.

[0275] Specifically, the first receiving end determines the second counter and encryption algorithm based on the second encrypted description message, and then uses the second counter and the second content key to decrypt the second encrypted audio and video message to obtain the second audio and video message.

[0276] S817, the second receiving end parses the second encrypted audio and video stream and obtains the second encrypted audio and video message, the second encrypted description message, and the second key distribution message.

[0277] S818, the second receiving end, based on the encryption algorithm and mode, uses the second target key and the fourth counter in the second key distribution message to decrypt the second encrypted content key to obtain the second content key.

[0278] The second receiving end determines that the type of the second content key is multicast based on the type of the content key in the second encrypted description message. Then, the second receiving end derives the second target key and determines the fourth counter for encrypting the second content key and the second encrypted content key from the second key distribution message. The second receiving end then decrypts the second encrypted content key based on the second target key and the fourth counter.

[0279] S819, the second receiving end decrypts the second encrypted audio and video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain the second audio and video message.

[0280] Similarly, the second receiving end determines the second counter and encryption algorithm based on the second encrypted description message, and then uses the second counter and the second content key to decrypt the second encrypted audio and video message to obtain the second audio and video message.

[0281] For a detailed description of each step in the audio and video stream transmission method for unicast-to-multicast scenarios, please refer to the detailed content of each step in the unicast scenario and the multicast scenario, which will not be repeated here.

[0282] Optionally, during subsequent audio / video stream transmission, if either the first receiving end or the second receiving end stops receiving the first audio / video stream (i.e., one receiving end withdraws from receiving the first audio / video stream), multicast can also switch to unicast. Specifically, the sending end updates the aforementioned second encrypted description message, switches the type of the content key in the second encrypted description message to unicast, and no longer sends key distribution messages. The sending end communicates with the receiving end according to the audio / video stream transmission method in a unicast scenario. For details, please refer to the relevant content of the above embodiments, which will not be elaborated here.

[0283] Accordingly, this application provides a transmitting end. In this application embodiment, the transmitting end can be divided into functional modules according to the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0284] When dividing each function into modules according to its corresponding function. Figure 9 This diagram illustrates a possible structure of the transmitting end involved in the above embodiments, such as... Figure 9 As shown, the sending end includes a key management module 901, an encryption module 902, and a sending module 903.

[0285] In a unicast scenario, the key management module 901 generates a first content key, which is used to encrypt the audio / video stream in the unicast scenario; and generates a first encrypted description message, which includes an encryption algorithm and mode, and / or first counter information; the first counter information is the high 64 bits of the first counter; for example, it is used to execute S401, S402, S801, and S802 in the above method embodiments. The encryption module 902 encrypts the first audio / video message based on the encryption algorithm and mode, using the first content key and the first counter, to obtain a first encrypted audio / video message; the first audio / video message is the message of the first audio / video stream; for example, it is used to execute S403 and S803 in the above method embodiments. The sending module 903 sends the first encrypted audio / video stream containing the first encrypted audio / video message and the first encrypted description message to the first receiving end; for example, it is used to execute S404 and S804 in the above method embodiments.

[0286] Optionally, the first encrypted description message may further include the identifier of the first content key and / or the identifier of the sender; the key management module 901 is specifically used to derive the first content key based on the shared master key between the sender and the first receiver, the identifier of the first content key, the random number generated by the sender, the random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver.

[0287] Optionally, the sending module 903 is specifically used to carry the first encrypted description message in the vertical blanking region of the first encrypted audio / video message to obtain the first encrypted audio / video stream, and send the first encrypted audio / video stream to the first receiving end.

[0288] Optionally, the sending end may further include an authentication module 904. This authentication module 904 is used to initiate an authentication and key negotiation process with the first receiving end to obtain a shared master key and a random number generated by the first receiving end.

[0289] Optionally, the aforementioned transmitting end may further include an authorization module 905, which is used to authorize the first receiving end based on the authorization control policy of the first audio and video stream.

[0290] Optionally, after the unicast scenario is switched to a multicast scenario, the key management module 901 is further configured to randomly generate a second content key, which is used to encrypt the audio and video streams in the multicast scenario, for example, by executing S809 in the above method embodiment; and generate a second encrypted description message, which includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter; for example, by executing S810 in the above method embodiment. The encryption module 902 is further configured to encrypt the second audio and video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain a second encrypted audio and video message, which is a message of the first audio and video stream; for example, by executing S811 in the above method embodiment. The key management module 901 is further configured to generate a first key distribution message and a second key distribution message. The first key distribution message includes a third counter and / or a first encrypted content key, wherein the first encrypted content key is a key obtained by encrypting a second content key using a first target key and a third counter based on an encryption algorithm and mode. The second key distribution message includes a fourth counter and / or a second encrypted content key, wherein the second encrypted content key is a key obtained by encrypting a second content key using a second target key and a fourth counter based on an encryption algorithm and mode. For example, S812 in the above method embodiment is executed. The sending module 903 is further configured to send a second encrypted audio / video stream containing a second encrypted audio / video message, a second encrypted description message, a first key distribution message, and a second key distribution message to the first receiving end and the second receiving end, respectively. For example, S813 in the above method embodiment is executed.

[0291] In a multicast scenario, the key management module 901 is used to randomly generate a second content key, which is used to encrypt the audio and video streams in the multicast scenario; for example, executing S601 in the above method embodiment; and generating an encryption description message, which includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter; for example, executing S602 in the above method embodiment. The encryption module 902 is used to encrypt the second audio and video message based on the encryption algorithm and mode, using the second content key and the second counter, to obtain a second encrypted audio and video message; for example, executing S603 in the above method embodiment. The key management module 901 is further configured to generate a first key distribution message and a second key distribution message. The first key distribution message includes a third counter and / or a first encrypted content key, wherein the first encrypted content key is a key obtained by encrypting a second content key using a first target key and a third counter based on an encryption algorithm and mode. The second key distribution message includes a fourth counter and / or a second encrypted content key, wherein the second encrypted content key is a key obtained by encrypting a second content key using a second target key and a fourth counter based on an encryption algorithm and mode. For example, S604 in the above method embodiment is executed. The sending module 903 is configured to send a second encrypted audio / video stream, including a second encrypted audio / video message, an encrypted description message, a first key distribution message, and a second key distribution message, to the first receiving end and the second receiving end, respectively. For example, S605 in the above method embodiment is executed.

[0292] Optionally, the sending module 903 is specifically used to carry the encrypted description message, the first key distribution message, and the second key distribution message in the vertical blanking region of the second encrypted audio and video message to obtain the second encrypted audio and video stream, and send the second encrypted audio and video stream to the first receiving end and the second receiving end respectively.

[0293] Optionally, the authentication module 904 is used to initiate an authentication and key negotiation process to the first receiving end to obtain the first shared master key and the random number generated by the first receiving end; and to initiate an authentication and key negotiation process to the second receiving end to obtain the second shared master key and the random number generated by the second receiving end.

[0294] The authorization module 905 is used to authorize the first receiver and the second receiver based on the authorization control policy of the second audio and video stream.

[0295] The modules of the above-mentioned sending end can also be used to perform other actions in the above method embodiments. All relevant content of each step involved in the above method embodiments can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0296] When using integrated units, Figure 10A schematic diagram of another possible structure of the transmitting end involved in the above embodiments is shown. For example... Figure 10 As shown, the transmitting end provided in this embodiment may include a processing module 1001 and a communication module 1002. The processing module 1001 can be used to control and manage the actions of the transmitting end. For example, the processing module 1001 can be used to support the execution of the steps performed by the key management module 901, encryption module 902, authentication module 904, and authorization module 905, and / or other processes used in the technology described herein. The communication module 1002 can be used to support communication between the transmitting end and other network entities, such as supporting communication between the transmitting end and the receiving end. For example, the communication module 1002 can be used to support the transmitting end in executing the steps performed by the transmitting module 903.

[0297] Optionally, such as Figure 10 As shown, the transmitting end may also include a storage module 1003 for storing computer instructions and data.

[0298] The processing module 1001 can be a processor or a controller. The processor can also be a combination of components that implement computing functions, such as a combination of one or more microprocessors, a DSP, and a microprocessor, etc. The communication module 1002 can be a communication interface. The storage module 1003 can be a memory. When the processing module 1001 is a processor, the communication module 1002 is a communication interface, and the storage module 1003 is a memory, the processor, transceiver, and memory can be connected via a bus.

[0299] For more details on how the modules included in the aforementioned sending end implement the above functions, please refer to the descriptions in the preceding method embodiments, which will not be repeated here. The various embodiments in this specification are described in a progressive manner; similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments.

[0300] Accordingly, this application provides a receiving end. In this application embodiment, the receiving end can be divided into functional modules according to the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0301] When dividing each function into modules according to its corresponding function. Figure 11 This diagram illustrates a possible structure of the receiving end involved in the above embodiments, such as... Figure 11As shown, the receiving end includes an acquisition module 1101, a key management module 1102, and a decryption module 1103.

[0302] In a unicast scenario, the acquisition module 1101 is used to parse the first encrypted audio / video stream, acquire a first encrypted audio / video message and a first encrypted description message. The first encrypted description message includes an encryption algorithm and mode, and / or first counter information, where the first counter information is the high 64 bits of the first counter; for example, executing S405 in the above method embodiment. The key management module 1102 is used to generate a first content key based on the first encrypted description message. The first content key is used to encrypt the audio / video stream in the unicast scenario; for example, executing S406 in the above method embodiment. The decryption module is used to decrypt the first encrypted audio / video message based on the encryption algorithm and mode, using the first content key and the first counter, to obtain a first audio / video message, which is the message of the first audio / video stream; for example, executing S407 in the above method embodiment.

[0303] Optionally, the first encrypted description message may further include the identifier of the first content key and / or the identifier of the sender; the key management module 1102 is specifically used to derive the first content key based on the shared master key between the sender and the receiver, the identifier of the first content key, the random number generated by the sender, the random number generated by the receiver, the identifier of the sender, and the identifier of the receiver.

[0304] Optionally, the receiving end provided in this application embodiment further includes an authentication module 1104. The authentication module 1104 is used to perform an authentication and key negotiation process with the sending end to obtain a shared master key and a random number generated by the sending end. Specifically, the authentication module 1104 performs authentication and key negotiation with the first receiving end to obtain a first shared master key, and the authentication module 1104 performs authentication and key negotiation with the second receiving end to obtain a second shared master key.

[0305] Optionally, the acquisition module 1101 is further configured to parse the second encrypted audio / video stream to acquire a second encrypted audio / video message, a second encrypted description message, and a first key distribution message; wherein, the second encrypted description message includes an encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter; the first key distribution message includes a third counter and / or a first encrypted content key, the first encrypted content key being a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode; for example, executing S814 in the above method embodiment. The key management module 1102 of the receiving end is further configured to decrypt the first encrypted content key using a first target key and a third counter in the first key distribution message based on the encryption algorithm and mode to obtain a second content key; the second content key is used to encrypt the audio / video stream in a multicast scenario; for example, executing S815 in the above method embodiment. The decryption module 1103 is also used to decrypt the second encrypted audio and video message based on the encryption algorithm and mode, using the second content key and the second counter to obtain the second audio and video message, which is a message of the first audio and video stream; for example, executing S816 in the above method embodiment.

[0306] In a multicast scenario, the acquisition module 1101 is used to parse the second encrypted audio / video stream and acquire the second encrypted audio / video message, the encrypted description message, and the key distribution message. The encrypted description message includes an encryption algorithm and mode, and / or second counter information, where the second counter information is the high 64 bits of the second counter. The key distribution message includes a third counter and / or a first encrypted content key, where the first encrypted content key is a key obtained by encrypting the second content key using a first target key and a third counter based on the encryption algorithm and mode. For example, executing S606 in the above method embodiment. The key management module 1102 is used to decrypt the first encrypted content key using the first target key and the third counter in the first key distribution message based on the encryption algorithm and mode to obtain a second content key, which is used to encrypt the audio / video stream in the multicast scenario. For example, executing S607 in the above method embodiment. The decryption module 1103 is used to decrypt the second encrypted audio / video message using the second content key and a second counter based on the encryption algorithm and mode to obtain the second audio / video message. For example, executing S608 in the above method embodiment.

[0307] Optionally, the authentication module 1104 is used to perform an authentication and key negotiation process with the sender to obtain the shared master key between the sender and the receiver and the random number generated by the sender.

[0308] The modules of the receiving end described above can also be used to perform other actions in the above method embodiments. All relevant content of each step involved in the above method embodiments can be referred to in the functional description of the corresponding functional module, and will not be repeated here.

[0309] When using integrated units, Figure 12 A schematic diagram of another possible structure of the receiving end involved in the above embodiments is shown. For example... Figure 12 As shown, the receiving end provided in this embodiment may include a processing module 1201 and a communication module 1202. The processing module 1201 can be used to control and manage the actions of the receiving end. For example, the processing module 1201 can be used to support the execution of the steps performed by the key management module 1102, decryption module 1103, and authentication module 1104, and / or other processes used in the technology described herein. The communication module 1202 can be used to support communication between the receiving end and other network entities, such as supporting communication between the receiving end and other receiving ends. For example, the communication module 1202 can be used to support the receiving end in obtaining encrypted audio and video streams from the sending end.

[0310] Optionally, such as Figure 12 As shown, the receiving end may also include a storage module 1203 for storing computer instructions and data.

[0311] The processing module 1201 can be a processor or a controller. The processor can also be a combination of components that implement computing functions, such as a combination of one or more microprocessors, a DSP, and a microprocessor. The communication module 1202 can be a communication interface. The storage module 1203 can be a memory. When the processing module 1201 is a processor, the communication module 1202 is a communication interface, and the storage module 1203 is a memory, the processor, transceiver, and memory can be connected via a bus.

[0312] For more details on how the modules included in the receiving end implement the above functions, please refer to the descriptions in the preceding method embodiments, which will not be repeated here. The various embodiments in this specification are described in a progressive manner; similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments.

[0313] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center integrating one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0314] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0315] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0316] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0317] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0318] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0319] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method of transmitting a video and audio stream, characterized by, The method is applied at the sending end, and the method includes: Generate a first content key; the first content key is a key used to encrypt audio and video streams in a unicast scenario; Generate a first encrypted description message; the first encrypted description message includes an encryption algorithm and mode, and / or first counter information; the first counter information is the high 64 bits of the first counter; Based on the encryption algorithm and mode, the first audio and video message is encrypted using the first content key and the first counter to obtain the first encrypted audio and video message; the first audio and video message is a message of the first audio and video stream. The first encrypted description message is carried in the vertical blanking region of the first encrypted audio / video message to obtain the first encrypted audio / video stream, and the first encrypted audio / video stream is sent to the first receiving end.

2. The method of claim 1, wherein, The first encrypted description message also includes the identifier of the first content key and / or the identifier of the sending end; The generation of the first content key includes: The first content key is derived based on the shared master key between the sending end and the first receiving end, the identifier of the first content key, the random number generated by the sending end, the random number generated by the first receiving end, the identifier of the sending end, and the identifier of the first receiving end.

3. The method of claim 2, wherein, Before generating the first content key, the method further includes: An authentication and key negotiation process is initiated with the first receiving end to obtain the shared master key and the random number generated by the first receiving end.

4. The method according to any one of claims 1 to 3, characterized in that, Before encrypting the first audio / video stream using the first content key and the first counter based on the encryption algorithm and mode to obtain the first encrypted audio / video stream, the method further includes: The authorization control of the first receiving end is performed based on the authorization control policy of the first audio and video stream.

5. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Generate a second content key; the second content key is a key used to encrypt audio and video streams in a multicast scenario; Generate a second encrypted description message; the second encrypted description message includes an encryption algorithm and mode, and / or second counter information; the second counter information is the high 64 bits of the second counter; Based on the encryption algorithm and mode, the second audio and video message is encrypted using the second content key and the second counter to obtain the second encrypted audio and video message; the second audio and video message is a message of the first audio and video stream. Generate a first key distribution message; the first key distribution message includes a first encryption content key; Generate a second key distribution message; the second key distribution message includes a second encrypted content key; Send a second encrypted audio-visual stream containing a second encrypted audio-visual message, a second encrypted description message, a first key distribution message, and a second key distribution message to a first receiving end and a second receiving end.

6. A method of transmitting an audiovisual stream, characterized in that, The method is applied at the receiving end, and the method includes: Obtain the first encrypted description message from the vertical blanking region of the first encrypted audio / video message; the first encrypted description message includes the encryption algorithm and mode, and / or the first counter information; the first counter information is the high 64 bits of the first counter; A first content key is generated based on the first encrypted description message; the first content key is used to decrypt the first audio and video stream in a unicast scenario; Based on the encryption algorithm and mode, the first encrypted audio and video message is decrypted using the first content key and the first counter to obtain the first audio and video message, which is a message of the first audio and video stream.

7. The method of claim 6, wherein, The first encrypted description message further includes an identifier for the first content key and / or an identifier for the sender; generating the first content key based on the first encrypted description message includes: The first content key is derived based on the shared master key between the sending end and the receiving end, the identifier of the first content key, the random number generated by the sending end, the random number generated by the receiving end, the identifier of the sending end, and the identifier of the receiving end.

8. The method of claim 7, wherein, The method further includes: An authentication and key negotiation process is performed with the sending end to obtain the shared master key and the random number generated by the sending end.

9. The method according to any one of claims 6 to 8, characterized in that, Before obtaining the first encrypted description message from the first encrypted audio / video stream, the method further includes: The authorization control is performed in response to the sending end, and the authorization control is based on the authorization control policy of the first audio and video stream.

10. The method according to any one of claims 6 to 8, characterized in that, The method further includes: Obtain a second encrypted audio / video message, a second encrypted description message, and a first key distribution message from the second encrypted audio / video stream; wherein, the second encrypted description message includes the encryption algorithm and mode, and / or second counter information, the second counter information being the high 64 bits of the second counter; the first key distribution message includes a first encrypted content key; The first encrypted content key in the first key distribution message is decrypted to obtain the second content key; the first content key is the key used to decrypt the second audio and video stream in a multicast scenario; Based on the encryption algorithm and mode, the second encrypted audio and video message is decrypted using the second content key and the second counter to obtain the second audio and video message, which is a message of the first audio and video stream.

11. A method of transmitting an audiovisual stream, characterized in that, The method is applied at the sending end, and the method includes: Generate a second content key; the second content key is a key used to encrypt audio and video streams in a multicast scenario; Generate an encrypted description message; the encrypted description message includes an encryption algorithm and mode, and / or second counter information; the second counter information is the high 64 bits of the second counter; Based on the encryption algorithm and mode, the second audio and video message is encrypted using the second content key and the second counter to obtain the second encrypted audio and video message; the second audio and video message is a message of the second audio and video stream; Generate a first key distribution message; the first key distribution message includes a first encryption content key; Generate a second key distribution message; the second key distribution message includes a second encrypted content key; The encrypted description message, the first key distribution message, and the second key distribution message are carried in the vertical blanking region of the second encrypted audio / video message to obtain the second encrypted audio / video stream, and the second encrypted audio / video stream is sent to the first receiving end.

12. The method of claim 11, wherein, The first encrypted content key is a key obtained by encrypting the second content key using the first target key and the third counter, based on the encryption algorithm and mode.

13. The method of claim 12, wherein, The first target key is generated based on the shared master key between the sender and the first receiver, a random number generated by the sender, a random number generated by the first receiver, the identifier of the sender, and the identifier of the first receiver.

14. The method of claim 13, wherein, Before generating the second content key, the method further includes: An authentication and key negotiation process is initiated with the first receiving end to obtain the shared master key and the random number generated by the first receiving end.

15. The method according to any one of claims 11 to 14, characterized in that, The method further includes: The authorization control of the first receiving end is performed based on the authorization control policy of the second audio and video stream.

16. The method according to any one of claims 11 to 14, characterized in that, The method further includes: The second encrypted audio and video stream is sent to the second receiving end.

17. The method of claim 16, wherein, The second encrypted content key is obtained by encrypting the second content key based on the second target key and the fourth counter.

18. The method of claim 17, wherein, The second target key is generated based on the shared master key between the sender and the receiver, a random number generated by the sender, a random number generated by the receiver, the identifier of the sender, and the identifier of the receiver.

19. The method of any one of claims 11-14, 17-18, wherein, The receiving end includes multiple receiving ends.

20. A method of transmitting an audiovisual stream, characterized in that, The method is applied at the receiving end, and the method includes: Obtain the encrypted description message and the first key distribution message from the vertical blanking region of the second encrypted audio / video message; wherein, the first key distribution message includes the first encrypted content key, the encrypted description message includes the encryption algorithm and mode, and / or the second counter information, the second counter information being the high 64 bits of the second counter; The first encrypted content key is decrypted to obtain the second content key; the second content key is used to decrypt the second audio and video stream in a multicast scenario. Based on the encryption algorithm and mode, the second encrypted audio and video message is decrypted using the second content key and the second counter to obtain the second audio and video message, which is the message of the second audio and video stream.

21. The method of claim 20, wherein, The first encrypted content key is a key obtained by encrypting the second content key using the first target key and the third counter, based on the encryption algorithm and mode.

22. The method of claim 21, wherein, The first target key is generated based on the shared master key between the sender and the receiver, a random number generated by the sender, a random number generated by the receiver, the identifier of the sender, and the identifier of the receiver.

23. The method of claim 22, wherein, The method further includes: An authentication and key negotiation process is performed with the sending end to obtain the shared master key and the random number generated by the sending end.

24. The method of any one of claims 20-23, wherein, Before obtaining the encrypted description message and the first key distribution message from the second encrypted audio / video stream, the method further includes: The authorization control is performed in response to the sending end, and the authorization control is based on the authorization control policy of the second audio and video stream.

25. The method of any one of claims 20-23, wherein, The receiving end includes multiple receiving ends.

26. An apparatus for transmitting a video / audio stream, the apparatus comprising: It includes modules for performing the method as described in any one of claims 1-5, or modules for performing the method as described in any one of claims 11-19.

27. A device for transmitting audio and video streams, characterized in that, It includes a module for performing the method as described in any one of claims 6-10, or a module for performing the method as described in any one of claims 20-25.

28. A transmitting end, comprising: The device includes a memory and at least one processor connected to the memory, the memory being used to store computer program code, the computer program code including computer instructions, which, when executed by the at least one processor, cause the transmitting end to perform the method as claimed in any one of claims 1-5, or any one of claims 11-19.

29. A computer-readable storage medium, characterized in that, The device stores computer instructions that, when executed on a computer, perform the method as claimed in any one of claims 1-5, or any one of claims 11-19.

30. A receiving end, characterized by The device includes a memory and at least one processor connected to the memory, the memory being used to store computer program code, the computer program code including computer instructions, which, when executed by the at least one processor, cause the receiving end to perform the method as claimed in any one of claims 6-10, or any one of claims 20-25.

31. A computer readable storage medium, characterized in that, The device stores computer instructions that, when executed on a computer, perform the method as claimed in any one of claims 6-10, or any one of claims 20-25.

32. An audiovisual streaming system, characterized by It includes the transmitting end as described in claim 28 and one or more receiving ends as described in claim 30.

Images