Method, device and system for safely transmitting audio and video streams

Abstract

The invention discloses a method, a device and a system for safely transmitting audio and video streams. Based on a security device arranged on a sender side, an audio and video related protocol message and a real-time transport protocol (RTP) packet including an audio and video stream are obtained. And analyzing the audio and video related protocol message, and extracting element information. And based on the element information, performing security packaging including encryption and integrity check value I CV addition on the RTP packet which is determined to be required to be protected, and transmitting the RTP packet after security packaging. And performing I CV verification and decryption on the securely packaged RTP packet based on a security device arranged on the receiver side. According to the invention, security protection is provided for the audio and video streams through the security device which is serially deployed on the switching link of the video monitoring network, and old equipment does not need to be transformed. And all audio and video stream data borne by the RTP are supported, so that the applicability is high. And only the RTP packet needing to be protected is safely packaged, so that the operand is reduced, and the performance overhead is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and system for secure transmission of audio and video streams. Background Art

[0002] Video surveillance networks are used to monitor and record specific areas in real time, and mainly include cameras, network transmission equipment, storage devices, and monitoring centers. Due to the data sensitivity of audio and video streams, they usually need to be protected from unauthorized access, data tampering, and loss when transmitted in video surveillance networks.

[0003] In the prior art, in order to ensure the secure transmission of audio and video streams, a method is usually adopted in which the audio and video streams are encrypted before being sent and then decrypted by the receiving device. This method has high requirements on the capabilities of the audio and video devices and supports fewer audio and video encodings. There is also a method of deploying VPN in the audio and video link to establish a secure communication channel to ensure transmission security, but due to the large amount of audio and video traffic, VPN performance is difficult to meet the performance requirements of the video surveillance network. Therefore, how to ensure the secure transmission of audio and video streams in the video surveillance network through a highly applicable method has become a problem that needs to be solved urgently. Summary of the invention

[0004] Based on the above problems, the present application provides a method, device and system for secure transmission of audio and video streams, so as to ensure the secure transmission of audio and video streams in a video surveillance network through a highly applicable method.

[0005] The present application discloses a method for securely transmitting audio and video streams, the method comprising:

[0006] Acquire audio and video related protocol messages and real-time transport protocol RTP packets; the RTP packets include audio and video streams;

[0007] Parsing the audio and video related protocol messages to extract element information; the element information includes creator, port, and streaming media type information;

[0008] Based on the element information, the RTP packet determined to be in need of protection is securely encapsulated; the secure encapsulation includes encryption and adding an integrity check value I CV;

[0009] Transmit the securely encapsulated RTP packet; the securely encapsulated RTP packet is used for ICV verification and decryption.

[0010] Optionally, determining the RTP packet that needs to be protected based on the element information includes:

[0011] Receive configuration information from the management interface;

[0012] Determine the element type that needs to be protected in the element information through the RTP packet selector in the configuration information;

[0013] Determine that the RTP packet corresponding to the element type is the RTP packet that needs to be protected.

[0014] Optionally, the audio and video related protocol message and the RTP packet are transmitted from the sender to the receiver in the form of an IP message, and the step of obtaining the audio and video related protocol message and the real-time transport protocol RTP packet includes:

[0015] The security device at the sender side captures the IP message sent by the sender.

[0016] Optionally, the RTP packet after transmission security encapsulation includes:

[0017] The security device at the sender side sends the securely encapsulated RTP packet and the audio and video related protocol message to the receiver in the form of an encapsulated IP message;

[0018] The security device at the receiving side captures the encapsulated IP message, and performs ICV verification and decryption on the securely encapsulated RTP packet.

[0019] Optionally, the step of securely encapsulating the RTP packet determined to need protection includes:

[0020] Encrypt the RTP packet that needs to be protected by using the encryption algorithm and key to obtain an encrypted packet;

[0021] Calculate the checksum of the encrypted packet using a digest algorithm and a key used to calculate the digest information to obtain an I CV;

[0022] The encrypted packet, I CV and key index are combined as the securely encapsulated RTP packet; the key index is used to obtain the encryption algorithm, the key, the digest algorithm and the key used to calculate the digest information.

[0023] Optionally, performing I CV verification on the securely encapsulated RTP packet includes:

[0024] The security device at the receiving side splits the securely encapsulated RTP packet into an encrypted receiving packet and an I CV;

[0025] When the security device at the receiving side obtains the key used to calculate the summary information and the digest algorithm through the key index, the checksum of the encrypted received packet is calculated as a control value according to the key used to calculate the summary information and the digest algorithm;

[0026] When the control value is the same as the I CV, the I CV verification is passed;

[0027] When the control value and I CV are different, the I CV verification fails;

[0028] When the security device at the receiving side fails to obtain the key used to calculate the summary information and the summary algorithm through the key index, the I CV verification fails.

[0029] Optionally, decrypting the securely encapsulated RTP packet includes:

[0030] When the security device at the receiving side obtains the key and the encryption algorithm according to the key index, decrypts the securely encapsulated RTP packet according to the key and the encryption algorithm;

[0031] When the security device at the receiving side fails to obtain the key and the encryption algorithm according to the key index, decryption fails.

[0032] Optionally, after determining that the RTP packet corresponding to the element type is an RTP packet that needs to be protected, the method further includes:

[0033] Transmit RTP packets that do not require protection.

[0034] Based on the above-mentioned method for secure transmission of audio and video streams, the present application also discloses a device for secure transmission of audio and video streams, including: an acquisition unit, a parsing unit, a packaging unit and a transmission unit;

[0035] The acquisition unit is used to acquire audio and video related protocol messages and real-time transport protocol RTP packets; the RTP packets include audio and video streams;

[0036] The parsing unit is used to parse the audio and video related protocol messages and extract element information; the element information includes creator, port, and streaming media type information;

[0037] The encapsulation unit is used to securely encapsulate the RTP packet determined to need protection based on the element information; the secure encapsulation includes encryption and adding an integrity check value I CV;

[0038] The transmission unit is used to transmit the securely encapsulated RTP packet; the securely encapsulated RTP packet is used for ICV verification and decryption.

[0039] Optionally, the packaging unit includes:

[0040] A receiving subunit, used for receiving configuration information from a management interface;

[0041] A selection subunit, used to determine the type of element that needs to be protected in the element information through the RTP packet selector in the configuration information;

[0042] The determination subunit is used to determine that the RTP packet corresponding to the element type is the RTP packet that needs to be protected.

[0043] Optionally, the audio and video related protocol message and the RTP packet are transmitted from the sender to the receiver in the form of an IP message, and the acquisition unit is used to:

[0044] The security device at the sender side captures the IP message sent by the sender.

[0045] Optionally, the transmission unit includes:

[0046] The sending subunit is used for the security device on the sender side to send the securely encapsulated RTP packet and the audio and video related protocol message to the receiver in the form of an encapsulated IP message;

[0047] The capture subunit is used for the security device on the receiving side to capture the encapsulated IP message, and to perform ICV verification and decryption on the securely encapsulated RTP packet.

[0048] Optionally, the packaging unit includes:

[0049] The encryption subunit is used to encrypt the RTP packet that needs to be protected by using an encryption algorithm and a key to obtain an encrypted packet;

[0050] The I CV subunit is used to calculate the checksum of the encrypted packet by using a digest algorithm and a key used to calculate the digest information to obtain the I CV;

[0051] The encapsulation subunit is used to combine the encrypted packet, I CV and key index as the securely encapsulated RTP packet; the key index is used to obtain the encryption algorithm, the key, the digest algorithm and the key used to calculate the digest information.

[0052] Optionally, the capture subunit comprises:

[0053] A splitting subunit, used for the security device at the receiving side to split the RTP packet after the security encapsulation into an encrypted receiving packet and an I CV;

[0054] a calculation subunit, configured to calculate a checksum of the encrypted received packet as a control value according to the key used to calculate the summary information and the digest algorithm when the security device at the receiving side obtains the key used to calculate the summary information and the digest algorithm through the key index;

[0055] A control subunit, used for passing the I CV verification when the control value is the same as the I CV;

[0056] Also used for when the control value and the I CV are different, the I CV verification fails;

[0057] The splitting subunit is further configured to cause the I CV verification to fail when the security device at the receiving side fails to obtain the key used to calculate the summary information and the summary algorithm through the key index.

[0058] Optionally, the capture subunit comprises:

[0059] A judgment subunit, configured to decrypt the securely encapsulated RTP packet according to the key and the encryption algorithm when the security device at the receiving side obtains the key and the encryption algorithm according to the key index;

[0060] A decryption subunit, used for the security device at the receiving side to decrypt the securely encapsulated RTP packet according to the key and the encryption algorithm;

[0061] The judgment subunit is further configured to determine that decryption fails when the security device at the receiving side fails to obtain the key and the encryption algorithm according to the key index.

[0062] Optionally, the device further comprises:

[0063] The forwarding unit is used to transmit RTP packets that do not require protection.

[0064] Based on the above-mentioned method for secure transmission of audio and video streams, the present application also discloses a system for secure transmission of audio and video streams, which is used to implement the above-mentioned method. The system includes: a security device arranged on the sender side and a security device arranged on the receiver side;

[0065] The security device provided at the sender side is used to capture the audio and video stream from the sender, securely encapsulate the audio and video stream, and send the securely encapsulated audio and video stream to the receiver;

[0066] The security device arranged at the receiving side is used to capture the securely encapsulated audio and video stream and decapsulate the securely encapsulated audio and video stream.

[0067] The present application discloses a method, device and system for secure transmission of audio and video streams. Based on a security device arranged on the sender side, audio and video related protocol messages and real-time transport protocol RTP packets including audio and video streams are obtained. The audio and video related protocol messages are parsed to extract element information. Based on the element information, the RTP packets determined to be in need of protection are securely encapsulated including encryption and adding integrity check value I CV, and the securely encapsulated RTP packets are transmitted. Then, based on the security device arranged on the receiver side, the securely encapsulated RTP packets are I CV verified and decrypted. The present application provides security protection for audio and video streams through a security device serially deployed on the switching link of a video surveillance network, thereby eliminating the need to modify the sending / receiving devices of old equipment. It also supports all audio and video stream data carried by RTP, and has high applicability. In addition, it also supports secure encapsulation of only RTP packets that need to be protected, reducing the amount of calculation and reducing performance overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0069] Figure 1a A flowchart of a method for securely transmitting audio and video streams disclosed in an embodiment of the present application;

[0070] Figure 1b A comparison diagram of RTP packets before and after security encapsulation disclosed in the embodiment of the present application;

[0071] Figure 2 A flowchart of another method for securely transmitting audio and video streams disclosed in an embodiment of the present application;

[0072] Figure 3 A schematic diagram of the structure of a device for securely transmitting audio and video streams disclosed in an embodiment of the present application;

[0073] Figure 4 A structural diagram of a system for secure transmission of audio and video streams disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0074] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0075] Embodiment 1: This application discloses a method for securely transmitting audio and video streams.

[0076] For details, please refer to Figure 1a The method for securely transmitting an audio or video stream disclosed in this embodiment includes the following steps:

[0077] Step 101: Acquire audio and video related protocol messages and real-time transport protocol RTP packets.

[0078] In the method described in this embodiment, the sender sends an IP message in the video surveillance network between the sender and the receiver, and the receiver receives the IP message in the video surveillance network. The IP message includes audio and video related protocol messages and real-time transport protocol RTP (Real lt ime Transport Protocol) packets, and the RTP packets also include audio and video streams, that is, multiple audio and video files. The IP message is streamed from the sender to the receiver.

[0079] In the method described in this embodiment, as an optional method, a security device is set on the sender side and the receiver side respectively, that is, the sender (sending device), the security device on the sender side, the security device on the receiver side and the receiver (receiving device) are serially deployed on the switching link of the video surveillance network. Therefore, after the sender sends an IP message, the security device on the sender side can capture the IP message, process it, and then upload it to the video surveillance network between the sender and the receiver. The security device on the receiver side can capture the processed IP message in the video surveillance network, process it, and then send it to the receiver.

[0080] Step 102: Parse the audio and video related protocol messages to extract element information.

[0081] In the method described in this embodiment, the security device on the sender side parses the audio and video related protocol messages in the IP message, tracks the RTP session establishment process, and extracts element information including the creator, port, streaming media type, etc. from the audio and video related protocol messages.

[0082] Step 103: Based on the element information, the RTP packets that are determined to need protection are securely encapsulated.

[0083] In the method described in this embodiment, the security device on the sender side receives configuration information from the management interface. The configuration information includes a protection strategy, an RTP packet selector, and the payload type used for RTP packet encapsulation. Among them, the protection strategy includes a protection method and parameters necessary for protection, such as the algorithm used, the key update strategy and other parameters. The RTP packet selector is used to determine the element types that need to be protected in the element information, and then determine that the RTP packets corresponding to these element types are the RTP packets that need to be protected, that is, determine which messages in the RTP session need to be protected. The selectable conditions include creator, participant, RTP sequence number (SN), Payload Type (PT), U32 Matcher, etc.

[0084] In the method described in this embodiment, the security device on the sender side may also receive key information, including the key index used, the key used for encryption, the encryption algorithm, the key used to calculate the summary information, the summary algorithm, etc. As an optional method, the encryption algorithm may adopt a block cipher algorithm (such as SM1, SM4) or a sequence cipher algorithm (such as ZUC). When a block cipher algorithm is adopted, the padding algorithm and the algorithm mode need to be specified in the key information. The summary algorithm may adopt SM3-HMAC.

[0085] In the method described in this embodiment, the configuration information can be sent to the security device through the management interface, and the configuration information in the security device on the sender side and the security device on the receiver side can be consistent. The key information can be sent to the security device through the management interface, or it can be generated by the security device on the sender side and the security device on the receiver side through key negotiation. The key information in the security device on the sender side and the security device on the receiver side is also consistent.

[0086] In the method described in this embodiment, based on the protection strategy in the configuration information, the RTP packet that needs to be protected can be securely encapsulated. As an optional method, the secure encapsulation includes encryption and adding an integrity check value I CV (Integrity Check Value), but in actual operation, it is also possible to choose to only encrypt or add ICV according to the protection requirements.

[0087] The encryption operation may specifically be to obtain an encryption algorithm and a key (key used for encryption) from the configuration information and the key information, encrypt the RTP packet to be protected, and obtain an encrypted packet. The operation of adding I CV may specifically be to obtain a digest algorithm and a key used to calculate the digest information from the configuration information and the key information, calculate the checksum of the encrypted packet, and obtain I CV. Accordingly, in the scenario where only I CV is added, the checksum of the RTP packet to be protected is calculated to obtain I CV.

[0088] Finally, the encrypted packet and / or I CV is combined with the key index as the RTP packet after security encapsulation. The key index is used by the security device on the receiving side to obtain the key used for encryption, the encryption algorithm, the key used to calculate the summary information and the summary algorithm. As an optional method, the comparison diagram of the RTP packet before and after security encapsulation is shown in Figure 1b As shown, the RTP packet after security encapsulation, that is, the new RTP packet (RTP_n), consists of a new RTP packet header, a security protection information header (SPH), an encrypted packet (RTP_o') and a security protection information tail (SPT). Among them, the encryption range is RTP_o', which is obtained by encrypting the RTP packet before security encapsulation, that is, the original RTP packet (RTP_o). The integrity check range is SPH and RTP_o'. The data part of RTP_n includes SPH, RTP_o' and SPT.

[0089] Wherein, the payload type of the new RTP packet header comes from the configuration information, and other data comes from the header of the RTP_o packet. As an optional method, RTP_o may be a combination of multiple continuous RTP packets. SPH includes a key index SPI (Security Parameter Index), a length (representing the length of RTP_n) and an initialization vector IV (Initialization Vector) in sequence. The length of each component of SPH can be a preset value, for example, SPI occupies 4 bytes, Length occupies 2 bytes, and the length of IV is determined by the selected encryption algorithm.

[0090] SPT includes padding information and I CV, and the length of both can also be preset values. For example, when using the stream cipher algorithm for encryption, the length of the padding information is 0, otherwise the length of the padding information is determined by the encryption algorithm packet length and the length of RTP_o, and the length of I CV is determined by the digest algorithm packet length.

[0091] In the method described in this embodiment, based on Figure 1b The specific operation of security encapsulation can be as follows: first, determine whether RTP_o needs to be filled according to the selected encryption algorithm. When the encryption algorithm is a block cipher algorithm, it needs to be filled to obtain RTP_o_f. When the encryption algorithm is a sequence cipher algorithm, no filling is required. Then generate a random IV, call the digest algorithm, use the key and IV to encrypt RTP_o_f, obtain RTP_o′, and complete the encryption operation. Then call the digest algorithm, use the key used to calculate the summary information to calculate the checksum of RTP_o′, and obtain I CV. The final structure is as follows Figure 1b The RTP_n shown replaces the RTP_o in the IP message with RTP_n to complete the security encapsulation operation.

[0092] In the method described in this embodiment, for RTP packets that do not need to be securely encapsulated, the security device of the sender directly forwards them to the video surveillance network between the sender and the receiver.

[0093] Step 104: Transmit the securely encapsulated RTP packet.

[0094] In the method described in this embodiment, the securely encapsulated RTP packet is used for I CV verification and decryption. Specifically, the security device on the sender side sends the securely encapsulated RTP packet and the audio and video related protocol message to the receiver in the form of an encapsulated IP message. The security device on the receiver side captures the encapsulated IP message and performs I CV verification and decryption on the securely encapsulated RTP packet.

[0095] In the method described in this embodiment, the security device on the receiving side can judge the element information of the RTP packet after security encapsulation based on the content in the configuration information, and judge whether the RTP packet after security encapsulation needs to be I CV verified or decrypted. When the judgment result is that I CV verification is required, I CV verification is performed on it. When the judgment result is that decryption is required, it is decrypted. In this way, in the scenario of multiple senders and multiple receivers, it is avoided that the security device of the receiving side verifies and decrypts useless RTP packets.

[0096] Specifically, the I CV check can be performed by splitting the RTP packet after security encapsulation into an encrypted receiving packet and an I CV. The security device on the receiving side obtains the key and digest algorithm used to calculate the summary information through the key index, and calculates the checksum of the encrypted receiving packet as the control value based on the key and digest algorithm used to calculate the summary information. When the security device on the receiving side cannot obtain the key and digest algorithm used to calculate the summary information through the key index, the I CV check fails. When the control value and the I CV are the same, the I CV check passes. When the control value and the I CV are different, the I CV check fails.

[0097] Specifically, the decryption may be that the security device at the receiving side obtains the key and encryption algorithm through the key index, and decrypts the RTP packet after security encapsulation according to the key and encryption algorithm. If the security device at the receiving side cannot obtain the key and encryption algorithm through the key index, the decryption fails.

[0098] In the method described in this embodiment, the security device on the receiving side discards the RTP packets that fail the ICV verification or decryption, and sends the RTP packets that pass the ICV verification and decryption to the receiving side.

[0099] The method described in this embodiment provides security protection for audio and video streams through security devices serially deployed on the switching link of the video surveillance network, thereby eliminating the need to modify the sending / receiving devices of old equipment. It also supports all audio and video stream data carried by RTP, and has high applicability. In addition, it also supports secure encapsulation of only RTP packets that need to be protected, while meeting security protection requirements, reducing the amount of cryptographic operations, reducing performance overhead, and improving device throughput.

[0100] Embodiment 2: This application discloses another method for secure transmission of audio and video streams. Figure 2 The method described in this embodiment introduces the entire process of secure transmission of audio and video streams.

[0101] Step 201: A sender sends an IP message, and a first security device disposed on the sender side captures the IP message.

[0102] Step 202: The first security device parses the IP message and determines whether the RTP packet in the IP message needs to be securely encapsulated according to the parsing result. If yes, proceed to step 203. If no, proceed to step 204.

[0103] Step 203: The first security device securely encapsulates the RTP packet to obtain an encapsulated IP message. Then, the process proceeds to step 204.

[0104] Step 204: The first security device forwards the IP message to the second security device disposed at the receiver side.

[0105] Step 205: The second security device parses the IP message and determines whether the RTP packet in the IP message has been securely encapsulated according to the parsing result. If yes, proceed to step 206. If no, proceed to step 207.

[0106] Step 206: The second security device decapsulates the RTP packet to obtain a decapsulated IP message. Then, the process proceeds to step 207.

[0107] Step 207: The second security device sends the IP message to the receiver.

[0108] Based on the method for secure transmission of audio and video streams disclosed in the above embodiment, this embodiment correspondingly discloses a device for secure transmission of audio and video streams. Figure 3 , the device for secure transmission of audio and video streams comprises: an acquisition unit 301, a parsing unit 302, a packaging unit 303 and a transmission unit 304;

[0109] The acquisition unit 301 is used to acquire audio and video related protocol messages and real-time transport protocol RTP packets; the RTP packets include audio and video streams;

[0110] The parsing unit 302 is used to parse the audio and video related protocol message and extract element information; the element information includes creator, port, and streaming media type information;

[0111] The encapsulation unit 303 is used to securely encapsulate the RTP packet determined to need protection based on the element information; the secure encapsulation includes encryption and adding an integrity check value I CV;

[0112] The transmission unit 304 is used to transmit the securely encapsulated RTP packet; the securely encapsulated RTP packet is used for I CV verification and decryption.

[0113] Optionally, the encapsulation unit 303 includes:

[0114] A receiving subunit, used for receiving configuration information from a management interface;

[0115] A selection subunit, used to determine the type of element that needs to be protected in the element information through the RTP packet selector in the configuration information;

[0116] The determination subunit is used to determine that the RTP packet corresponding to the element type is the RTP packet that needs to be protected.

[0117] Optionally, the audio and video related protocol message and the RTP packet are transmitted from the sender to the receiver in the form of an IP message, and the acquisition unit 301 is used to:

[0118] The security device at the sender side captures the IP message sent by the sender.

[0119] Optionally, the transmission unit 304 includes:

[0120] The sending subunit is used for the security device on the sender side to send the securely encapsulated RTP packet and the audio and video related protocol message to the receiver in the form of an encapsulated IP message;

[0121] The capture subunit is used for the security device on the receiving side to capture the encapsulated IP message, and to perform ICV verification and decryption on the securely encapsulated RTP packet.

[0122] Optionally, the encapsulation unit 303 includes:

[0123] The encryption subunit is used to encrypt the RTP packet that needs to be protected by using an encryption algorithm and a key to obtain an encrypted packet;

[0124] The I CV subunit is used to calculate the checksum of the encrypted packet by using a digest algorithm and a key used to calculate the digest information to obtain the I CV;

[0125] The encapsulation subunit is used to combine the encrypted packet, I CV and key index as the securely encapsulated RTP packet; the key index is used to obtain the encryption algorithm, the key, the digest algorithm and the key used to calculate the digest information.

[0126] Optionally, the capture subunit comprises:

[0127] A splitting subunit, used for the security device at the receiving side to split the RTP packet after the security encapsulation into an encrypted receiving packet and an I CV;

[0128] a calculation subunit, configured to calculate a checksum of the encrypted received packet as a control value according to the key used to calculate the summary information and the digest algorithm when the security device at the receiving side obtains the key used to calculate the summary information and the digest algorithm through the key index;

[0129] A control subunit, used for passing the I CV verification when the control value is the same as the I CV;

[0130] Also used for when the control value and the I CV are different, the I CV verification fails;

[0131] The splitting subunit is further configured to cause the I CV verification to fail when the security device at the receiving side fails to obtain the key used to calculate the summary information and the summary algorithm through the key index.

[0132] Optionally, the capture subunit comprises:

[0133] A judgment subunit, configured to decrypt the securely encapsulated RTP packet according to the key and the encryption algorithm when the security device at the receiving side obtains the key and the encryption algorithm according to the key index;

[0134] A decryption subunit, used for the security device at the receiving side to decrypt the securely encapsulated RTP packet according to the key and the encryption algorithm;

[0135] The judgment subunit is further configured to determine that decryption fails when the security device at the receiving side fails to obtain the key and the encryption algorithm according to the key index.

[0136] Optionally, the device further comprises:

[0137] The forwarding unit is used to transmit RTP packets that do not require protection.

[0138] Based on the above-mentioned method for secure transmission of audio and video streams, the present application also discloses a system for secure transmission of audio and video streams, which is used to implement the above-mentioned method. Figure 4 , the system comprises: a safety device 401 arranged at the sender side and a safety device 402 arranged at the receiver side;

[0139] The security device 401 disposed on the sender side is used to capture the audio and video stream from the sender, securely encapsulate the audio and video stream, and send the securely encapsulated audio and video stream to the receiver;

[0140] The security device 402 disposed on the receiving side is used to capture the securely encapsulated audio and video streams and decapsulate the securely encapsulated audio and video streams.

[0141] In the system described in this embodiment, the security device includes an audio and video related protocol message parsing module, a storage module, an RTP encapsulation / decapsulation module, a calculation module, a cryptographic operation module and a network communication module.

[0142] The audio and video related protocol message parsing module is used to parse audio and video related protocol messages, such as Session Initiation Protocol SIP (Session initiat ion Protocol), Real Time Streaming Protocol RTSP (Real Time Streaming Protocol), Open Network Video Interface Forum ONVIF (Open Network Video Interface Forum), Session Description Protocol SDP (Session Description Protocol), etc. It is also used to track the RTP protocol session establishment process and extract element information, such as port number, RTP payload type, encoding format, creator, etc.

[0143] The RTP encapsulation / decapsulation module is used to implement the encapsulation and decapsulation of RTP packets. The cryptographic operation module is used to provide cryptographic operation capabilities for the RTP encapsulation / decapsulation module. The network communication module is used to receive IP messages and send them to the audio and video related protocol message parsing module for processing, or send the processed IP messages out. The storage module is used to store configuration information, key information, calculation data, binary programs or codes necessary for device operation, system images, etc. The calculation module is used to provide calculation capabilities for other modules.

[0144] The embodiments in this specification are described in a progressive manner. As for the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the methods.

[0145] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0146] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0147] The features described in the embodiments of this specification can be replaced or combined with each other, so that professional and technical personnel in this field can implement or use the present application.

[0148] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for securely transmitting audio and video streams, characterized in that: include: Acquire audio and video related protocol messages and real-time transport protocol RTP packets; the RTP packets include audio and video streams; Parsing the audio and video related protocol messages to extract element information; The element information includes creator, port, and streaming media type information; Based on the element information, the RTP packet determined to be in need of protection is securely encapsulated; the secure encapsulation includes encryption and adding an integrity check value ICV; Transmit the securely encapsulated RTP packet; the securely encapsulated RTP packet is used for ICV verification and decryption.

2. The method according to claim 1, characterized in that: Determining the RTP packet that needs to be protected based on the element information includes: Receive configuration information from the management interface; Determine the element type that needs to be protected in the element information through the RTP packet selector in the configuration information; Determine that the RTP packet corresponding to the element type is the RTP packet that needs to be protected.

3. The method according to claim 1, characterized in that The audio and video related protocol message and the RTP packet are transmitted from the sender to the receiver in the form of an IP message, and the obtaining of the audio and video related protocol message and the real-time transport protocol RTP packet includes: The security device at the sender side captures the IP message sent by the sender.

4. The method according to claim 3, characterized in that: The RTP packet after the transmission security encapsulation includes: The security device at the sender side sends the securely encapsulated RTP packet and the audio and video related protocol message to the receiver in the form of an encapsulated IP message; The security device on the receiving side captures the encapsulated IP message, and performs ICV verification and decryption on the securely encapsulated RTP packet.

5. The method according to claim 1, characterized in that The step of securely encapsulating the RTP packets that are determined to be in need of protection includes: The RTP packet to be protected is encrypted by using an encryption algorithm and a key to obtain an encrypted packet; Calculate the checksum of the encrypted packet using a digest algorithm and a key used to calculate the digest information to obtain an ICV; The encrypted packet, ICV and key index are combined as the securely encapsulated RTP packet; the key index is used to obtain the encryption algorithm, the key, the digest algorithm and the key used to calculate the digest information.

6. The method according to claim 4 or 5, characterized in that: The performing ICV verification on the securely encapsulated RTP packet includes: The security device at the receiving side splits the securely encapsulated RTP packet into an encrypted receiving packet and an ICV; When the security device at the receiving side obtains the key used to calculate the summary information and the digest algorithm through the key index, the checksum of the encrypted received packet is calculated as a control value according to the key used to calculate the summary information and the digest algorithm; When the control value and the ICV are the same, the ICV verification passes; When the control value and the ICV are different, the ICV verification fails; When the security device at the receiving side fails to obtain the key used to calculate the summary information and the summary algorithm through the key index, the ICV verification fails.

7. The method according to claim 4 or 5, characterized in that: Decrypting the securely encapsulated RTP packet includes: When the security device at the receiving side obtains the key and the encryption algorithm according to the key index, decrypts the securely encapsulated RTP packet according to the key and the encryption algorithm; When the security device at the receiving side fails to obtain the key and the encryption algorithm according to the key index, decryption fails.

8. The method according to claim 2, characterized in that: After determining that the RTP packet corresponding to the element type is the RTP packet that needs to be protected, the method further includes: Transmit RTP packets that do not require protection.

9. A device for secure transmission of audio and video streams, characterized in that: include: Acquisition unit, parsing unit, encapsulation unit and transmission unit; The acquisition unit is used to acquire audio and video related protocol messages and real-time transport protocol RTP packets; the RTP packets include audio and video streams; The parsing unit is used to parse the audio and video related protocol messages and extract element information; the element information includes creator, port, and streaming media type information; The encapsulation unit is used to securely encapsulate the RTP packet determined to need protection based on the element information; the secure encapsulation includes encryption and adding an integrity check value ICV; The transmission unit is used to transmit the securely encapsulated RTP packet; the securely encapsulated RTP packet is used for ICV verification and decryption.

10. A system for secure transmission of audio and video streams, characterized in that: For implementing the method described in any one of claims 1 to 8, the system comprises: a safety device arranged at a sender side and a safety device arranged at a receiver side; The security device provided at the sender side is used to capture the audio and video stream from the sender, securely encapsulate the audio and video stream, and send the securely encapsulated audio and video stream to the receiver; The security device arranged at the receiving side is used to capture the securely encapsulated audio and video stream and decapsulate the securely encapsulated audio and video stream.

Images